From ssilva at SGVWATER.COM  Fri Oct  1 00:23:21 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:05 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2908.1137101225.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel Bird wrote:
| Scott Silva wrote:
|
| snip ...
| | | So am I. I have many systems setup this way and:
| | |
| | |         grep URIBL_ /var/log/maillog
| | |
| | With grep URIBL I get nothing, but with grep URI I get lots of hits.
| | I am using the spamassassin prefs from your site.
| |
| |
| |> Please send some (but NOT all :) of the log entries that are found
| with
| |> "grep URI"
|
| Just 3 log entries, and I see SC_URI, WS_URI etc...
| Same thing or not??
|
|
|> Yes, sort of, but that looks like you have the SURBL tests defined
|> somewhere in the SA config files as per the 2.6x way. The new names for
|> them are URIBL_xx_SURBL.
|> Check your /etc/mail/spamassassin (or even your spam.assassin.prefs.conf
|> file ) directory for any rules with those names and remove them. Then
|> make sure you have the latest Net::DNS module installed and the line:
|
|> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL
|
|> is uncommented in  /etc/mail/spamassassin/init.pre (that's the
default btw)
|
|> Dan
/etc/mail/spamassassin is clean (empty as a matter of fact),  and there
are no such rules in spam.assassin.prefs.conf. I found an old user_prefs
in /root/.spamassassin and have killed it. I have no
/etc/mail/spamassassin/init.pre it is in /usr/etc/mail/spamassassin/ but
that line is <not> commented out. I could use a good sample of a URIBL
rich email though.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBXJVpRADw9lziUqQRAk+NAJ9vooC0j5+QBjoIX/aTnl3OD3nSSQCfcmhf
/97WkfuZcxshtopVEmFw6ok=
=5kpU
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dbird at SGHMS.AC.UK  Fri Oct  1 01:09:34 2004
From: dbird at SGHMS.AC.UK (Daniel Bird)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2909.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
<snip>

>
> /etc/mail/spamassassin is clean (empty as a matter of fact),  and there
> are no such rules in spam.assassin.prefs.conf. I found an old user_prefs
> in /root/.spamassassin and have killed it. I have no
> /etc/mail/spamassassin/init.pre it is in /usr/etc/mail/spamassassin/ but
> that line is <not> commented out. I could use a good sample of a URIBL
> rich email though.


Here's one that definitely matches: http://www.sghms.ac.uk/test_SURBL.txt
Save that to a file and run spamassassin -D -t <saved-file on it .

That should give you a debug output, it'll tell you where your default
rules are ( /usr/etc/mail/spamassassin/ by the looks of things) and what
it matches on.

go to /usr/etc/mail/spamassassin/ (if that's where the SA debug says
your cf files are ) and do

grep URI *

That should show up which files contain the URI rules.

You may also want to to:
spamaassassin --lint to make sure all your cf files are OK. If not,
it'll tell you which ones are borked and you can remove the offending
entries.

Dan




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Fri Oct  1 03:08:56 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2910.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On Thu, 30 Sep 2004, Dean Jones wrote:

> Daniel Bird wrote:
>> Dean Jones wrote:
>>
>>> Daniel Bird wrote:
>>>
>>>> Jeff A. Earickson wrote:
>>>>
>>>>> This issue has been reported by myself and Ugo earlier this week
>>>>> on the list.  I'm at a loss too.  When the next version of MS
>>>>> comes out, I will upgrade and see if the problem remains.
>>>>>
>>>> Just noticed I had a similar problem after upgrading to SA3, although
>>>> all my RBL checks failed to show up not just the SURBL ones.
>>>> Installation of a newer version of Net::DNS (v 0.48) has cured it...

Nice to know I'm not alone :)

>>>
>>> the Net::DNS install cured the SURBL as well as the RBL?
>>>
>>> I had to upgrade my Net::DNS as well, but that only fixed my RBL
>>> checks...
>>>
>>> i either need a pint or some aspirin!
>>
>>
>> Just a thought, what do you see if you set the follwing in
>> MailScanner.conf ?
>>
>> Debug = yes
>> Debug SpamAssassin = yes
>>
>> Anyhting like this? :
>>
>> debug: using "/etc/mail/spamassassin/init.pre" for site rules init.pre
>> debug: config: read file /etc/mail/spamassassin/init.pre
>> and
>> debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
>> debug:plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
>> debug:plugin: registered
>> Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x989052c)
>>
>
> Well i re-installed Net::DNS from scratch (killed all Net::DNS related
> stuff) and the SURBL checks have started.
> I'm still scratching my head though, but hey it's working.


I'd like to try that too. How do I remove the 'old' Net::DNS 0.48 and
re-install it?

Thanx!!
Remco

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From p.g.m.peters at utwente.nl  Fri Oct  1 08:28:22 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:06 2006
Subject: Mark mail as spam for known destination and origin
Message-ID: <mailman.2911.1137101226.24926.mailscanner@lists.mailscanner.info>

On Thu, 30 Sep 2004 10:25:03 +0100, you wrote:

>>Is it possible to mark a mail as spam on the following conditions:
>>
>>if a mail is from bla@domain.com and the destination is fubar@mydomain.com
>>then the mail is spam.
>>
>>BUT
>>
>>if a mail is from bla@domain.com and the destination is me@mydomain.com then
>>the mail isn't spam.
>>
>>I thought of using the spam.blacklist.rules and write a rule like this:
>>
>>From: bla@destination.com To:fubar@mydomain.com Yes
>>
>>But that doesn't work out (you can't make combinations on 1 line)
>
>Yes you can, you forgot to put in the word "and" in the middle.

So when I want to consider everything to spam-addr@mydomain.com to be
spam except mail from me@mydomain.com I use:

To: spam-addr@mydomain.com yes
To: spam-addr@mydomain.com and From: me@mydomain.com no

Or should I put the second line in spam.whitelist.rules with a "yes"
instead of a "no"?

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From misterpo at IFRANCE.COM  Fri Oct  1 09:11:17 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner, SA and Bayes
Message-ID: <mailman.2912.1137101226.24926.mailscanner@lists.mailscanner.info>

Hello all,

My config is Postfix 2.1.5, MailScanner 4.32.51, clamAV 0.80rc3, SA
installed via perl CPAN on a RedHat 9 box.

How can I make sure that Bayes is activated for SA ?

I have checked my /etc/MailScanner/spam.assassin.prefs.conf file and Bayes
looks OK.

If I run spamassassin --prefspath/etc/MailScanner/spam.assassin.prefs.conf -
-lint -D, I get the following output :

debug: using "/usr/share/spamassassin" for default rules dir
debug: using "/etc/mail/spamassassin" for site rules dir
debug: using "/root/.spamassassin" for user state dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: bayes: 24697 tie-ing to DB file
R/O /usr/var/spool/spamfilter/bayes_toks
debug: bayes: 24697 tie-ing to DB file
R/O /usr/var/spool/spamfilter/bayes_seen
debug: bayes: found bayes db version 2
debug: bayes: Not available for scanning, only 1 spam(s) in Bayes DB < 200
debug: bayes: 24697 untie-ing
debug: bayes: 24697 untie-ing db_toks
debug: bayes: 24697 untie-ing db_seen
debug: Score set 1 chosen.
debug: Initialising learner
debug: bayes: 24697 tie-ing to DB file
R/O /usr/var/spool/spamfilter/bayes_toks
debug: bayes: 24697 tie-ing to DB file
R/O /usr/var/spool/spamfilter/bayes_seen
debug: bayes: found bayes db version 2
debug: bayes: Not available for scanning, only 1 spam(s) in Bayes DB < 200
debug: bayes: 24697 untie-ing
debug: bayes: 24697 untie-ing db_toks
debug: bayes: 24697 untie-ing db_seen
debug: running header regexp tests; score so far=0

Any idea ?

Thanks in advance,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 09:28:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Mark mail as spam for known destination and origin
Message-ID: <mailman.2913.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 08:28 01/10/2004, you wrote:
>On Thu, 30 Sep 2004 10:25:03 +0100, you wrote:
>
> >>Is it possible to mark a mail as spam on the following conditions:
> >>
> >>if a mail is from bla@domain.com and the destination is fubar@mydomain.com
> >>then the mail is spam.
> >>
> >>BUT
> >>
> >>if a mail is from bla@domain.com and the destination is me@mydomain.com
> then
> >>the mail isn't spam.
> >>
> >>I thought of using the spam.blacklist.rules and write a rule like this:
> >>
> >>From: bla@destination.com To:fubar@mydomain.com Yes
> >>
> >>But that doesn't work out (you can't make combinations on 1 line)
> >
> >Yes you can, you forgot to put in the word "and" in the middle.
>
>So when I want to consider everything to spam-addr@mydomain.com to be
>spam except mail from me@mydomain.com I use:
>
>To: spam-addr@mydomain.com yes
>To: spam-addr@mydomain.com and From: me@mydomain.com no

Swap those 2 rules over. You want the most specific rules first, otherwise
the general rule matches and the specific rule will be ignored.


--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 09:33:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2914.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I haven't changed the SA3 code, it all works on my production and
development systems, as do Steve's systems.

At 21:47 30/09/2004, you wrote:
>This issue has been reported by myself and Ugo earlier this week
>on the list.  I'm at a loss too.  When the next version of MS
>comes out, I will upgrade and see if the problem remains.
>
>Jeff Earickson
>Colby College
>
>On Thu, 30 Sep 2004, Dean Jones wrote:
>
>>Date: Thu, 30 Sep 2004 12:49:31 -0700
>>From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: MailScanner + SA3 + SURBL not registering.
>>
>>Steve Swaney wrote:
>>>>>SNIPPED <<<
>>>>
>>>>Doing the command that you suggested manages to make the SURBL checks
>>>>work.
>>>>
>>>>It almost as if there is a spamassassin option in MailScanner.conf that
>>>>turns it off.
>>>
>>>
>>>There is a command in MailScanner that turns SpamAssassin off;
>>>
>>>         Use SpamAssassin = yes
>>>
>>>But if you have SpamAssassin turned on in MS and the test above works,
>>>MailScanner should run the exactly as the test does. How are you sure thst
>>>MS is not running the tests?
>>
>>Use SpamAssassin is set to yes, and SA is doing other checks.
>>
>>The only way i have to guess is just by the data SA drops into the logs.
>>It never hits on any URIBL_* scores running natively.
>>
>>I can forward SURBL test emails through from outside addresses and they
>>don't get hit by the SURBL checks.
>>
>>I'm at a loss :)
>>otherwise SA 3 is working great.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct  1 09:50:16 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner being killed and restarted until system hangs
Message-ID: <mailman.2915.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi

there was some fun last weekend with bitdefender updates, so it might be
best to redo the updates for that (or whatever the fix was).

But also bigevil.cf is *huge*, esp with only 256MB ram you are going to
be much better off installing the  spamcop_uri plugin and using the
surbl.org URI RBL.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


sebastian ruchti wrote:
>>Do you have any custom rulesets for SA?
>>
>
> I'm using SURBL, antidrug & backhair
>
> I'm NOT using bigevil.cf, however.
>
> .sebastian
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From james at GRAYONLINE.ID.AU  Fri Oct  1 09:52:22 2004
From: james at GRAYONLINE.ID.AU (James Gray)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner, SA and Bayes
Message-ID: <mailman.2916.1137101226.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Fri, 1 Oct 2004 06:11 pm, Mister PO wrote:
> Hello all,
>
> My config is Postfix 2.1.5, MailScanner 4.32.51, clamAV 0.80rc3, SA
> installed via perl CPAN on a RedHat 9 box.
>
> How can I make sure that Bayes is activated for SA ?
>
> I have checked my /etc/MailScanner/spam.assassin.prefs.conf file and
> Bayes looks OK.
>
> If I run spamassassin
> --prefspath/etc/MailScanner/spam.assassin.prefs.conf - -lint -D, I get
> the following output :

...snipped...
> debug: bayes: found bayes db version 2

This is OK if you're running SA 2.6x.  However, if you're running SA 3.0, 
this should be "db version 3".  If you're running SA 3.0, stop MailScanner, 
and run "sa-learn --sync".  Then restart MailScanner.

> debug: bayes: Not available for scanning, only 1 spam(s) in Bayes DB <
> 200 debug: bayes: 24697 untie-ing

Here's the main problem.  Your bayes database hasn;t seen enough spam yet.  
It requires a minimum 200 ham and 200 spam before it will be used to 
calssify new messages.

You can get a good corpus to "train" bayes with from here:
http://www.spamarchive.org/

..and read the docs about "sa-learn" here:
http://spamassassin.apache.org/full/3.0.x/dist/doc/sa-learn.html

Note that the files from spamarchive.org are in MBOX format, so make sure 
you tell "sa-learn", like this (all on one line, and best to run it as the 
same user MailScanner run's as):

sa-learn -p /opt/MailScanner/etc/spam.assassin.prefs.conf \
--mbox \
--spam corpus.file

Cheers,

James
-- 
Westheimer's Discovery:
        A couple of months in the laboratory can frequently save a
couple of hours in the library.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From lists at DVD-GOETSCH.DE  Fri Oct  1 10:12:09 2004
From: lists at DVD-GOETSCH.DE (sebastian ruchti)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner being killed and restarted until system hangs
Message-ID: <mailman.2917.1137101226.24926.mailscanner@lists.mailscanner.info>

Thank you all for your fast responses.

It was indeed the bitdefender update "fun" that made the box go down....
... unfortunetaly I wasn't monitoring the list that weekend....

I'm NOT using bigevil, but SURBL.....

well - all's running fine and I'm just waiting to receive Julian's book in
order to get somehow deeper involved with MailScanner ;-)

.sebastian

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Martin Hepworth
> Sent: Friday, October 01, 2004 10:50 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner being killed and restarted until system hangs
>
>
> Hi
>
> there was some fun last weekend with bitdefender updates, so it might be
> best to redo the updates for that (or whatever the fix was).
>
> But also bigevil.cf is *huge*, esp with only 256MB ram you are going to
> be much better off installing the  spamcop_uri plugin and using the
> surbl.org URI RBL.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> sebastian ruchti wrote:
> >>Do you have any custom rulesets for SA?
> >>
> >
> > I'm using SURBL, antidrug & backhair


> >
> > I'm NOT using bigevil.cf, however.
> >
> > .sebastian
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From misterpo at IFRANCE.COM  Fri Oct  1 10:12:44 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner, SA and Bayes
Message-ID: <mailman.2918.1137101226.24926.mailscanner@lists.mailscanner.info>

Hi,

Thanks a lot for this information. I'm always impress how fast people
respond to my queries.

Do you know if I can train SA with a Netscape 7 Inobx file containing all
my old spam messages ?

Thanks a lot,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at BARENDSE.TO  Fri Oct  1 10:17:47 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2919.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Strange.... I can confirm the same problem.

I don't know how to remove a perl module, after the suggestion on this
list I simply re-installed the tarball and restarted MailScanner but still
no URI hits from MS.

Can I do a forced re-install of all the perl modules in the
install-SA-CLAMAV package?


On Fri, 1 Oct 2004, Julian Field wrote:

> I haven't changed the SA3 code, it all works on my production and
> development systems, as do Steve's systems.
>
> At 21:47 30/09/2004, you wrote:
>> This issue has been reported by myself and Ugo earlier this week
>> on the list.  I'm at a loss too.  When the next version of MS
>> comes out, I will upgrade and see if the problem remains.
>>
>> Jeff Earickson
>> Colby College
>>
>> On Thu, 30 Sep 2004, Dean Jones wrote:
>>
>>> Date: Thu, 30 Sep 2004 12:49:31 -0700
>>> From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>
>>> Steve Swaney wrote:
>>>>>> SNIPPED <<<
>>>>>
>>>>> Doing the command that you suggested manages to make the SURBL checks
>>>>> work.
>>>>>
>>>>> It almost as if there is a spamassassin option in MailScanner.conf that
>>>>> turns it off.
>>>>
>>>>
>>>> There is a command in MailScanner that turns SpamAssassin off;
>>>>
>>>> Use SpamAssassin = yes
>>>>
>>>> But if you have SpamAssassin turned on in MS and the test above works,
>>>> MailScanner should run the exactly as the test does. How are you sure
>>>> thst
>>>> MS is not running the tests?
>>>
>>> Use SpamAssassin is set to yes, and SA is doing other checks.
>>>
>>> The only way i have to guess is just by the data SA drops into the logs.
>>> It never hits on any URIBL_* scores running natively.
>>>
>>> I can forward SURBL test emails through from outside addresses and they
>>> don't get hit by the SURBL checks.
>>>
>>> I'm at a loss :)
>>> otherwise SA 3 is working great.
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 10:20:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: ANNOUNCE: MailScanner Stable 4.34.8 released
Message-ID: <mailman.2920.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Morning all,

I have just released a new stable version 4.34.8.

When installing this release, you *MUST* upgrade to MIME-tools 5.413 and
MIME-Base64 3.03, MailScanner can no longer be compatible with previous
versions of these packages. This finally gets rid of all the patches
required to MIME-tools.

Lots of new features this month, the main ones are:

- Added "Bounce Spam As Attachment" and "Bounce MCP As Attachment" options.
- Added "Remove These Headers" setting.
- Added MIME-tools 5.413 and MIME-Base64 3.03. *****You must have these
installed.*****
- Added 4 new MCP options: "MCP Modify Subject", "MCP Subject Text",
   "High Scoring MCP Modify Subject", "High Scoring MCP Subject Text".
- Added a "generic" virus scanner. This enables you to write your own
   virus (or other "nasty content") scanner.
- Added a new setting "First Check" so you can control whether the MCP or
   the spam checks are done first.

Download as usual from www.mailscanner.info

The full ChangeLog is this:

* New Features and Improvements *
- Added "Bounce Spam As Attachment" and "Bounce MCP As Attachment" options.
   These will cause the original message (up to the Max SpamAssassin Size so
   it cannot be used for denial-of-service attacks) to be included in the
   bounced message as an RFC/822 attachment, which some mail clients can read
   very nicely. This lets the original sender see what message got bounced.
- Updated the Qmail support. See opencomputing.sf.net for more info on Qmail.
- Changed default supplied values for a few settings. This will have no effect
   on upgraded installations, but will improve resource use for new
   installations, such as not quarantining silent viruses which is pretty
   much a waste of disk space and i/o load.
- Added POSIX back-compatibility switches to scripts wanting to use "tail".
- Added "Remove These Headers" setting to allow arbitrary headers, such as
   delivery receipt requests, to be removed from mail.
- Implemented MCP support for SpamAssassin 3.0.0.
- Published packages for RPM and non-RPM systems to install ClamAV and
   SpamAssassin 3.
- Adapted code to run with MIME-tools 5.412.
- Removed most of the MIME-tools version checks as the new code doesn't
   specify versions for its components.
- Added a load more optional modules to the version number list so we get
   all the modules required by SpamAssassin 3 and Mail::ClamAV.
- Added MIME-tools 5.413 and MIME-Base64 3.03. You must have these installed.
- Updated Catalan reports.
- Added support for NOD32 2.04.
- Added $longspamreport to sender.spam.sa report.
- Update Trend-autoupdate script so it supports Trend's new opr.ini file.
- Added 4 new MCP options to provide the same subject line modifications as
   you can do with spam messages: "MCP Modify Subject", "MCP Subject Text",
   "High Scoring MCP Modify Subject", "High Scoring MCP Subject Text".
   The defaults are the same as for spam.
- Added a "generic" virus scanner. This enables you to write your own
   virus (or other "nasty content") scanner, which produces input which is
   read by MailScanner and used to mark certain files as virus-infected.
   The spec of what output is required from your scanner is in the
   "generic-wrapper" script. It's very simple to use.
- When a child process is HUPped it will now attempt to kill any running
   child scanner processes, to avoid problems with uvscan consuming 100% CPU.
- Timeout code added to AntiVir updating script.
- Added a new setting "First Check" so you can control whether the MCP or
   the spam checks are done first. It is MCP by default as that is how it has
   run in the past, but you may well want to do spam checks first if you
   delete most spam.

* Fixes *
- Fixed another Postfix perl buffering error on a few OS's.
- Added remaining MCP definitions to languages.conf files.
- Fixed installation problems with MIME-Base64.
- Fixed bug in Exim.pm where case of MAIL sender wasn't properly preserved.
- Fixed problem causing bitdefender-autoupdate to hang.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 10:20:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: ANNOUNCE: MailScanner Stable 4.34.8 released
Message-ID: <mailman.2921.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Morning all,

I have just released a new stable version 4.34.8.

When installing this release, you *MUST* upgrade to MIME-tools 5.413 and
MIME-Base64 3.03, MailScanner can no longer be compatible with previous
versions of these packages. This finally gets rid of all the patches
required to MIME-tools.

Lots of new features this month, the main ones are:

- Added "Bounce Spam As Attachment" and "Bounce MCP As Attachment" options.
- Added "Remove These Headers" setting.
- Added MIME-tools 5.413 and MIME-Base64 3.03. *****You must have these
installed.*****
- Added 4 new MCP options: "MCP Modify Subject", "MCP Subject Text",
   "High Scoring MCP Modify Subject", "High Scoring MCP Subject Text".
- Added a "generic" virus scanner. This enables you to write your own
   virus (or other "nasty content") scanner.
- Added a new setting "First Check" so you can control whether the MCP or
   the spam checks are done first.

Download as usual from www.mailscanner.info

The full ChangeLog is this:

* New Features and Improvements *
- Added "Bounce Spam As Attachment" and "Bounce MCP As Attachment" options.
   These will cause the original message (up to the Max SpamAssassin Size so
   it cannot be used for denial-of-service attacks) to be included in the
   bounced message as an RFC/822 attachment, which some mail clients can read
   very nicely. This lets the original sender see what message got bounced.
- Updated the Qmail support. See opencomputing.sf.net for more info on Qmail.
- Changed default supplied values for a few settings. This will have no effect
   on upgraded installations, but will improve resource use for new
   installations, such as not quarantining silent viruses which is pretty
   much a waste of disk space and i/o load.
- Added POSIX back-compatibility switches to scripts wanting to use "tail".
- Added "Remove These Headers" setting to allow arbitrary headers, such as
   delivery receipt requests, to be removed from mail.
- Implemented MCP support for SpamAssassin 3.0.0.
- Published packages for RPM and non-RPM systems to install ClamAV and
   SpamAssassin 3.
- Adapted code to run with MIME-tools 5.412.
- Removed most of the MIME-tools version checks as the new code doesn't
   specify versions for its components.
- Added a load more optional modules to the version number list so we get
   all the modules required by SpamAssassin 3 and Mail::ClamAV.
- Added MIME-tools 5.413 and MIME-Base64 3.03. You must have these installed.
- Updated Catalan reports.
- Added support for NOD32 2.04.
- Added $longspamreport to sender.spam.sa report.
- Update Trend-autoupdate script so it supports Trend's new opr.ini file.
- Added 4 new MCP options to provide the same subject line modifications as
   you can do with spam messages: "MCP Modify Subject", "MCP Subject Text",
   "High Scoring MCP Modify Subject", "High Scoring MCP Subject Text".
   The defaults are the same as for spam.
- Added a "generic" virus scanner. This enables you to write your own
   virus (or other "nasty content") scanner, which produces input which is
   read by MailScanner and used to mark certain files as virus-infected.
   The spec of what output is required from your scanner is in the
   "generic-wrapper" script. It's very simple to use.
- When a child process is HUPped it will now attempt to kill any running
   child scanner processes, to avoid problems with uvscan consuming 100% CPU.
- Timeout code added to AntiVir updating script.
- Added a new setting "First Check" so you can control whether the MCP or
   the spam checks are done first. It is MCP by default as that is how it has
   run in the past, but you may well want to do spam checks first if you
   delete most spam.

* Fixes *
- Fixed another Postfix perl buffering error on a few OS's.
- Added remaining MCP definitions to languages.conf files.
- Fixed installation problems with MIME-Base64.
- Fixed bug in Exim.pm where case of MAIL sender wasn't properly preserved.
- Fixed problem causing bitdefender-autoupdate to hang.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct  1 10:24:30 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2922.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Remco

you don't the spamcop_uri module for sa3.0 it's all built-in.

HOWEVER, the rule syntax is different and I don't think the surbl URI
rules aren't  turned on by default - you need the edit the local.cf to
turn it on. Also make sure the DNS stuff for SA3.0 is turned on as well
(again I think this may be off by default), have a look at the rules in
/usr/local/share/spamassassin) for which settings to add to the local.cf.


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Remco Barendse wrote:
> Strange.... I can confirm the same problem.
>
> I don't know how to remove a perl module, after the suggestion on this
> list I simply re-installed the tarball and restarted MailScanner but still
> no URI hits from MS.
>
> Can I do a forced re-install of all the perl modules in the
> install-SA-CLAMAV package?
>
>
> On Fri, 1 Oct 2004, Julian Field wrote:
>
>> I haven't changed the SA3 code, it all works on my production and
>> development systems, as do Steve's systems.
>>
>> At 21:47 30/09/2004, you wrote:
>>
>>> This issue has been reported by myself and Ugo earlier this week
>>> on the list.  I'm at a loss too.  When the next version of MS
>>> comes out, I will upgrade and see if the problem remains.
>>>
>>> Jeff Earickson
>>> Colby College
>>>
>>> On Thu, 30 Sep 2004, Dean Jones wrote:
>>>
>>>> Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>> From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>>> Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>
>>>> Steve Swaney wrote:
>>>>
>>>>>>> SNIPPED <<<
>>>>>>
>>>>>>
>>>>>> Doing the command that you suggested manages to make the SURBL checks
>>>>>> work.
>>>>>>
>>>>>> It almost as if there is a spamassassin option in MailScanner.conf
>>>>>> that
>>>>>> turns it off.
>>>>>
>>>>>
>>>>>
>>>>> There is a command in MailScanner that turns SpamAssassin off;
>>>>>
>>>>> Use SpamAssassin = yes
>>>>>
>>>>> But if you have SpamAssassin turned on in MS and the test above works,
>>>>> MailScanner should run the exactly as the test does. How are you sure
>>>>> thst
>>>>> MS is not running the tests?
>>>>
>>>>
>>>> Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>
>>>> The only way i have to guess is just by the data SA drops into the
>>>> logs.
>>>> It never hits on any URIBL_* scores running natively.
>>>>
>>>> I can forward SURBL test emails through from outside addresses and they
>>>> don't get hit by the SURBL checks.
>>>>
>>>> I'm at a loss :)
>>>> otherwise SA 3 is working great.
>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> MailScanner thanks transtec Computers for their support
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From davidj at synaq.com  Fri Oct  1 10:43:56 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:06 2006
Subject: bitdefender issues
Message-ID: <mailman.2923.1137101226.24926.mailscanner@lists.mailscanner.info>

Hi,

Just a quick note to let the group know that Bitdefender does not work
with kernel 2.6.8.  I asked Bitdefender what the solution was they said
downgrade to 2.6.5.  We have now decided to scrap Bitdefender.

Just incase anyone would like to know.

-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From raymond at PROLOCATION.NET  Fri Oct  1 10:53:59 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:06 2006
Subject: bitdefender issues
Message-ID: <mailman.2924.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

> Just a quick note to let the group know that Bitdefender does not work
> with kernel 2.6.8.  I asked Bitdefender what the solution was they said
> downgrade to 2.6.5.  We have now decided to scrap Bitdefender.
>
> Just incase anyone would like to know.

We decided to do that same, for now, with the load issues last week we
were not really happy.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 11:21:50 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2925.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I think all this stuff is switched on by default.
The only change I made was to set
         lock_method flock
as the default is very slow locking that is compatible with NFS. As most
people don't share the Bayes DB over NFS, I don't understand why they
didn't make the faster version the default. But they didn't. Ho hum.

At 10:24 01/10/2004, you wrote:
>Remco
>
>you don't the spamcop_uri module for sa3.0 it's all built-in.
>
>HOWEVER, the rule syntax is different and I don't think the surbl URI
>rules aren't  turned on by default - you need the edit the local.cf to
>turn it on. Also make sure the DNS stuff for SA3.0 is turned on as well
>(again I think this may be off by default), have a look at the rules in
>/usr/local/share/spamassassin) for which settings to add to the local.cf.
>
>
>--
>Martin Hepworth
>Snr Systems Administrator
>Solid State Logic
>Tel: +44 (0)1865 842300
>
>
>Remco Barendse wrote:
>>Strange.... I can confirm the same problem.
>>
>>I don't know how to remove a perl module, after the suggestion on this
>>list I simply re-installed the tarball and restarted MailScanner but still
>>no URI hits from MS.
>>
>>Can I do a forced re-install of all the perl modules in the
>>install-SA-CLAMAV package?
>>
>>
>>On Fri, 1 Oct 2004, Julian Field wrote:
>>
>>>I haven't changed the SA3 code, it all works on my production and
>>>development systems, as do Steve's systems.
>>>
>>>At 21:47 30/09/2004, you wrote:
>>>
>>>>This issue has been reported by myself and Ugo earlier this week
>>>>on the list.  I'm at a loss too.  When the next version of MS
>>>>comes out, I will upgrade and see if the problem remains.
>>>>
>>>>Jeff Earickson
>>>>Colby College
>>>>
>>>>On Thu, 30 Sep 2004, Dean Jones wrote:
>>>>
>>>>>Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>>>From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>>>Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>>>Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>>
>>>>>Steve Swaney wrote:
>>>>>
>>>>>>>>SNIPPED <<<
>>>>>>>
>>>>>>>
>>>>>>>Doing the command that you suggested manages to make the SURBL checks
>>>>>>>work.
>>>>>>>
>>>>>>>It almost as if there is a spamassassin option in MailScanner.conf
>>>>>>>that
>>>>>>>turns it off.
>>>>>>
>>>>>>
>>>>>>
>>>>>>There is a command in MailScanner that turns SpamAssassin off;
>>>>>>
>>>>>>Use SpamAssassin = yes
>>>>>>
>>>>>>But if you have SpamAssassin turned on in MS and the test above works,
>>>>>>MailScanner should run the exactly as the test does. How are you sure
>>>>>>thst
>>>>>>MS is not running the tests?
>>>>>
>>>>>
>>>>>Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>>
>>>>>The only way i have to guess is just by the data SA drops into the
>>>>>logs.
>>>>>It never hits on any URIBL_* scores running natively.
>>>>>
>>>>>I can forward SURBL test emails through from outside addresses and they
>>>>>don't get hit by the SURBL checks.
>>>>>
>>>>>I'm at a loss :)
>>>>>otherwise SA 3 is working great.
>>>
>>>
>>>--
>>>Julian Field
>>>www.MailScanner.info
>>>MailScanner thanks transtec Computers for their support
>>>Buy the MailScanner book at www.MailScanner.info/store
>>>
>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>**********************************************************************
>
>This email and any files transmitted with it are confidential and
>intended solely for the use of the individual or entity to whom they
>are addressed. If you have received this email in error please notify
>the system manager.
>
>This footnote confirms that this email message has been swept
>for the presence of computer viruses and is believed to be clean.
>
>**********************************************************************
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Fri Oct  1 11:31:25 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2926.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have two identical boxes, both running the same distro and module
versions and MailScanner version. One box was installed just one week
after the other.

I use the exact same config files for the boxes (I keep one as my main
config file box and simply clone the config to the other box only
replacing the hostname).

On one box it is working as it should, on the other box it isn't.

Both local.cf files on either box is completely empty. I really don't know
where to look for the problem.



On Fri, 1 Oct 2004, Julian Field wrote:

> I think all this stuff is switched on by default.
> The only change I made was to set
>        lock_method flock
> as the default is very slow locking that is compatible with NFS. As most
> people don't share the Bayes DB over NFS, I don't understand why they
> didn't make the faster version the default. But they didn't. Ho hum.
>
> At 10:24 01/10/2004, you wrote:
>> Remco
>>
>> you don't the spamcop_uri module for sa3.0 it's all built-in.
>>
>> HOWEVER, the rule syntax is different and I don't think the surbl URI
>> rules aren't  turned on by default - you need the edit the local.cf to
>> turn it on. Also make sure the DNS stuff for SA3.0 is turned on as well
>> (again I think this may be off by default), have a look at the rules in
>> /usr/local/share/spamassassin) for which settings to add to the local.cf.
>>
>>
>> --
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Remco Barendse wrote:
>>> Strange.... I can confirm the same problem.
>>>
>>> I don't know how to remove a perl module, after the suggestion on this
>>> list I simply re-installed the tarball and restarted MailScanner but still
>>> no URI hits from MS.
>>>
>>> Can I do a forced re-install of all the perl modules in the
>>> install-SA-CLAMAV package?
>>>
>>>
>>> On Fri, 1 Oct 2004, Julian Field wrote:
>>>
>>>> I haven't changed the SA3 code, it all works on my production and
>>>> development systems, as do Steve's systems.
>>>>
>>>> At 21:47 30/09/2004, you wrote:
>>>>
>>>>> This issue has been reported by myself and Ugo earlier this week
>>>>> on the list.  I'm at a loss too.  When the next version of MS
>>>>> comes out, I will upgrade and see if the problem remains.
>>>>>
>>>>> Jeff Earickson
>>>>> Colby College
>>>>>
>>>>> On Thu, 30 Sep 2004, Dean Jones wrote:
>>>>>
>>>>>> Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>>>> From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>>>>> Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>>>
>>>>>> Steve Swaney wrote:
>>>>>>
>>>>>>>>> SNIPPED <<<
>>>>>>>>
>>>>>>>>
>>>>>>>> Doing the command that you suggested manages to make the SURBL checks
>>>>>>>> work.
>>>>>>>>
>>>>>>>> It almost as if there is a spamassassin option in MailScanner.conf
>>>>>>>> that
>>>>>>>> turns it off.
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> There is a command in MailScanner that turns SpamAssassin off;
>>>>>>>
>>>>>>> Use SpamAssassin = yes
>>>>>>>
>>>>>>> But if you have SpamAssassin turned on in MS and the test above works,
>>>>>>> MailScanner should run the exactly as the test does. How are you sure
>>>>>>> thst
>>>>>>> MS is not running the tests?
>>>>>>
>>>>>>
>>>>>> Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>>>
>>>>>> The only way i have to guess is just by the data SA drops into the
>>>>>> logs.
>>>>>> It never hits on any URIBL_* scores running natively.
>>>>>>
>>>>>> I can forward SURBL test emails through from outside addresses and they
>>>>>> don't get hit by the SURBL checks.
>>>>>>
>>>>>> I'm at a loss :)
>>>>>> otherwise SA 3 is working great.
>>>>
>>>>
>>>> --
>>>> Julian Field
>>>> www.MailScanner.info
>>>> MailScanner thanks transtec Computers for their support
>>>> Buy the MailScanner book at www.MailScanner.info/store
>>>>
>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From bg.mahesh at INDIAINFO.COM  Fri Oct  1 11:39:52 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:06 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.2927.1137101226.24926.mailscanner@lists.mailscanner.info>

hi

I am not able to install MS 4.34.8-1. The error message I get is,

Installing tnef decoder
Preparing...                ########################################### [100%]
        package tnef-1.2.3.1-1 is already installed

Now to install MailScanner itself.

error: Failed dependencies:
        perl(MIME::QuotedPrint) >= 3.03 is needed by (installed) perl-MIME-tools-5.413-1

My setup

Redhat Linux
Perl 5.8.3
MIME::QuotedPrint   : 3.03
MIME::Tools         : 5.413
MIME::Base64        : 3.03

What am I doing wrong?

--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 12:07:18 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.2928.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:39 01/10/2004, you wrote:
>hi
>
>I am not able to install MS 4.34.8-1. The error message I get is,
>
>Installing tnef decoder
>Preparing...                ########################################### [100%]
>         package tnef-1.2.3.1-1 is already installed
>
>Now to install MailScanner itself.
>
>error: Failed dependencies:
>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> perl-MIME-tools-5.413-1
>
>My setup
>
>Redhat Linux
>Perl 5.8.3
>MIME::QuotedPrint   : 3.03
>MIME::Tools         : 5.413
>MIME::Base64        : 3.03
>
>What am I doing wrong?

I don't know quite what is going on here, I saw a few similar problems
myself sometimes, but I couldn't come up with a definite reason for it. It
knows you have QuotedPrint 3.03 but then says you need it installed. All I
ended up doing was forcing the install of the main MailScanner rpm.

What happens if you rpm -e MIME::Base64 and then reinstall it?

Anyone else got any ideas on this?



--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From danslists at CONPOINT.COM  Fri Oct  1 12:58:00 2004
From: danslists at CONPOINT.COM (Dan Spray)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2929.1137101226.24926.mailscanner@lists.mailscanner.info>

Hello,



I am using MailScanner 4.33.3-1 and am using the spam.whitelist.rules file
to whitelist for a few customers that thought my scanning was to tight.  My
spam has gotten so much better with the latest version of MailScanner that I
can actually go through the spam I do get and try to find a way to block it.
It appears to me that if a message is sent to multiple recipients and one of
those recipients is in the spam.whitelist.rules file that the message is
whitelisted for everyone.  Is this correct?  If so is there a way to block
it to everyone other than the one whitelisted?



Thanks in advance,



Dan



--
Dan Spray, Director of Internet Operations dan@conpoint.com
<BLOCKED::BLOCKED::BLOCKED::BLOCKED::BLOCKED::mailto:dan@conpoint.com>
Connecting Point Norfolk, NE <
<BLOCKED::BLOCKED::BLOCKED::BLOCKED::BLOCKED::http://www.conpoint.com/>
http://www.conpoint.com/>
Voice - 402.844.2308 Fax - 402.371.4515

"The porcupine with the sharpest quills gets stuck on a tree more often."

--

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 13:56:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2930.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12:58 01/10/2004, you wrote:
>I am using MailScanner 4.33.3-1 and am using the spam.whitelist.rules file
>to whitelist for a few customers that thought my scanning was to tight.  My
>spam has gotten so much better with the latest version of MailScanner that I
>can actually go through the spam I do get and try to find a way to block it.
>It appears to me that if a message is sent to multiple recipients and one of
>those recipients is in the spam.whitelist.rules file that the message is
>whitelisted for everyone.  Is this correct?

Yes.

>   If so is there a way to block
>it to everyone other than the one whitelisted?

What you need is a Custom Function that edits the recipients list in each
message, according to whether they want to be filtered or not. I've done
something like this already, just haven't yet published it.

What form would people like it in? Added to the per-user white and black
list code?
It would have to be a simple "remove them from the message if it's in their
blacklist or not in their whitelist".

Can people see any problems with this? Something is nagging me that this
isn't the correct functionality, but I can't see what the right answer is
for definite.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wont-i at wkh.org  Fri Oct  1 14:19:52 2004
From: wont-i at wkh.org (William K. Hardeman)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2931.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
--On Friday, October 01, 2004 13:56 +0100 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> What form would people like it in? Added to the per-user white and black
> list code?
> It would have to be a simple "remove them from the message if it's in
> their
> blacklist or not in their whitelist".
>
> Can people see any problems with this? Something is nagging me that this
> isn't the correct functionality, but I can't see what the right answer is
> for definite.

The only problem I can see with it right now is that there will have to be
a rule this rule to check the To:, CC: and BCC: headers to ensure that it
gets disposed of properly in the case that all possible local recipients
are removed. I'm sure you've probably already thought of that, though. :-)

Will
--
----------------------------------------------------------------------------
William K. Hardeman
wont-i@wkh.org
http://www.wkh.org

The most exciting phrase to hear in science, the one that heralds new
discoveries, is not "Eureka!" (I found it!) but "That's funny ..."
                -- Isaac Asimov

Always listen to experts. They'll tell you what can't be done and why. Then
do it.
--Robert A. Heinlein

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From misterpo at IFRANCE.COM  Fri Oct  1 14:24:05 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner, SA and Bayes : still problems
Message-ID: <mailman.2932.1137101226.24926.mailscanner@lists.mailscanner.info>

What happens with the sa-learn process is very strange.

I have run sa-learn on several files downloaded from spamarchive.org and
when I run spamassassin --lint -D, it seems that content of Bayes DB is
removed !

Learned from 913 message(s) (1117 message(s) examined).
debug: Initialising learner
debug: bayes: 31672 tie-ing to DB file
R/O /usr/var/spool/MailScanner/spamassassin/bayes_toks
debug: bayes: 31672 tie-ing to DB file
R/O /usr/var/spool/MailScanner/spamassassin/bayes_seen
debug: bayes: found bayes db version 2
debug: bayes: Not available for scanning, only 15 ham(s) in Bayes DB < 200

Should I shutdown spamd before running the spamassassin command ? How can I
rebuild a fresh new Bayes DB ?

Thanks,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From campbell at cnpapers.com  Fri Oct  1 14:41:59 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2933.1137101226.24926.mailscanner@lists.mailscanner.info>

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, October 01, 2004 8:56 AM
Subject: Re: Need clarification on whitelist rules


> At 12:58 01/10/2004, you wrote:
> >I am using MailScanner 4.33.3-1 and am using the spam.whitelist.rules
file
> >to whitelist for a few customers that thought my scanning was to tight.
My
> >spam has gotten so much better with the latest version of MailScanner
that I
> >can actually go through the spam I do get and try to find a way to block
it.
> >It appears to me that if a message is sent to multiple recipients and one
of
> >those recipients is in the spam.whitelist.rules file that the message is
> >whitelisted for everyone.  Is this correct?
>
> Yes.
>
> >   If so is there a way to block
> >it to everyone other than the one whitelisted?
>
> What you need is a Custom Function that edits the recipients list in each
> message, according to whether they want to be filtered or not. I've done
> something like this already, just haven't yet published it.
>
> What form would people like it in? Added to the per-user white and black
> list code?
> It would have to be a simple "remove them from the message if it's in
their
> blacklist or not in their whitelist".

*******
I would still prefer a simple "global" entry in the spam.blacklist and
spam.whitelist files as opposed to the per-user prefs. With the "and" option
you have implemented, I feel this would suffice for us who do not use
per-user prefs in any form. I don't know, though, if this would be negated
by the envelop-only restrictions for email destinations. I'm just not
knowledgable enough about the specifics (or how to spell knowledgable.)
*******

>
> Can people see any problems with this? Something is nagging me that this
> isn't the correct functionality, but I can't see what the right answer is
> for definite.

> --
> Julian Field

*******
As I understand this, you would be looking at the CC & BC fields, along with
multiple recipients, and you would be getting away from just interrogating
the envelop. I see this exploding into a lot more code down the road, but
feel this would solve a lot of questions to the list.

I like it - if this is what is intended.

Thanks.
*******

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 14:42:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2934.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:19 01/10/2004, you wrote:
>--On Friday, October 01, 2004 13:56 +0100 Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>>What form would people like it in? Added to the per-user white and black
>>list code?
>>It would have to be a simple "remove them from the message if it's in
>>their
>>blacklist or not in their whitelist".
>>
>>Can people see any problems with this? Something is nagging me that this
>>isn't the correct functionality, but I can't see what the right answer is
>>for definite.
>
>The only problem I can see with it right now is that there will have to be
>a rule this rule to check the To:, CC: and BCC: headers to ensure that it
>gets disposed of properly in the case that all possible local recipients
>are removed. I'm sure you've probably already thought of that, though. :-)

Yes I have :-) That's easy, I don't use the addresses in the headers
anyway, only the real addresses which are in the envelope.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 14:43:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner, SA and Bayes : still problems
Message-ID: <mailman.2935.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:24 01/10/2004, you wrote:
>What happens with the sa-learn process is very strange.
>
>I have run sa-learn on several files downloaded from spamarchive.org and
>when I run spamassassin --lint -D, it seems that content of Bayes DB is
>removed !
>
>Learned from 913 message(s) (1117 message(s) examined).
>debug: Initialising learner
>debug: bayes: 31672 tie-ing to DB file
>R/O /usr/var/spool/MailScanner/spamassassin/bayes_toks
>debug: bayes: 31672 tie-ing to DB file
>R/O /usr/var/spool/MailScanner/spamassassin/bayes_seen
>debug: bayes: found bayes db version 2
>debug: bayes: Not available for scanning, only 15 ham(s) in Bayes DB < 200
>
>Should I shutdown spamd before running the spamassassin command ? How can I
>rebuild a fresh new Bayes DB ?

If you have only taught it lots of spam, and 15 ham (i.e. 15 non-spam
messages), then you will see this. It has to have at least 200 non-spam
messages as well as lots of spam messages before it will start using it.
Just let it run on your system for a while to let it auto-learn enough
non-spam and it should all start working.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rcooper at DWFORD.COM  Fri Oct  1 14:56:50 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2936.1137101226.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Friday, October 01, 2004 7:57 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
>
<snip>
>
> What you need is a Custom Function that edits the recipients list in each
> message, according to whether they want to be filtered or not. I've done
> something like this already, just haven't yet published it.
>
> What form would people like it in? Added to the per-user white and black
> list code?
> It would have to be a simple "remove them from the message if
> it's in their
> blacklist or not in their whitelist".
>
> Can people see any problems with this? Something is nagging me that this
> isn't the correct functionality, but I can't see what the right answer is
> for definite.
> --

I guess my first question is how it's tagged as spam when there is a rule
file for the spam scoring settings? If user A tagges as spam with a score of
5.0 and user B tagges it with a score of 7.5 how does the message get
tagged, since a score of 6.5 would flag as spam for user A and ham for user
B?

I would think where ever this happens would be the place to check the
black/white since that would make it absolutely spam or ham at that point
per user. I don't see where this is taken into account within the
HandleHamAndSpam sub though?

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 15:10:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2937.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:56 01/10/2004, you wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > Behalf Of Julian Field
> > Sent: Friday, October 01, 2004 7:57 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Need clarification on whitelist rules
> >
> >
><snip>
> >
> > What you need is a Custom Function that edits the recipients list in each
> > message, according to whether they want to be filtered or not. I've done
> > something like this already, just haven't yet published it.
> >
> > What form would people like it in? Added to the per-user white and black
> > list code?
> > It would have to be a simple "remove them from the message if
> > it's in their
> > blacklist or not in their whitelist".
> >
> > Can people see any problems with this? Something is nagging me that this
> > isn't the correct functionality, but I can't see what the right answer is
> > for definite.
> > --
>
>I guess my first question is how it's tagged as spam when there is a rule
>file for the spam scoring settings? If user A tagges as spam with a score of
>5.0 and user B tagges it with a score of 7.5 how does the message get
>tagged, since a score of 6.5 would flag as spam for user A and ham for user
>B?

We use it only for automatic spam deletion. In your example, user A would
be removed from the list of recipients, and it would be normally delivered
to user B. To use it for anything other than spam deletion is pretty much
impossible.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From davidj at synaq.com  Fri Oct  1 15:14:39 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:06 2006
Subject: www.mailscanner.info
Message-ID: <mailman.2938.1137101226.24926.mailscanner@lists.mailscanner.info>

Hi,

It seems the MailScanner website is down.  Just informing Julian incase
he is not aware :)

-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From rcooper at DWFORD.COM  Fri Oct  1 15:26:59 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2939.1137101226.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Friday, October 01, 2004 9:10 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
>
> At 14:56 01/10/2004, you wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Friday, October 01, 2004 7:57 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: Need clarification on whitelist rules
> > >
> > >
> ><snip>
> > >
> > > What you need is a Custom Function that edits the recipients
> list in each
> > > message, according to whether they want to be filtered or
> not. I've done
> > > something like this already, just haven't yet published it.
> > >
> > > What form would people like it in? Added to the per-user
> white and black
> > > list code?
> > > It would have to be a simple "remove them from the message if
> > > it's in their
> > > blacklist or not in their whitelist".
> > >
> > > Can people see any problems with this? Something is nagging
> me that this
> > > isn't the correct functionality, but I can't see what the
> right answer is
> > > for definite.
> > > --
> >
> >I guess my first question is how it's tagged as spam when there is a rule
> >file for the spam scoring settings? If user A tagges as spam
> with a score of
> >5.0 and user B tagges it with a score of 7.5 how does the message get
> >tagged, since a score of 6.5 would flag as spam for user A and
> ham for user
> >B?
>
> We use it only for automatic spam deletion. In your example, user A would
> be removed from the list of recipients, and it would be normally delivered
> to user B. To use it for anything other than spam deletion is pretty much
> impossible.
>
> --

Isn't this what you are proposing above?

> > > It would have to be a simple "remove them from the message if
> > > it's in their
> > > blacklist or not in their whitelist".

so if you handle the white/black listing here if it's spam and whitelisted
don't remove them and if it's ham but blacklisted do remove them, or am I
missing something? I would think where every the per user scoring is checked
if the whitelist/blacklist was checked as well it would simply adjust the
actual tagging as spam or ham the same as the scoring based tagging would,
the difference being if it scores as 6.5 and the user threshold is 7.5 but
it's blacklisted it would be tagged as spam and not ham? I'm sorry if I am
coming across dense just looking for a way to simplify the overall code
changes

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 16:04:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2940.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 15:26 01/10/2004, you wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > Behalf Of Julian Field
> > Sent: Friday, October 01, 2004 9:10 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Need clarification on whitelist rules
> >
> >
> > At 14:56 01/10/2004, you wrote:
> > > > -----Original Message-----
> > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > Behalf Of Julian Field
> > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: Need clarification on whitelist rules
> > > >
> > > >
> > ><snip>
> > > >
> > > > What you need is a Custom Function that edits the recipients
> > list in each
> > > > message, according to whether they want to be filtered or
> > not. I've done
> > > > something like this already, just haven't yet published it.
> > > >
> > > > What form would people like it in? Added to the per-user
> > white and black
> > > > list code?
> > > > It would have to be a simple "remove them from the message if
> > > > it's in their
> > > > blacklist or not in their whitelist".
> > > >
> > > > Can people see any problems with this? Something is nagging
> > me that this
> > > > isn't the correct functionality, but I can't see what the
> > right answer is
> > > > for definite.
> > > > --
> > >
> > >I guess my first question is how it's tagged as spam when there is a rule
> > >file for the spam scoring settings? If user A tagges as spam
> > with a score of
> > >5.0 and user B tagges it with a score of 7.5 how does the message get
> > >tagged, since a score of 6.5 would flag as spam for user A and
> > ham for user
> > >B?
> >
> > We use it only for automatic spam deletion. In your example, user A would
> > be removed from the list of recipients, and it would be normally delivered
> > to user B. To use it for anything other than spam deletion is pretty much
> > impossible.
> >
> > --
>
>Isn't this what you are proposing above?
>
> > > > It would have to be a simple "remove them from the message if
> > > > it's in their
> > > > blacklist or not in their whitelist".
>
>so if you handle the white/black listing here if it's spam and whitelisted
>don't remove them and if it's ham but blacklisted do remove them, or am I
>missing something?


>  I would think where every the per user scoring is checked
>if the whitelist/blacklist was checked as well it would simply adjust the
>actual tagging as spam or ham the same as the scoring based tagging would,
>the difference being if it scores as 6.5 and the user threshold is 7.5 but
>it's blacklisted it would be tagged as spam and not ham?

I don't understand that sentence at all, sorry.

>  I'm sorry if I am
>coming across dense just looking for a way to simplify the overall code
>changes

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 16:06:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: www.mailscanner.info
Message-ID: <mailman.2941.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 15:14 01/10/2004, you wrote:
>It seems the MailScanner website is down.  Just informing Julian incase
>he is not aware :)

Our infrastructure people are playing with websites this afternoon, and
they have screwed up the firewall in the process. Hopefully they are now
fixing it!

Thanks for letting me know.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct  1 16:20:54 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:06 2006
Subject: www.mailscanner.info
Message-ID: <mailman.2942.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Works...

at the moment...


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> At 15:14 01/10/2004, you wrote:
>
>> It seems the MailScanner website is down.  Just informing Julian incase
>> he is not aware :)
>
>
> Our infrastructure people are playing with websites this afternoon, and
> they have screwed up the firewall in the process. Hopefully they are now
> fixing it!
>
> Thanks for letting me know.
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ssilva at SGVWATER.COM  Fri Oct  1 16:24:25 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2943.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Daniel Bird wrote:
| <snip>
|
|>
|> /etc/mail/spamassassin is clean (empty as a matter of fact),  and there
|> are no such rules in spam.assassin.prefs.conf. I found an old user_prefs
|> in /root/.spamassassin and have killed it. I have no
|> /etc/mail/spamassassin/init.pre it is in /usr/etc/mail/spamassassin/ but
|> that line is <not> commented out. I could use a good sample of a URIBL
|> rich email though.
|
|
|
| Here's one that definitely matches: http://www.sghms.ac.uk/test_SURBL.txt
| Save that to a file and run spamassassin -D -t <saved-file on it .
|
| That should give you a debug output, it'll tell you where your default
| rules are ( /usr/etc/mail/spamassassin/ by the looks of things) and what
| it matches on.
|
| go to /usr/etc/mail/spamassassin/ (if that's where the SA debug says
| your cf files are ) and do
|
| grep URI *
|
| That should show up which files contain the URI rules.
|
| You may also want to to:
| spamaassassin --lint to make sure all your cf files are OK. If not,
| it'll tell you which ones are borked and you can remove the offending
| entries.
|
It doesn't show any hits for URIBL, but it does say it is running URI
tests, but they do not add to the score.
It shows these tests being run, if it helps.
debug: tests=DRUGS_ERECTILE,FORGED_RCVD_HELO,MSGID_DOLLARS
debug: subtests=__0_TZ_3,__CT,__CTE,__CTYPE_CHARSET_QUOTED,__CT_TEXT_PLAIN,
__DRUGS_ERECTILE1,__DRUGS_ERECTILE10,__DRUGS_ERECTILE_V,__HAS_MSGID,
__HAS_SUBJECT,__MIME_VERSION,__MSGID_OK_HEX,__MSGID_OK_HOST,__OE_MSGID_2,
__OUTLOOK_DOLLARS_MSGID,__SANE_MSGID

Could there be some hang up from upgrading a 2.64 install?
Does anyone else having this problem have upgrading in common?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBXXapRADw9lziUqQRAvIPAJ42WRFbZpF4Y5xFdp+V5slUA4i87QCggfFy
sEmObjpgkgPl0tBADNlJRHQ=
=9Qah
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dean at SAHRA.ARIZONA.EDU  Fri Oct  1 16:29:24 2004
From: dean at SAHRA.ARIZONA.EDU (Dean Jones)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2944.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Remco Barendse wrote:
> Strange.... I can confirm the same problem.
>
> I don't know how to remove a perl module, after the suggestion on this
> list I simply re-installed the tarball and restarted MailScanner but still
> no URI hits from MS.
>
> Can I do a forced re-install of all the perl modules in the
> install-SA-CLAMAV package?
>

hye,

this is what i did to finally get Net::DNS to fully re-install.
it is probably not the 'proper' way to do this, so please be careful.
When i upgraded to SA 3 i used the CPAN shell to make sure Net::DNS was
upgraded. apparantly this wasn't enough.

Make sure spamassassin/mailscanner isn't running or doing checks while
you do this.
I dloaded the version of Net::DNS i needed from cpan.org.
Then i found my perl install and lib/site_perl/5.8.4/Net
After backing it up, i removed the DNS.pm and
lib/site_perl/5.8.4/Net/DNS directory.
Then i re-compiled and installed from the tar.gz i dloaded from cpan.org.

Fired MailScanner back up and RBL and URIBL checks were both working.

Hopefully that will do it for you.



>
> On Fri, 1 Oct 2004, Julian Field wrote:
>
>> I haven't changed the SA3 code, it all works on my production and
>> development systems, as do Steve's systems.
>>
>> At 21:47 30/09/2004, you wrote:
>>
>>> This issue has been reported by myself and Ugo earlier this week
>>> on the list.  I'm at a loss too.  When the next version of MS
>>> comes out, I will upgrade and see if the problem remains.
>>>
>>> Jeff Earickson
>>> Colby College
>>>
>>> On Thu, 30 Sep 2004, Dean Jones wrote:
>>>
>>>> Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>> From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>>> Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>
>>>> Steve Swaney wrote:
>>>>
>>>>>>> SNIPPED <<<
>>>>>>
>>>>>>
>>>>>> Doing the command that you suggested manages to make the SURBL checks
>>>>>> work.
>>>>>>
>>>>>> It almost as if there is a spamassassin option in MailScanner.conf
>>>>>> that
>>>>>> turns it off.
>>>>>
>>>>>
>>>>>
>>>>> There is a command in MailScanner that turns SpamAssassin off;
>>>>>
>>>>> Use SpamAssassin = yes
>>>>>
>>>>> But if you have SpamAssassin turned on in MS and the test above works,
>>>>> MailScanner should run the exactly as the test does. How are you sure
>>>>> thst
>>>>> MS is not running the tests?
>>>>
>>>>
>>>> Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>
>>>> The only way i have to guess is just by the data SA drops into the
>>>> logs.
>>>> It never hits on any URIBL_* scores running natively.
>>>>
>>>> I can forward SURBL test emails through from outside addresses and they
>>>> don't get hit by the SURBL checks.
>>>>
>>>> I'm at a loss :)
>>>> otherwise SA 3 is working great.
>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> MailScanner thanks transtec Computers for their support
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Fri Oct  1 16:35:29 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:06 2006
Subject: www.mailscanner.info
Message-ID: <mailman.2945.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Martin Hepworth wrote:

> Works...
>
> at the moment...

But the sig for the rpm version is a 404 error.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 17:01:49 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: www.mailscanner.info
Message-ID: <mailman.2946.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I uploaded the SuSE version to the RPM directory. Sorry about that. The
right files are in the right places now.

At 16:35 01/10/2004, you wrote:
>Martin Hepworth wrote:
>
>>Works...
>>
>>at the moment...
>
>But the sig for the rpm version is a 404 error.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wright at CYBERVALE.COM  Fri Oct  1 17:40:13 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:06 2006
Subject: Install-Clam error
Message-ID: <mailman.2947.1137101226.24926.mailscanner@lists.mailscanner.info>

> >
> >
> >Missing file /usr/src/redhat/RPMS/noarch/perl-URI-1.31-1.noarch.rpm.
> >Maybe it did not build correctly?
> >
> >I can't seem to find 1.31-1, I've only been able to find perl-URI-1.21-7
and
> >I have that installed.
> >Any help here?
>
> I expect 1.21-7 will do just fine.
>
well it fails with the above error and as you can see 1.21-7 is installed
 # rpm -qa | grep URI
perl-URI-1.21-7

I tried doing rpm -Uvh perl-URI-1.31-1.src.rpm(which is included in the perl
dir of your package) it completes but I still get this:
 # rpm -qa | grep URI
perl-URI-1.21-7

I ran the install again with --nodeps it complained about Perl-URI-1.31-1
just the same but ran to completion

I notice that there is no /etc/mail/spamassassin directory, does that
indicate that there was a problem and how do I remedy that?

> Have you bought the MailScanner book yet? Available at a very reasonable
> price from www.mailscanner.info, and it helps support my bills to aid
> future MailScanner development :-)

I got approval from the people who spend the money and should be placing the
order next week ;-). It's the least I could do to support you, we love the
product and your work.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vboulytchev at COINFOTECH.COM  Fri Oct  1 17:52:10 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:06 2006
Subject: Load Balancing + File Locking
Message-ID: <mailman.2948.1137101226.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

:))))))))))))))   Brilliant! :)))))))))))))))))

This is definitely a nice way to use round robin DNS... To your advantage
even.  Sweet.

Unfortunately this don^Òt help us :(.   We must load balance this sucker.  If
we will not have loadbalancing, we shall achieve the same with running
sendmail on each mailscanner box, and vuala..... But I really want a
Mailscanner Cluster!  I want redundancy! 


Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Denis Beauchemin
Sent: Thursday, September 30, 2004 2:56 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Load Balancing + File Locking


Boulytchev, Vasiliy wrote:

>Ladies and Gents,
>        The loads on the mail server require us to start moving 
>Mailscanner with Spam and Virus filtering to other machines.  Questions:
>        1.)     How does MS do the locking on files in the submitted
>directory (after cgp2ms)?  If NFS3 is used to mount that shared folder 
>on say 3 servers designated to only scanning mail, how do we avoid run-ons?
>        2.)     Idea: if the local procs keep track of locking, then we can
>toss all that into mysql for example? :)))  Just thinking of ways to 
>add scalability.
>
>  
>

Vasiliy,

We have 2 MS servers for incoming mail and they don't share any spool
directory.  They are separate servers and the load balancing is done through
the MX records.  Our 2 servers were not identical (one was about twice as
fast as the other) and we had the following:
# host -t mx usherbrooke.ca
usherbrooke.ca mail is handled by 10 smtpe1.usherbrooke.ca.
usherbrooke.ca mail is handled by 10 smtpe2.usherbrooke.ca.
usherbrooke.ca mail is handled by 10 smtpe3.usherbrooke.ca.

Here smtpe1 and smtpe3 are the same machine (the fastest one) with different
IP.  It received close to 2/3 of all mail.

I just replaced the slowest one (smtpe2) by a machine identical to the
fastest one (smtpe1) so I asked our DNS guys to drop the smtpe3 name.

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From vboulytchev at COINFOTECH.COM  Fri Oct  1 17:55:49 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:06 2006
Subject: Load Balancing + File Locking
Message-ID: <mailman.2949.1137101226.24926.mailscanner@lists.mailscanner.info>

Unfortunately, our budget is limited.  We really need to have independent
boxes scanning the Submitted folder.  That would be ideal.  If money was not
an issue, then I would definitely stick this on Beowulf.


Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ugo Bellavance
Sent: Thursday, September 30, 2004 2:51 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Load Balancing + File Locking


Boulytchev, Vasiliy wrote:

> Ladies and Gents,
>         The loads on the mail server require us to start moving
> Mailscanner with Spam and Virus filtering to other machines.  Questions:
>         1.)     How does MS do the locking on files in the submitted
> directory (after cgp2ms)?  If NFS3 is used to mount that shared folder
> on say 3 servers designated to only scanning mail, how do we avoid
run-ons?
>         2.)     Idea: if the local procs keep track of locking, then we
can
> toss all that into mysql for example? :)))  Just thinking of ways to
> add scalability.

Isn't it simpler to use MX records to do your load balancing?  Or a hardware
load balancer like coyotelinux sells?

>
> Thanks,
>
> Vasiliy Boulytchev
> Colorado Information Technologies, Inc.
> http://www.coinfotech.com
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From martinh at SOLID-STATE-LOGIC.COM  Fri Oct  1 17:58:55 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:06 2006
Subject: Load Balancing + File Locking
Message-ID: <mailman.2950.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Vasiliv

that's what's achieved by round-robin DNS.

Or do you a central file store for all queues, quarantine dir etc. You 
could always have a third machine with the file stores on it that's 
mounted by all the other hosts, but you still have the issus of the 
fileserver going down...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Boulytchev, Vasiliy wrote:
> :))))))))))))))   Brilliant! :)))))))))))))))))
> 
> This is definitely a nice way to use round robin DNS... To your advantage
> even.  Sweet.
> 
> Unfortunately this don^Òt help us :(.   We must load balance this sucker.  If
> we will not have loadbalancing, we shall achieve the same with running
> sendmail on each mailscanner box, and vuala..... But I really want a
> Mailscanner Cluster!  I want redundancy! 
> 
> 
> Vasiliy Boulytchev
> Colorado Information Technologies, Inc.
> http://www.coinfotech.com
> 
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Denis Beauchemin
> Sent: Thursday, September 30, 2004 2:56 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Load Balancing + File Locking
> 
> 
> Boulytchev, Vasiliy wrote:
> 
> 
>>Ladies and Gents,
>>       The loads on the mail server require us to start moving 
>>Mailscanner with Spam and Virus filtering to other machines.  Questions:
>>       1.)     How does MS do the locking on files in the submitted
>>directory (after cgp2ms)?  If NFS3 is used to mount that shared folder 
>>on say 3 servers designated to only scanning mail, how do we avoid run-ons?
>>       2.)     Idea: if the local procs keep track of locking, then we can
>>toss all that into mysql for example? :)))  Just thinking of ways to 
>>add scalability.
>>
>> 
>>
> 
> 
> Vasiliy,
> 
> We have 2 MS servers for incoming mail and they don't share any spool
> directory.  They are separate servers and the load balancing is done through
> the MX records.  Our 2 servers were not identical (one was about twice as
> fast as the other) and we had the following:
> # host -t mx usherbrooke.ca
> usherbrooke.ca mail is handled by 10 smtpe1.usherbrooke.ca.
> usherbrooke.ca mail is handled by 10 smtpe2.usherbrooke.ca.
> usherbrooke.ca mail is handled by 10 smtpe3.usherbrooke.ca.
> 
> Here smtpe1 and smtpe3 are the same machine (the fastest one) with different
> IP.  It received close to 2/3 of all mail.
> 
> I just replaced the slowest one (smtpe2) by a machine identical to the
> fastest one (smtpe1) so I asked our DNS guys to drop the smtpe3 name.
> 
> Denis
> 

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From vboulytchev at COINFOTECH.COM  Fri Oct  1 18:35:22 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:06 2006
Subject: Load Balancing + File Locking
Message-ID: <mailman.2951.1137101226.24926.mailscanner@lists.mailscanner.info>

Thoughts and setup  (mx is out of the questions, sorry, network is different
here)

A = Mail Server (CommunigatePro)
S1 = Mailscanner node 1
S2 = Mailscanner node 2
S3 = Mailscanner node 3

On A, we have all of our domains (hundreds).  I will not go into detail of
how much redundancy this thing has, and why we cant simply point to the
scanners with mx records, but here is my idea.  On A, have 2 NFS-shared
folders (certainly on a private network and gig nics).  One Incoming, which
is handled by cgp2ms and the other is Submitted, handled by ms2cgp.  Now,
say these three nodes keep grabbing batches of mail from these mount points,
process them, and spit things out in the final Submitted location for Cgate
to push the mail out.  Mailscanner should not have any issues with handling
the mounted directories, the only thing I am worried about is file locking
and fragmentation.
        So the question is, how do I prevent (or is it a big deal), that
lets say... There are 300 messages in the Incoming directory at any moment.
Mailscanners pick that queue up, crunch on it on each node, and spit it out
in the Submitted directory.  Now we start to ask these questions:
        1.)     Am I tripple scanning each message and not getting any
performance back.
        2.)     As of right not, I think there are 2 ways MS goes through
the Incoming directory, sequentially and non-sequentially (if there are more
than x amount of messages).  How do I tell MS to share the load!
        3.)     Maybe modify cgp2ms to spit things out into different
Incoming directories, therefore walking right around the file locking
problem.

IDEAS?   Who else is doing this?


Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Martin Hepworth
Sent: Friday, October 01, 2004 10:59 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Load Balancing + File Locking


Vasiliv

that's what's achieved by round-robin DNS.

Or do you a central file store for all queues, quarantine dir etc. You could
always have a third machine with the file stores on it that's mounted by all
the other hosts, but you still have the issus of the fileserver going
down...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Boulytchev, Vasiliy wrote:
> :))))))))))))))   Brilliant! :)))))))))))))))))
>
> This is definitely a nice way to use round robin DNS... To your advantage
> even.  Sweet.
>
> Unfortunately this don't help us :(.   We must load balance this sucker.
If
> we will not have loadbalancing, we shall achieve the same with running
> sendmail on each mailscanner box, and vuala..... But I really want a
> Mailscanner Cluster!  I want redundancy!
>
>
> Vasiliy Boulytchev
> Colorado Information Technologies, Inc.
> http://www.coinfotech.com
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
> Of Denis Beauchemin
> Sent: Thursday, September 30, 2004 2:56 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Load Balancing + File Locking
>
>
> Boulytchev, Vasiliy wrote:
>
>
>>Ladies and Gents,
>>       The loads on the mail server require us to start moving
>>Mailscanner with Spam and Virus filtering to other machines.  Questions:
>>       1.)     How does MS do the locking on files in the submitted
>>directory (after cgp2ms)?  If NFS3 is used to mount that shared folder
>>on say 3 servers designated to only scanning mail, how do we avoid
run-ons?
>>       2.)     Idea: if the local procs keep track of locking, then we can
>>toss all that into mysql for example? :)))  Just thinking of ways to
>>add scalability.
>>
>>
>>
>
>
> Vasiliy,
>
> We have 2 MS servers for incoming mail and they don't share any spool
> directory.  They are separate servers and the load balancing is done
through
> the MX records.  Our 2 servers were not identical (one was about twice as
> fast as the other) and we had the following:
> # host -t mx usherbrooke.ca
> usherbrooke.ca mail is handled by 10 smtpe1.usherbrooke.ca.
> usherbrooke.ca mail is handled by 10 smtpe2.usherbrooke.ca.
> usherbrooke.ca mail is handled by 10 smtpe3.usherbrooke.ca.
>
> Here smtpe1 and smtpe3 are the same machine (the fastest one) with
different
> IP.  It received close to 2/3 of all mail.
>
> I just replaced the slowest one (smtpe2) by a machine identical to the
> fastest one (smtpe1) so I asked our DNS guys to drop the smtpe3 name.
>
> Denis
>

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From rcooper at DWFORD.COM  Fri Oct  1 19:03:11 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:06 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.2952.1137101226.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Friday, October 01, 2004 10:04 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
>
<snip>
> > > >I guess my first question is how it's tagged as spam when
> there is a rule
> > > >file for the spam scoring settings? If user A tagges as spam
> > > with a score of
> > > >5.0 and user B tagges it with a score of 7.5 how does the message get
> > > >tagged, since a score of 6.5 would flag as spam for user A and
> > > ham for user
> > > >B?
> > >
> We use it only for automatic spam deletion. In your example, user A would
> be removed from the list of recipients, and it would be normally delivered
> to user B. To use it for anything other than spam deletion is
> pretty much impossible.
> > >
> > > --
> >

> I don't understand that sentence at all, sorry.
>

Ok right now there is an expansion of the spam and high scoring spam score
that allows for the score for spam/high scoring spam to be configure via a
rule file. if the following rules were in that file:

To:     me@mine.com             5.0
To:     you@mine.com    7.5
FromOrTo:       default 6.0

and a message arrived from they@them.com that scored 6.5, me@mine.com would
not receive the message but you@mine.com would. You would now remove
me@mine.com from the recipients list (and presumably CC/BCC)

Now suppose you were to also expand the whitelist/blacklist prior to
performing the deletion and that and the *whitelist* rules contained

To:     me@mine.com     and From: they@them.com yes
ToOrFrom:       default no

Now even, though the message scored above me@mine.com's spam threshold it
would not be tagged /processed as spam and they would not be deleted from
the recipient listing. The inverse would be true for a mail scoring below
their spam threshold but the to/from pair expansion of the blacklist rule
set resulted in the sender address/host being yes.

This would result in the whitelist/blacklisting being as per user as the
spam/high spam scoring, yes? Of course the most economical processing would
be to test the message before processing through SA and see if the entire
message would be whitelisted or blacklist and process it accordingly (skip
SA or dump entirely) before wasting time with SA and/or virus testing, and
only do the above checks if there are more than one recipient.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jrudd at UCSC.EDU  Fri Oct  1 19:04:07 2004
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner and CommuniGate Pro (Was: Re: Load Balancing + File
    Locking)
Message-ID: <mailman.2953.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Vasiliy,

I'm working on a problem like this, but not the same.  (and, you might
remember that I'm the person who originally wrote ms2cgp and cgp2ms,
but then abandoned them; why?  because the tracking mechanisms
available me, both through CGP and MS, left me with a lot of doubt in
my ability to guarantee the ability to track every message without
losing any of them in the logs, so I have taken a new direcction).

What I'm doing now is working on a CGP "execute" script which takes a
message from CGP, then, using the SMTP perl module, sends it to my load
balancer's SMTP port (you could just as easily use a round-robin
approach, or any of a few other techniques), behind which sits an array
of standard sendmail+mailscanner+sophos systems.

It just so happens that the sendmail+mailscanner systems are also the
MX servers for our domain, but that's not a requirement.  The
arrangement could just as easily be a private array of systems that
aren't available to outside submitters (protected from those submitters
by tcpwrappers and/or sendmail access rules and/or network topology).


So, there is no "triple scanning" because the load balancer makes sure
the message goes to only one mailscanner system.  That also takes care
of the multiple paths problem, and whether or not mailscanner is doing
sequential or non-sequential processing (because it doesn't matter:
mailscanner can do whatever it wants, without competing with other
mailscanner processes).  And there's no need for file locking issues
(because there's no shared incoming directory).

I'll try to put up a web page with my current effort later today.



On Oct 1, 2004, at 10:35 AM, Boulytchev, Vasiliy wrote:

> Thoughts and setup  (mx is out of the questions, sorry, network is
> different
> here)
>
> A = Mail Server (CommunigatePro)
> S1 = Mailscanner node 1
> S2 = Mailscanner node 2
> S3 = Mailscanner node 3
>
> On A, we have all of our domains (hundreds).  I will not go into
> detail of
> how much redundancy this thing has, and why we cant simply point to the
> scanners with mx records, but here is my idea.  On A, have 2 NFS-shared
> folders (certainly on a private network and gig nics).  One Incoming,
> which
> is handled by cgp2ms and the other is Submitted, handled by ms2cgp.
> Now,
> say these three nodes keep grabbing batches of mail from these mount
> points,
> process them, and spit things out in the final Submitted location for
> Cgate
> to push the mail out.  Mailscanner should not have any issues with
> handling
> the mounted directories, the only thing I am worried about is file
> locking
> and fragmentation.
>         So the question is, how do I prevent (or is it a big deal),
> that
> lets say... There are 300 messages in the Incoming directory at any
> moment.
> Mailscanners pick that queue up, crunch on it on each node, and spit
> it out
> in the Submitted directory.  Now we start to ask these questions:
>         1.)     Am I tripple scanning each message and not getting any
> performance back.
>         2.)     As of right not, I think there are 2 ways MS goes
> through
> the Incoming directory, sequentially and non-sequentially (if there
> are more
> than x amount of messages).  How do I tell MS to share the load!
>         3.)     Maybe modify cgp2ms to spit things out into different
> Incoming directories, therefore walking right around the file locking
> problem.
>
> IDEAS?   Who else is doing this?
>
>
> Vasiliy Boulytchev
> Colorado Information Technologies, Inc.
> http://www.coinfotech.com
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
> Of Martin Hepworth
> Sent: Friday, October 01, 2004 10:59 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Load Balancing + File Locking
>
>
> Vasiliv
>
> that's what's achieved by round-robin DNS.
>
> Or do you a central file store for all queues, quarantine dir etc. You
> could
> always have a third machine with the file stores on it that's mounted
> by all
> the other hosts, but you still have the issus of the fileserver going
> down...
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Boulytchev, Vasiliy wrote:
>> :))))))))))))))   Brilliant! :)))))))))))))))))
>>
>> This is definitely a nice way to use round robin DNS... To your
>> advantage
>> even.  Sweet.
>>
>> Unfortunately this don't help us :(.   We must load balance this
>> sucker.
> If
>> we will not have loadbalancing, we shall achieve the same with running
>> sendmail on each mailscanner box, and vuala..... But I really want a
>> Mailscanner Cluster!  I want redundancy!
>>
>>
>> Vasiliy Boulytchev
>> Colorado Information Technologies, Inc.
>> http://www.coinfotech.com
>>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
>> Of Denis Beauchemin
>> Sent: Thursday, September 30, 2004 2:56 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: Load Balancing + File Locking
>>
>>
>> Boulytchev, Vasiliy wrote:
>>
>>
>>> Ladies and Gents,
>>>       The loads on the mail server require us to start moving
>>> Mailscanner with Spam and Virus filtering to other machines.
>>> Questions:
>>>       1.)     How does MS do the locking on files in the submitted
>>> directory (after cgp2ms)?  If NFS3 is used to mount that shared
>>> folder
>>> on say 3 servers designated to only scanning mail, how do we avoid
> run-ons?
>>>       2.)     Idea: if the local procs keep track of locking, then
>>> we can
>>> toss all that into mysql for example? :)))  Just thinking of ways to
>>> add scalability.
>>>
>>>
>>>
>>
>>
>> Vasiliy,
>>
>> We have 2 MS servers for incoming mail and they don't share any spool
>> directory.  They are separate servers and the load balancing is done
> through
>> the MX records.  Our 2 servers were not identical (one was about
>> twice as
>> fast as the other) and we had the following:
>> # host -t mx usherbrooke.ca
>> usherbrooke.ca mail is handled by 10 smtpe1.usherbrooke.ca.
>> usherbrooke.ca mail is handled by 10 smtpe2.usherbrooke.ca.
>> usherbrooke.ca mail is handled by 10 smtpe3.usherbrooke.ca.
>>
>> Here smtpe1 and smtpe3 are the same machine (the fastest one) with
> different
>> IP.  It received close to 2/3 of all mail.
>>
>> I just replaced the slowest one (smtpe2) by a machine identical to the
>> fastest one (smtpe1) so I asked our DNS guys to drop the smtpe3 name.
>>
>> Denis
>>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ssilva at SGVWATER.COM  Fri Oct  1 19:04:48 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2954.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


|>
|> Well i re-installed Net::DNS from scratch (killed all Net::DNS related
|> stuff) and the SURBL checks have started.
|> I'm still scratching my head though, but hey it's working.
|
|
|
| I'd like to try that too. How do I remove the 'old' Net::DNS 0.48 and
| re-install it?
I think I found a simple fix. At least it is working on my system.
The install for Spamassassin 3 puts the files init.pre and local.cf in
/usr/etc/mail/spamassassin but MailScanner and spamassassin seem to
default to /etc/mail/spamassassin.
I copied those two files to /etc/mail/spamassassin and the URIBL tests
are now working. Maybe a glitch in the install script for SA 3 or ???
Either way that fixed it.

(Sysop wipes sweat from furrowed brow!!)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBXZxARADw9lziUqQRAi0kAJ9bQaJ1CA7DT3BTie6MCi8E8ZhzrgCfRVNI
6k7kCA5JjNkvKfYMvuarmws=
=5W7X
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vboulytchev at COINFOTECH.COM  Fri Oct  1 19:25:57 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner and CommuniGate Pro (Was: Re: Load Balancing +
    File Locking)
Message-ID: <mailman.2955.1137101226.24926.mailscanner@lists.mailscanner.info>

John,  without your help with cgp2ms and ms2cgp last year, we would have
been completely stuck, thank you!  Too many questions arise when reading
your email.  What you are doing is extremely interesting to us, as well as
anyone else running into one server limitations.  Please post a website
regarding your efforts.  This should really be looked at by the Mailscanner
team.

THANKS GUYS!



Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of John Rudd
Sent: Friday, October 01, 2004 12:04 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner and CommuniGate Pro (Was: Re: Load Balancing + File
Locking)


Vasiliy,

I'm working on a problem like this, but not the same.  (and, you might
remember that I'm the person who originally wrote ms2cgp and cgp2ms, but
then abandoned them; why?  because the tracking mechanisms available me,
both through CGP and MS, left me with a lot of doubt in my ability to
guarantee the ability to track every message without losing any of them in
the logs, so I have taken a new direcction).

What I'm doing now is working on a CGP "execute" script which takes a
message from CGP, then, using the SMTP perl module, sends it to my load
balancer's SMTP port (you could just as easily use a round-robin approach,
or any of a few other techniques), behind which sits an array of standard
sendmail+mailscanner+sophos systems.

It just so happens that the sendmail+mailscanner systems are also the MX
servers for our domain, but that's not a requirement.  The arrangement could
just as easily be a private array of systems that aren't available to
outside submitters (protected from those submitters by tcpwrappers and/or
sendmail access rules and/or network topology).


So, there is no "triple scanning" because the load balancer makes sure the
message goes to only one mailscanner system.  That also takes care of the
multiple paths problem, and whether or not mailscanner is doing sequential
or non-sequential processing (because it doesn't matter:
mailscanner can do whatever it wants, without competing with other
mailscanner processes).  And there's no need for file locking issues
(because there's no shared incoming directory).

I'll try to put up a web page with my current effort later today.



On Oct 1, 2004, at 10:35 AM, Boulytchev, Vasiliy wrote:

> Thoughts and setup  (mx is out of the questions, sorry, network is
> different
> here)
>
> A = Mail Server (CommunigatePro)
> S1 = Mailscanner node 1
> S2 = Mailscanner node 2
> S3 = Mailscanner node 3
>
> On A, we have all of our domains (hundreds).  I will not go into
> detail of how much redundancy this thing has, and why we cant simply
> point to the scanners with mx records, but here is my idea.  On A,
> have 2 NFS-shared folders (certainly on a private network and gig
> nics).  One Incoming, which is handled by cgp2ms and the other is
> Submitted, handled by ms2cgp.
> Now,
> say these three nodes keep grabbing batches of mail from these mount
> points, process them, and spit things out in the final Submitted
> location for Cgate to push the mail out.  Mailscanner should not have
> any issues with handling the mounted directories, the only thing I am
> worried about is file locking and fragmentation.
>         So the question is, how do I prevent (or is it a big deal),
> that lets say... There are 300 messages in the Incoming directory at
> any moment.
> Mailscanners pick that queue up, crunch on it on each node, and spit
> it out in the Submitted directory.  Now we start to ask these
> questions:
>         1.)     Am I tripple scanning each message and not getting any
> performance back.
>         2.)     As of right not, I think there are 2 ways MS goes
> through
> the Incoming directory, sequentially and non-sequentially (if there
> are more than x amount of messages).  How do I tell MS to share the
> load!
>         3.)     Maybe modify cgp2ms to spit things out into different
> Incoming directories, therefore walking right around the file locking
> problem.
>
> IDEAS?   Who else is doing this?
>
>
> Vasiliy Boulytchev
> Colorado Information Technologies, Inc.
> http://www.coinfotech.com
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Martin Hepworth
> Sent: Friday, October 01, 2004 10:59 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Load Balancing + File Locking
>
>
> Vasiliv
>
> that's what's achieved by round-robin DNS.
>
> Or do you a central file store for all queues, quarantine dir etc. You
> could always have a third machine with the file stores on it that's
> mounted by all the other hosts, but you still have the issus of the
> fileserver going down...
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Boulytchev, Vasiliy wrote:
>> :))))))))))))))   Brilliant! :)))))))))))))))))
>>
>> This is definitely a nice way to use round robin DNS... To your
>> advantage even.  Sweet.
>>
>> Unfortunately this don't help us :(.   We must load balance this
>> sucker.
> If
>> we will not have loadbalancing, we shall achieve the same with
>> running sendmail on each mailscanner box, and vuala..... But I really
>> want a Mailscanner Cluster!  I want redundancy!
>>
>>
>> Vasiliy Boulytchev
>> Colorado Information Technologies, Inc.
>> http://www.coinfotech.com
>>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
>> Of Denis Beauchemin
>> Sent: Thursday, September 30, 2004 2:56 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: Load Balancing + File Locking
>>
>>
>> Boulytchev, Vasiliy wrote:
>>
>>
>>> Ladies and Gents,
>>>       The loads on the mail server require us to start moving
>>> Mailscanner with Spam and Virus filtering to other machines.
>>> Questions:
>>>       1.)     How does MS do the locking on files in the submitted
>>> directory (after cgp2ms)?  If NFS3 is used to mount that shared
>>> folder on say 3 servers designated to only scanning mail, how do we
>>> avoid
> run-ons?
>>>       2.)     Idea: if the local procs keep track of locking, then
>>> we can
>>> toss all that into mysql for example? :)))  Just thinking of ways to
>>> add scalability.
>>>
>>>
>>>
>>
>>
>> Vasiliy,
>>
>> We have 2 MS servers for incoming mail and they don't share any spool
>> directory.  They are separate servers and the load balancing is done
> through
>> the MX records.  Our 2 servers were not identical (one was about
>> twice as fast as the other) and we had the following:
>> # host -t mx usherbrooke.ca
>> usherbrooke.ca mail is handled by 10 smtpe1.usherbrooke.ca.
>> usherbrooke.ca mail is handled by 10 smtpe2.usherbrooke.ca.
>> usherbrooke.ca mail is handled by 10 smtpe3.usherbrooke.ca.
>>
>> Here smtpe1 and smtpe3 are the same machine (the fastest one) with
> different
>> IP.  It received close to 2/3 of all mail.
>>
>> I just replaced the slowest one (smtpe2) by a machine identical to
>> the fastest one (smtpe1) so I asked our DNS guys to drop the smtpe3 name.
>>
>> Denis
>>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept for the
> presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From rpotter at RPCS.NET  Fri Oct  1 19:32:55 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2956.1137101226.24926.mailscanner@lists.mailscanner.info>

On Fri, 1 Oct 2004, Scott Silva wrote:

> I think I found a simple fix. At least it is working on my system.
> The install for Spamassassin 3 puts the files init.pre and local.cf in
> /usr/etc/mail/spamassassin but MailScanner and spamassassin seem to
> default to /etc/mail/spamassassin.
> I copied those two files to /etc/mail/spamassassin and the URIBL tests
> are now working. Maybe a glitch in the install script for SA 3 or ???
> Either way that fixed it.

Well... that worked for me also! I only copied init.pre to
/etc/mail/spamassassin, as I have /etc/mail/spamassassin/local.cf linked to
/etc/MailScanner/spam.assassin.prefs.conf

God I love UNIX!


Cheers!
--
Richard Potter RHCE
Re/Max
Kingston, ON  CANADA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  1 20:17:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: Install-Clam error
Message-ID: <mailman.2957.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:40 01/10/2004, you wrote:
>I tried doing rpm -Uvh perl-URI-1.31-1.src.rpm(which is included in the perl
>dir of your package) it completes but I still get this:
>  # rpm -qa | grep URI
>perl-URI-1.21-7

Installing the src.rpm just installs the source, it doesn't install the
running code.
You need to
rpmbuild -rebuild perl-URI-1.31-1.src.rpm
and then install the resulting RPM.

> > Have you bought the MailScanner book yet? Available at a very reasonable
> > price from www.mailscanner.info, and it helps support my bills to aid
> > future MailScanner development :-)
>
>I got approval from the people who spend the money and should be placing the
>order next week ;-). It's the least I could do to support you, we love the
>product and your work.

Thankyou!
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jonas.back at pin.se  Fri Oct  1 20:58:29 2004
From: jonas.back at pin.se (Jonas Back)
Date: Thu Jan 12 21:27:06 2006
Subject: Debian version of 4.34.8
Message-ID: <mailman.2958.1137101226.24926.mailscanner@lists.mailscanner.info>

Hi!

When will we see the debian version of this release?

Cheers,
Jonas

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Fri Oct  1 21:08:41 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:06 2006
Subject: Debian version of 4.34.8
Message-ID: <mailman.2959.1137101226.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-10-01 at 21:58 +0200, Jonas Back wrote:
> Hi!
>
> When will we see the debian version of this release?

Julian only released the new version this morning, so you'll need to be
patient until the package maintainer gets round to it

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at BARENDSE.TO  Fri Oct  1 21:23:59 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:06 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.2960.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On Fri, 1 Oct 2004, Scott Silva wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> |>
> |> Well i re-installed Net::DNS from scratch (killed all Net::DNS related
> |> stuff) and the SURBL checks have started.
> |> I'm still scratching my head though, but hey it's working.
> |
> |
> |
> | I'd like to try that too. How do I remove the 'old' Net::DNS 0.48 and
> | re-install it?
> I think I found a simple fix. At least it is working on my system.
> The install for Spamassassin 3 puts the files init.pre and local.cf in
> /usr/etc/mail/spamassassin but MailScanner and spamassassin seem to
> default to /etc/mail/spamassassin.
> I copied those two files to /etc/mail/spamassassin and the URIBL tests
> are now working. Maybe a glitch in the install script for SA 3 or ???
> Either way that fixed it.

Had a look but the directory on my non-working box is empty and the files
are already in /etc/mail/spamassassin. Guess this is not the problem I am
having but thanks for the suggestion!


>
> (Sysop wipes sweat from furrowed brow!!)
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBXZxARADw9lziUqQRAi0kAJ9bQaJ1CA7DT3BTie6MCi8E8ZhzrgCfRVNI
> 6k7kCA5JjNkvKfYMvuarmws=
> =5W7X
> -----END PGP SIGNATURE-----
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wright at CYBERVALE.COM  Fri Oct  1 22:01:46 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:06 2006
Subject: Install-Clam error
Message-ID: <mailman.2961.1137101226.24926.mailscanner@lists.mailscanner.info>

Thank you Guys for all the help, I'll make this my LAST POST ON THIS ISSUE.


> At 17:40 01/10/2004, you wrote:
> >I tried doing rpm -Uvh perl-URI-1.31-1.src.rpm(which is included in the
perl
> >dir of your package) it completes but I still get this:
> >  # rpm -qa | grep URI
> >perl-URI-1.21-7
>
> Installing the src.rpm just installs the source, it doesn't install the
> running code.
> You need to
> rpmbuild -rebuild perl-URI-1.31-1.src.rpm
> and then install the resulting RPM.

there's no resulting rpm and that appears to be the problem. This is the
output of the rpm --rebuild
<snip>
t/generic........ok
t/heuristic......FAILED test 7
        Failed 1/15 tests, 93.33% okay
t/http...........ok
<snip>
Failed Test   Stat Wstat Total Fail  Failed  List of Failed
----------------------------------------------------------------------------
---
t/heuristic.t               15    1   6.67%  7
Failed 1/30 test scripts, 96.67% okay. 1/467 subtests failed, 99.79% okay.
make: *** [test_dynamic] Error 29
error: Bad exit status from /var/tmp/rpm-tmp.47301 (%build)


RPM build errors:
    Bad exit status from /var/tmp/rpm-tmp.47301 (%build)

I tried building it on another redhat 9 box with same result. Can anyone
tell me what's missing or what I need to do. I have tried searching for the
rpm but can't find it anywhere.



Also the issue of there not being a /etc/mail/spamassasin directory was not
addressed. does that mean the install was not completed correctly? what can
I do about that?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ml at NETGROUPES.CA  Fri Oct  1 23:43:35 2004
From: ml at NETGROUPES.CA (Mailing List)
Date: Thu Jan 12 21:27:06 2006
Subject: ByDomainSpamBlacklist & ByDomainSpamWhitelist
Message-ID: <mailman.2962.1137101226.24926.mailscanner@lists.mailscanner.info>

I'm using: & ByDomainSpamBlacklist and &ByDomainSpamWhitelist 
I looked at CustomConfig.pm, but could not find an answer, and my
Perl=null ;)

Can i use wildcards in the files?

To blacklist something like:
newsletter*@microsoft.com

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From bg.mahesh at INDIAINFO.COM  Sat Oct  2 06:00:49 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:06 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.2963.1137101226.24926.mailscanner@lists.mailscanner.info>

> hi
>
> I am not able to install MS 4.34.8-1. The error message I get is,
>
> Installing tnef decoder
> Preparing...                ########################################### [100%]
>         package tnef-1.2.3.1-1 is already installed
>
> Now to install MailScanner itself.
>
> error: Failed dependencies:
>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed) perl-MIME-tools-5.413-1
>
> My setup
>
> Redhat Linux
> Perl 5.8.3
> MIME::QuotedPrint   : 3.03
> MIME::Tools         : 5.413
> MIME::Base64        : 3.03
>
> What am I doing wrong?
>>

>Julian said:
>I don't know quite what is going on here, I saw a few similar >problems
>myself sometimes, but I couldn't come up with a definite reason >for it. It
>knows you have QuotedPrint 3.03 but then says you need it >installed. All I
>ended up doing was forcing the install of the main MailScanner rpm.

W>hat happens if you rpm -e MIME::Base64 and then reinstall it?

"rpm -e MIME::Base64 " says MIME::Base64 is not installed!

Anyways, I installed MIME::Base64 3.05 but I still get the same error,

perl(MIME::QuotedPrint) >= 3.03 is needed by (installed) perl-MIME-tools-5.413-1

--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From admin at thenamegame.com  Sat Oct  2 07:12:28 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:06 2006
Subject: Delaying cron job for up to 600 seconds?
Message-ID: <mailman.2964.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:Arial;
        color:windowtext;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>update.virus.scanners: Delaying cron job up to 600 seconds<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I contantly see this message on one of my boxes? Why? Why
would the job be delayed?<o:p></o:p></span></font></p>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mike at ZANKER.ORG  Sat Oct  2 08:09:47 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:06 2006
Subject: Delaying cron job for up to 600 seconds?
Message-ID: <mailman.2965.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 02 October 2004 02:12 -0400 Michael Freeman <admin@THENAMEGAME.COM>
wrote:

> update.virus.scanners: Delaying cron job up to 600 seconds
>
> I contantly see this message on one of my boxes? Why? Why would the
> job be delayed?

This is intentional to prevent everybody hammering virus scanner update
servers at exactly the same time.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From raymond at PROLOCATION.NET  Sat Oct  2 11:10:42 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:06 2006
Subject: Delaying cron job for up to 600 seconds?
Message-ID: <mailman.2966.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

> update.virus.scanners: Delaying cron job up to 600 seconds

> I contantly see this message on one of my boxes? Why? Why would the job be
> delayed?

If you have a look inside the file thats doing it you would have known...

# Insert a random delay up to this value, to spread virus updates round
# the clock. 1800 seconds = 30 minutes.
# Set this to 0 to disable it.
UPDATEMAXDELAY=600
if [ -f /etc/sysconfig/MailScanner ] ; then
         . /etc/sysconfig/MailScanner
fi
export UPDATEMAXDELAY

Do you ever look at anything you install ? ;)

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 13:04:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:06 2006
Subject: ByDomainSpamBlacklist & ByDomainSpamWhitelist
Message-ID: <mailman.2967.1137101226.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 23:43 01/10/2004, you wrote:
>I'm using: & ByDomainSpamBlacklist and &ByDomainSpamWhitelist
>I looked at CustomConfig.pm, but could not find an answer, and my
>Perl=null ;)
>
>Can i use wildcards in the files?
>
>To blacklist something like:
>newsletter*@microsoft.com

Not in there, no. Feel free to pay someone to write the code for you :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From joey at JOESMITH.NET  Sat Oct  2 16:53:10 2004
From: joey at JOESMITH.NET (Joe Smith)
Date: Thu Jan 12 21:27:07 2006
Subject: Delaying cron job for up to 600 seconds?
Message-ID: <mailman.2968.1137101226.24926.mailscanner@lists.mailscanner.info>

On Sat, 2 Oct 2004, Michael Freeman wrote:

> update.virus.scanners: Delaying cron job up to 600 seconds
>
>
>
> I contantly see this message on one of my boxes? Why? Why would the job be
> delayed?

There is a random delay inserted with the update process.. this helps
prevent everyone from updating at the same time and hammering the update
servers with traffic.

If you study the code a bit,  you will find where you can modify this
delay or remove it completely depending on your needs.    I typically
leave it in place but change it to 0 sometimes for debugging.

On a RedHat or derivative linux system you can modify this value in
/etc/sysconfig/MailScanner.

Have fun!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From d.santos at barcelohotels.com.do  Sat Oct  2 17:39:31 2004
From: d.santos at barcelohotels.com.do (Dywer Santos)
Date: Thu Jan 12 21:27:07 2006
Subject: RedHat Enterprise Linux AS 3.0 Install
Message-ID: <mailman.2969.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=261193516-02102004><FONT face=Arial 
size=2>Hi.</FONT></SPAN></DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial size=2>I 
cannot&nbsp;install MScanner in REL 3.0. Does anybody had do it? Which steps did 
you perform?</FONT></SPAN></DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial size=2>thanks for any 
help</FONT></SPAN></DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=261193516-02102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV>
<DIV><FONT face=Arial size=1>Dywer Santos</FONT></DIV></DIV>
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 17:55:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: RedHat Enterprise Linux AS 3.0 Install
Message-ID: <mailman.2970.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:39 02/10/2004, you wrote:
>Hi.
>
>I cannot install MScanner in REL 3.0. Does anybody had do it? Which steps
>did you perform?

Download the RedHat RPM distribution from
http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-1.rpm.tar.gz

tar xzf MailScanner-4.34.8-1.rpm.tar.gz

cd MailScanner-4.34.8-1

./install.sh

Then read what it outputs to keep an eye on the installation procedure.
When it finishes, it will print up a few lines of instructions and commands
that you *must* do to complete the installation.

And also please read
http://www.sng.ecs.soton.ac.uk/mailscanner/install/linux.shtml
and the MailScanner MAQ (address at the bottom of every posting to this list)
and buy the book, and read it :)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From roel at GLOUDEMANS.INFO  Sat Oct  2 18:22:03 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2971.1137101227.24926.mailscanner@lists.mailscanner.info>

Upon starting MailScanner 4.34-8 I get the error message below:

Bad arg length for Socket::pack_sockaddr_in, length is 0, should be 4 at
/usr/local/lib/perl5/5.8.5/sun4-solaris/Socket.pm line 373.

Running perl 5.8.5, SA 3.0.0, Clamav 0.80rc3

Any ideas? The perl socket package is up-to-date.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 18:47:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2972.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What are your
MTA =
Lock Type =
settings? What does
         uname -a
say?
Have you ever used a previous version of MailScanner?
Have you tried it with a previous version of Perl?

At 18:22 02/10/2004, you wrote:
>Upon starting MailScanner 4.34-8 I get the error message below:
>
>Bad arg length for Socket::pack_sockaddr_in, length is 0, should be 4 at
>/usr/local/lib/perl5/5.8.5/sun4-solaris/Socket.pm line 373.
>
>Running perl 5.8.5, SA 3.0.0, Clamav 0.80rc3
>
>Any ideas? The perl socket package is up-to-date.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From roel at GLOUDEMANS.INFO  Sat Oct  2 19:03:10 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2973.1137101227.24926.mailscanner@lists.mailscanner.info>

Running Solaris 9. I did some testing, next to the MailScanner upgrade I
upgraded from perl 5.8.3 to 5.8.5. (In an attempt to solve a problem with
corrupt messages). The old MailScanner version is also not running and gives
the same error.

I'll try to downgrade perl to 5.8.3 and see if this solves the problem.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 19:27:37 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2974.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I run MailScanner on Solaris 9 on my production systems, though not with
perl 5.8, and have no problems.

At 19:03 02/10/2004, you wrote:
>Running Solaris 9. I did some testing, next to the MailScanner upgrade I
>upgraded from perl 5.8.3 to 5.8.5. (In an attempt to solve a problem with
>corrupt messages). The old MailScanner version is also not running and gives
>the same error.
>
>I'll try to downgrade perl to 5.8.3 and see if this solves the problem.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alex at ERUS.CO.UK  Sat Oct  2 19:28:16 2004
From: alex at ERUS.CO.UK (Alex Pimperton)
Date: Thu Jan 12 21:27:07 2006
Subject: Mailscanner sends load sky-high on Debian
Message-ID: <mailman.2975.1137101227.24926.mailscanner@lists.mailscanner.info>

Hi

I've been having a few problems recently with mailscanner going awol and
sending the load average sky high on my Debian testing box.

Looking at my ps output I see:

14662 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16595 ?        ZN     0:00  \_ [MailScanner] <defunct>
14758 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17982 ?        ZN     0:00  \_ [MailScanner] <defunct>
14952 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16664 ?        ZN     0:00  \_ [MailScanner] <defunct>
15207 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17303 ?        ZN     0:00  \_ [MailScanner] <defunct>
15696 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
15770 ?        ZN     0:00  \_ [MailScanner] <defunct>
15748 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
15985 ?        ZN     0:00  \_ [MailScanner] <defunct>
15771 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
15867 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
15986 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17432 ?        ZN     0:00  \_ [MailScanner] <defunct>
15998 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16012 ?        ZN     0:00  \_ [MailScanner] <defunct>
16013 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17169 ?        ZN     0:00  \_ [MailScanner] <defunct>
16028 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16618 ?        ZN     0:00  \_ [MailScanner] <defunct>
16063 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16676 ?        ZN     0:00  \_ [MailScanner] <defunct>
16074 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17361 ?        ZN     0:00  \_ [MailScanner] <defunct>
16525 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17314 ?        ZN     0:01  \_ [MailScanner] <defunct>
16596 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16619 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17448 ?        ZN     0:01  \_ [MailScanner] <defunct>
16663 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17210 ?        ZN     0:00  \_ [MailScanner] <defunct>
16665 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16677 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16699 ?        ZN     0:00  \_ [MailScanner] <defunct>
16688 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
16700 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17170 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17211 ?        SN     0:01 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17390 ?        ZN     0:00  \_ [MailScanner] <defunct>
17304 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17945 ?        ZN     0:01  \_ [MailScanner] <defunct>
17315 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17362 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17391 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17406 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17433 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17449 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17946 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail
17983 ?        SN     0:00 /usr/bin/perl -I/usr/share/MailScanner
/usr/sbin/Mail

Is this normal? I have Max Children = 1 set in MailScanner.conf so why am I
seeing all these processes/threads?

When the load average goes up, stopping mailscanner (/etc/init.d/mailscanner
stop) fixes the problem.

I'm running 4.33.3, but I've had the same problem with unstable package
(4.34-1)

I'd appreciate any pointers!

Thanks

Alex

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From roel at GLOUDEMANS.INFO  Sat Oct  2 19:45:45 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2976.1137101227.24926.mailscanner@lists.mailscanner.info>

Damn, downgraded to perl 5.8.3. Still got the same problem. I recon it is
coming with either one of the Spamassassin modules or the modules
MailScanner installs.

By the way, which perl version are you running?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 19:50:09 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Mailscanner sends load sky-high on Debian
Message-ID: <mailman.2977.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 19:28 02/10/2004, you wrote:
>Hi
>
>I've been having a few problems recently with mailscanner going awol and
>sending the load average sky high on my Debian testing box.

With Max Children = 1 you shouldn't be seeing all these children. Take a
look in your syslog for any errors.
Also set
         Debug = yes
and then try to start MailScanner. It should print out any errors if there
are any.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 19:50:59 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2978.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 19:45 02/10/2004, you wrote:
>Damn, downgraded to perl 5.8.3. Still got the same problem. I recon it is
>coming with either one of the Spamassassin modules or the modules
>MailScanner installs.
>
>By the way, which perl version are you running?

5.6.1 as shipped with Solaris.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From roel at GLOUDEMANS.INFO  Sat Oct  2 20:02:03 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2979.1137101227.24926.mailscanner@lists.mailscanner.info>

OK, going to try the built-in perl. Which additional SpamAssassin perl
modules doe you use? (I suppose your running SA3.0) Else I'm going to do a
trial and error and see when I hit rock-bottom (if the problem is caused by
one of the additional modules)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 20:10:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2980.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:02 02/10/2004, you wrote:
>OK, going to try the built-in perl. Which additional SpamAssassin perl
>modules doe you use? (I suppose your running SA3.0) Else I'm going to do a
>trial and error and see when I hit rock-bottom (if the problem is caused by
>one of the additional modules)

I just run SA 3. If you use my Clam+SA3 installation package on the
downloads page, it will install all the pre-requisites for you.
But you'll need to do a full installation of MailScanner first so that you
get all the modules installed that MS needs.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From roel at GLOUDEMANS.INFO  Sat Oct  2 20:30:24 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2981.1137101227.24926.mailscanner@lists.mailscanner.info>

Going to try it out. Geez. perl is making a mess. Installing SA from CPAN
failed because Digest:SHA1 is missing, then when I try to satisfy
dependencies it is compaining about missing option -KPIC for cc (I use gcc)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 21:02:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2982.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:30 02/10/2004, you wrote:
>Going to try it out. Geez. perl is making a mess. Installing SA from CPAN
>failed because Digest:SHA1 is missing, then when I try to satisfy
>dependencies it is compaining about missing option -KPIC for cc (I use gcc)

Use my installation package. It solves this problem for you so that the
"make" phases all work.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From roel at GLOUDEMANS.INFO  Sat Oct  2 21:19:44 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2983.1137101227.24926.mailscanner@lists.mailscanner.info>

>Use my installation package. It solves this problem for you so that the
>"make" phases all work.

Well I did have to kill off some options in a couple of Config.pm (-KPIC
compiler options and -xdepend options), but after that was done and all was
run the system came up!

Julian, many thanks for the support.

Also, now I am running the same versions as you do. Makes for much smoother
operation :-)

By the way; I removed the lines with:
-xO3 -xdepend
and
-KPIC
from
/usr/perl5/5.6.1/lib/sun4-solaris-64int/Config.pm
and
/usr/perl5/5.00503/sun4-solaris/Config.pm

Might be worth to mention on:
http://www.sng.ecs.soton.ac.uk/mailscanner/install/solaris9.txt

That part of documentation tells you to do the miscompiling modules one by one.

Cheers,
Roel.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  2 21:25:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2984.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 21:19 02/10/2004, you wrote:
> >Use my installation package. It solves this problem for you so that the
> >"make" phases all work.
>
>Well I did have to kill off some options in a couple of Config.pm (-KPIC
>compiler options and -xdepend options), but after that was done and all was
>run the system came up!
>
>Julian, many thanks for the support.
>
>Also, now I am running the same versions as you do. Makes for much smoother
>operation :-)
>
>By the way; I removed the lines with:
>-xO3 -xdepend
>and
>-KPIC
>from
>/usr/perl5/5.6.1/lib/sun4-solaris-64int/Config.pm
>and
>/usr/perl5/5.00503/sun4-solaris/Config.pm
>
>Might be worth to mention on:
>http://www.sng.ecs.soton.ac.uk/mailscanner/install/solaris9.txt
>
>That part of documentation tells you to do the miscompiling modules one by
>one.

My installation package creates a new Config.pm with those options removed,
so that your original setup is not affected. Most people don't know enough
to mess with that Config.pm file :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Sun Oct  3 03:13:11 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0, SURBL problem: fix for Solaris
Message-ID: <mailman.2985.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Gang,

Building on the fine efforts of others on the list, I discovered
that SURBL for SA 3.0 started working for me if I tracked down
the init.pre file (installed in /etc/opt/mail/spamassassin in my
case, hunh??) and copied it to /etc/mail/spamassasin.  Many thanks
to Scott Silva and Richard Potter for this important clue.

BUT YOU WILL GET BURNED IF YOU STOP HERE!

The FQDN bug in Sys-Hostname-Long-1.2 will rename your mail server
the nanosecond that SA invokes the URIDNSBL plugin, thereby screwing
up your email delivery and causing MailScanner to hang thereafter.
Bad news.  See:

http://wiki.apache.org/spamassassin/FqdnError

My ugly fix to Sys-Hostname-Long-1.2 to solve this problem:  I edited
Long.pm in this code and removed all references to "--fqdn".  I did
this in my actual perl source tree
(/opt/perl5/lib/site_perl/5.8.5/Sys/Hostname/Long.pm).  Maybe I should
have done this to the code, rebuilt, and reinstalled.  Solved this
nasty problem for the moment, and got SURBL working too.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From karl.kappel at SEGMUELLER.DE  Sun Oct  3 08:33:49 2004
From: karl.kappel at SEGMUELLER.DE (Karl Kappel)
Date: Thu Jan 12 21:27:07 2006
Subject: Different quarantine dirs
Message-ID: <mailman.2986.1137101227.24926.mailscanner@lists.mailscanner.info>

Hi,
ist there a way to have different dirs for infected mails and blocked
attachment mails.
I've tried "Quarantine Dir" with ruleset without success.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From roel at GLOUDEMANS.INFO  Sun Oct  3 11:56:22 2004
From: roel at GLOUDEMANS.INFO (Roel Gloudemans)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2987.1137101227.24926.mailscanner@lists.mailscanner.info>

Post-mortem evaluation of this incident might be worth noting.

Eventually the problem had nothing to do with the perl version. When
installing an optional spamassassing perl module (Net::Ident I believe), a
'hostname --fqdn' was done to find out the hostname.

On Solaris 'hostname --fqdn' actually sets the hostname to --fqdn. Hence the
complaining of Socket.pm (--fqdn is an illegal name). Before the switch to
the final perl version I opened up an extra ssh session to the server,
noticing the --fqdn hostname in the command prompt and changed it back.

That's why last time it did work. If I'd listened to Julians first mail to
do a 'uname -a', I would have found out right away.

So all Solaris folks out there, whatch out when you are installing
additional perl modules for spamassassin.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sun Oct  3 12:12:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2988.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
The one that does it is Sys::Hostname::Long. This has been mentioned a few
times before, but you probably need to know the module name to find it in
the mailing list archive.
You need to find and edit this module, or it will reset your hostname every
time it runs, which is "A Bad Thing(tm)".

See
http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0409&L=mailscanner&P=R13127&I=-1&X=5613951EE2DF4A9399&Y=jkf%40ecs%2Esoton%2Eac%2Euk
http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0410&L=mailscanner&P=R5416&I=-1
http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0409&L=mailscanner&P=R95109&I=-1

or search the archive for "--fqdn".

At 11:56 03/10/2004, you wrote:
>Post-mortem evaluation of this incident might be worth noting.
>
>Eventually the problem had nothing to do with the perl version. When
>installing an optional spamassassing perl module (Net::Ident I believe), a
>'hostname --fqdn' was done to find out the hostname.
>
>On Solaris 'hostname --fqdn' actually sets the hostname to --fqdn. Hence the
>complaining of Socket.pm (--fqdn is an illegal name). Before the switch to
>the final perl version I opened up an extra ssh session to the server,
>noticing the --fqdn hostname in the command prompt and changed it back.
>
>That's why last time it did work. If I'd listened to Julians first mail to
>do a 'uname -a', I would have found out right away.
>
>So all Solaris folks out there, whatch out when you are installing
>additional perl modules for spamassassin.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sun Oct  3 12:15:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2989.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12:12 03/10/2004, you wrote:
>The one that does it is Sys::Hostname::Long. This has been mentioned a few
>times before, but you probably need to know the module name to find it in
>the mailing list archive.
>You need to find and edit this module, or it will reset your hostname every
>time it runs, which is "A Bad Thing(tm)".

Correction, only the "make test" stage of the SpamAssassin installation
process will screw up your hostname, apparently.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Sun Oct  3 13:00:50 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2990.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
NOT TRUE!!!  Per my note of last night, once you get init.pre in
the right place and get SURBL working, then Sys::Hostname::Long
will screw up your hostname every time SA finds a message that matches
the SURBL criteria.  Boom, your hostname gets changed.  I confirmed
this last night, both in MS debug mode and in regular mode.

If you are on a Solaris box using Kerberos (as I am), then the
Sys::Hostname::Long bug is really nasty.  The hostname changes, the
Kerberos key table lookup fails, and then nobody can login to the
box.

Jeff Earickson
Colby College

On Sun, 3 Oct 2004, Julian Field wrote:

> Date: Sun, 3 Oct 2004 12:15:56 +0100
> From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Error message about Socket.pm when starting MailScanner
>
> At 12:12 03/10/2004, you wrote:
>> The one that does it is Sys::Hostname::Long. This has been mentioned a few
>> times before, but you probably need to know the module name to find it in
>> the mailing list archive.
>> You need to find and edit this module, or it will reset your hostname every
>> time it runs, which is "A Bad Thing(tm)".
>
> Correction, only the "make test" stage of the SpamAssassin installation
> process will screw up your hostname, apparently.
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sun Oct  3 13:05:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Error message about Socket.pm when starting MailScanner
Message-ID: <mailman.2991.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Thanks for the correction. I based my last post on the contents of the bug
report in the SA wiki.
I must admit I wasn't sure they were right, but I hadn't tested it out myself.

At 13:00 03/10/2004, you wrote:
>NOT TRUE!!!  Per my note of last night, once you get init.pre in
>the right place and get SURBL working, then Sys::Hostname::Long
>will screw up your hostname every time SA finds a message that matches
>the SURBL criteria.  Boom, your hostname gets changed.  I confirmed
>this last night, both in MS debug mode and in regular mode.
>
>If you are on a Solaris box using Kerberos (as I am), then the
>Sys::Hostname::Long bug is really nasty.  The hostname changes, the
>Kerberos key table lookup fails, and then nobody can login to the
>box.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rpotter at RPCS.NET  Sun Oct  3 14:13:02 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0, SURBL problem: fix for Solaris
Message-ID: <mailman.2992.1137101227.24926.mailscanner@lists.mailscanner.info>

On Sat, 2 Oct 2004, Jeff A. Earickson wrote:

<snip>

> BUT YOU WILL GET BURNED IF YOU STOP HERE!
>
> The FQDN bug in Sys-Hostname-Long-1.2 will rename your mail server
> the nanosecond that SA invokes the URIDNSBL plugin, thereby screwing
> up your email delivery and causing MailScanner to hang thereafter.
> Bad news.  See:
>
> http://wiki.apache.org/spamassassin/FqdnError
>
> My ugly fix to Sys-Hostname-Long-1.2 to solve this problem:  I edited
> Long.pm in this code and removed all references to "--fqdn".  I did
> this in my actual perl source tree
> (/opt/perl5/lib/site_perl/5.8.5/Sys/Hostname/Long.pm).  Maybe I should
> have done this to the code, rebuilt, and reinstalled.  Solved this
> nasty problem for the moment, and got SURBL working too.

For the list archives, this is a Solaris problem. Us Linux folks are good to
go.

I did 2 more installs Saturday, giving me 2 RHEL U3 boxes, and a RedHat 8
box.

Kudos to Julian for MailScanner, and his SpamAssassin 3.0 installation
package. These mail servers are working flawlessly, showing a 30% spam rate.


Cheers!
--
Richard Potter RHCE
Re/Max
Kingston, ON  CANADA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From peter at UCGBOOK.COM  Sun Oct  3 16:18:02 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0, SURBL problem: fix for Solaris
Message-ID: <mailman.2993.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Richard Potter wrote:
> For the list archives, this is a Solaris problem. Us Linux folks are good to
> go.

Is that why he put Solaris in the subject line..?

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rpotter at RPCS.NET  Sun Oct  3 17:29:47 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0, SURBL problem: fix for Solaris
Message-ID: <mailman.2994.1137101227.24926.mailscanner@lists.mailscanner.info>

On Sun, 3 Oct 2004, Peter Bonivart wrote:

> Richard Potter wrote:
> > For the list archives, this is a Solaris problem. Us Linux folks are good to
> > go.

> Is that why he put Solaris in the subject line..?

Duh! I should learn to read more carefully. It was Sunday morning and
all. Sorry about that.

Richard

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From doko at CS.TU-BERLIN.DE  Sun Oct  3 18:34:42 2004
From: doko at CS.TU-BERLIN.DE (Matthias Klose)
Date: Thu Jan 12 21:27:07 2006
Subject: Mailscanner sends load sky-high on Debian
Message-ID: <mailman.2995.1137101227.24926.mailscanner@lists.mailscanner.info>

Alex Pimperton writes:
> Hi
>
> I've been having a few problems recently with mailscanner going awol and
> sending the load average sky high on my Debian testing box.

downgrade spamassassin to the version from sarge.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From b.addis at TIMESMEDIA.CO.NZ  Sun Oct  3 22:05:36 2004
From: b.addis at TIMESMEDIA.CO.NZ (Brent Addis)
Date: Thu Jan 12 21:27:07 2006
Subject: bitdefender issues
Message-ID: <mailman.2996.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
That's odd. I'm using 2.6.8.1 and it seems to function just fine.

What are you seeing with it?

David Jacobson wrote:

>Hi,
>
>Just a quick note to let the group know that Bitdefender does not work
>with kernel 2.6.8.  I asked Bitdefender what the solution was they said
>downgrade to 2.6.5.  We have now decided to scrap Bitdefender.
>
>Just incase anyone would like to know.
>
>
>

--
Regards,

Brent Addis
Group Systems Administrator
Times Media Group

Mob: 021 890 241
DDI: 488 3433

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Sun Oct  3 22:18:04 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:07 2006
Subject: Bayes not rebuilding
Message-ID: <mailman.2997.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Bayes does not seem to be rebuilding since I upgraded to 4.34.8 last
Friday. I have

Rebuild Bayes Every = 86400

in MailScanner.conf.

I upgraded to version 3 of SpamAssassin recently and started with a new
Bayes database but I have had rebuilds since then.

Any ideas?

Thanks,

--
Mike Zanker
Northampton, UK
PGP Public Key from pgp@zanker.org

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From devonharding at gmail.com  Sun Oct  3 22:40:45 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:07 2006
Subject: End user quarantine?
Message-ID: <mailman.2998.1137101227.24926.mailscanner@lists.mailscanner.info>

Is there an end user quarantine feature available for MailScanner?  I
would like the users to get an email a few time per day summarizing
all quarantine email with the ability to release them.  IronMail and
MailFrontier both have this feature.

Thanks,

-Devon

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Sun Oct  3 22:49:42 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:07 2006
Subject: bitdefender issues
Message-ID: <mailman.2999.1137101227.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Brent Addis
> Sent: Sunday, October 03, 2004 5:06 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: bitdefender issues
>
> That's odd. I'm using 2.6.8.1 and it seems to function just fine.
>
> What are you seeing with it?
>
> David Jacobson wrote:
>
> >Hi,
> >
> >Just a quick note to let the group know that Bitdefender does not work
> >with kernel 2.6.8.  I asked Bitdefender what the solution was they said
> >downgrade to 2.6.5.  We have now decided to scrap Bitdefender.
> >
> >Just incase anyone would like to know.
> >
Seems to run fine on a dual Opteron Red Hat Linux et 2.6.8 #3 SMP Fri Sep 10
15:01:16 EDT 2004 x86_64 x86_64 x86_64 GNU/Linux

I seem to remember using the *gcc3x.* rpm.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Sun Oct  3 23:11:18 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon::Blacknight Solutions)
Date: Thu Jan 12 21:27:07 2006
Subject: End user quarantine?
Message-ID: <mailman.3000.1137101227.24926.mailscanner@lists.mailscanner.info>

On Sun, 2004-10-03 at 17:40 -0400, Devon Harding wrote:
> Is there an end user quarantine feature available for MailScanner?  I
> would like the users to get an email a few time per day summarizing
> all quarantine email with the ability to release them.  IronMail and
> MailFrontier both have this feature.
>
No, it's not part of MailScanner, but there are a few related projects
that offer *some* of the functionality you are looking for.
--
 Mr. Michele Neylon
Blacknight Solutions
Hosting, Co-location & Domain Registration
http://www.blacknight.ie/
Tel. +353 (0)59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Sun Oct  3 23:35:58 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:07 2006
Subject: End user quarantine?
Message-ID: <mailman.3001.1137101227.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Devon Harding
> Sent: Sunday, October 03, 2004 5:41 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: End user quarantine?
>
> Is there an end user quarantine feature available for MailScanner?  I
> would like the users to get an email a few time per day summarizing
> all quarantine email with the ability to release them.  IronMail and
> MailFrontier both have this feature.
>
> Thanks,
>
> -Devon

We have a client who paid us to develop just such scripts and has asked us
to release the code we developed as Open Source Software. They quarantine
all spam between x and y and then send each user a daily report of what the
have in quarantine.

I haven't finished the installation directions (just to busy this week) but
if you're perl aware you can probably use these scripts with a little
modification.

The application:

1. Sends email report once a day to any user who has spam in quarantine

2. Example format of this email report; for each quarantined email:

        From:           email_address_of_sender
        Subject:                subject_line _of_email
        Click to view:  link_to_view
        Click to Release:       link_to_release

3. Links the spam emails to a web accessible directory with a ".web"
extension for viewing.

4. Enables a release link mechanism on the server

5. Can be installed with MailWatch but does not need MailWatch to operate.

INSTALL instructions should be finished in a few days but if you can't wait:

        http://www.fsl.com/support

With many thanks to the IT staff at Douglas County Oregon, USA who worked
with us to develop the scripts. Credit is also due to Kevin Potter,
Information Technology Director at Douglas County who conceived of the
concept and wrote the original shell scripts.

I'll post again when the Steve
Install instructions are complete.

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ELKNET.NET  Mon Oct  4 00:35:19 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:07 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3002.1137101227.24926.mailscanner@lists.mailscanner.info>

Prior to upgrading to SA3, I used to see quite a few 'NO_DNS_FOR_FROM' hits
in my logs. Now that I have upgraded, I see none. Not a single hit.

When I moved to SA3, I started from scratch, installing RH8, the latest MS,
exim, and SA3. Everything else appears to be running fine, just zero hits
for 'NO_DNS_FOR_FROM', even when I feed it test messages with phoney 'from'
addresses.

Any suggestions on where I should look to solve this?
Thanks!
-Alan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Mon Oct  4 00:38:08 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:07 2006
Subject: Mandrake RPMs - good source
Message-ID: <mailman.3003.1137101227.24926.mailscanner@lists.mailscanner.info>

Just rejoined the list after a couple of months absence, so thought I'd
make my first post a positive one instead of a request for assistance
(for a change ;-)

An issue I find each time I attempt to install a new version of
MailScanner on the Mandrake based server is that the src rpms will not
build.  Others work, but there is obviously something "different" about
the way Mandrake is set up that I don't understand and that doesn't
correspond to the spec files used in MS src rpms.

Anyway, this always resulted in frustrating cpan sessions.  Some modules
would fail to install from there as well, so I'd be googling all over
the place to get the required perl modules in place.

But now I have discovered: http://rpmpan.sourceforge.net/

All the modules required in binary rpm form that install easily.  Cuts
my install time on MailScanner by about 90%.

Hope it helps someone else too.

cheers
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at TC3NET.COM  Mon Oct  4 00:45:58 2004
From: mike at TC3NET.COM (Michael Baird)
Date: Thu Jan 12 21:27:07 2006
Subject: Mandrake RPMs - good source
Message-ID: <mailman.3004.1137101227.24926.mailscanner@lists.mailscanner.info>

Same here, I just install from the tar, MailScanner's install script
checks for redhat perl dependancy names, Mandrake has renamed their perl
packages for some reason.

Regards
Mike
> Just rejoined the list after a couple of months absence, so thought I'd
> make my first post a positive one instead of a request for assistance
> (for a change ;-)
>
> An issue I find each time I attempt to install a new version of
> MailScanner on the Mandrake based server is that the src rpms will not
> build.  Others work, but there is obviously something "different" about
> the way Mandrake is set up that I don't understand and that doesn't
> correspond to the spec files used in MS src rpms.
>
> Anyway, this always resulted in frustrating cpan sessions.  Some modules
> would fail to install from there as well, so I'd be googling all over
> the place to get the required perl modules in place.
>
> But now I have discovered: http://rpmpan.sourceforge.net/
>
> All the modules required in binary rpm form that install easily.  Cuts
> my install time on MailScanner by about 90%.
>
> Hope it helps someone else too.
>
> cheers
> Brian
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
--
Michael Baird <mike@tc3net.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From miguelk at konsultex.com.br  Mon Oct  4 01:09:13 2004
From: miguelk at konsultex.com.br (Miguel Koren OBrien de Lacy)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3005.1137101227.24926.mailscanner@lists.mailscanner.info>

Hendrik;

You mean Red Hat 8? I have had very good experiences with Fedora 1, but I'm sure it
also applies to Fedora 2.

Miguel

--
Konsultex Informatica (http://www.konsultex.com.br)

---------- Original Message -----------
From: Hendrik den Hartog <hden@KCBBS.GEN.NZ>
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: Mon, 4 Oct 2004 13:09:24 +1300
Subject: OT - Which Linux Now?

> Our current MailScanner runs on Linux 8. I'm looking at
> rebuilding our firewall.
> 
> Any recommnedations as to which Linux flavour to migrate
> to now that RedHat has changed?
> 
> Cheers!
> Hendrik
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> -- 
> Esta mensagem foi verificada pelo sistema de antivírus e
>  acredita-se estar livre de perigo.
------- End of Original Message -------


-- 
Esta mensagem foi verificada pelo sistema de antivírus e
 acredita-se estar livre de perigo.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hden at KCBBS.GEN.NZ  Mon Oct  4 01:09:24 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3006.1137101227.24926.mailscanner@lists.mailscanner.info>

Our current MailScanner runs on Linux 8. I'm looking at
rebuilding our firewall.

Any recommnedations as to which Linux flavour to migrate
to now that RedHat has changed?

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greg at BLASTZONE.COM  Mon Oct  4 01:18:18 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3007.1137101227.24926.mailscanner@lists.mailscanner.info>

I'm running Fedora 2.  Absolutely no complaints.

> -----Original Message-----
> From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Miguel Koren 
> OBrien de Lacy
> Sent: Sunday, October 03, 2004 5:09 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: OT - Which Linux Now?
> 
> 
> Hendrik;
> 
> You mean Red Hat 8? I have had very good experiences with 
> Fedora 1, but I'm sure it also applies to Fedora 2.
> 
> Miguel
> 
> --
> Konsultex Informatica (http://www.konsultex.com.br)
> 
> ---------- Original Message -----------
> From: Hendrik den Hartog <hden@KCBBS.GEN.NZ>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Sent: Mon, 4 Oct 2004 13:09:24 +1300
> Subject: OT - Which Linux Now?
> 
> > Our current MailScanner runs on Linux 8. I'm looking at 
> rebuilding our 
> > firewall.
> > 
> > Any recommnedations as to which Linux flavour to migrate
> > to now that RedHat has changed?
> > 
> > Cheers!
> > Hendrik
> > 
> > ------------------------ MailScanner list 
> ------------------------ To 
> > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave 
> > mailscanner' in the body of the email. Before posting, read the MAQ 
> > (http://www.mailscanner.biz/maq/) and the archives 
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > 
> > --
> > Esta mensagem foi verificada pelo sistema de antivírus e
> >  acredita-se estar livre de perigo.
> ------- End of Original Message -------
> 
> 
> -- 
> Esta mensagem foi verificada pelo sistema de antivírus e
>  acredita-se estar livre de perigo.
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james at GRAYONLINE.ID.AU  Mon Oct  4 01:18:27 2004
From: james at GRAYONLINE.ID.AU (James Gray)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3008.1137101227.24926.mailscanner@lists.mailscanner.info>

On Mon, 4 Oct 2004 10:09 am, Hendrik den Hartog wrote:
> Our current MailScanner runs on Linux 8. I'm looking at
> rebuilding our firewall.
>
> Any recommnedations as to which Linux flavour to migrate
> to now that RedHat has changed?
>
> Cheers!
> Hendrik

This could border on a holy war....but I'll bite ;)  I rin MailScanner on
Debian (Woody + backports.org) and also on FreeBSD.  Personally, I find
Debian's packaging system far more elegant for remote admin that BSD's
ports.  However, that could also be a familiarity thing too - fBSD'ers
don't flame me :)

Debian doesn't have any "official" support providers so is harder to upsell
through the food chain, SuSE Enterprise Linux and RedHat Enterprise Server
both have mature and well designed support structures if that's important
(and MailScanner is packaged AFAIK for both platforms).

If you're planning on running AMD64 hardware (Athlon64/Opteron), SuSE EL is
the best choice IMHO.  For x86, go with RedHat ES.  If you run a mixed
environment (Sparc/x86/PowerPC etc) Debian is a good choice due to it's
consistent installation, layout and management tools across all platforms.

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Mon Oct  4 01:26:50 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:07 2006
Subject: change from sendmail to postfix - messages now stuck in hold
Message-ID: <mailman.3009.1137101227.24926.mailscanner@lists.mailscanner.info>

I have two servers running MailScanner - home and office.  The home
machine was installed from scratch using a single instance of postfix as
documented on the MS site and works fine.  The office machine was
running an old version of MS and used two instances of sendmail.  This
also worked, but not as well, so I moved the office machine to postfix
and installed the latest stable version of MS.

Without MS running and without the:

header_checks = regexp:/etc/postfix/header_checks

line in postfix's main.cf file, mail is processed in both directions,
but with this line in action and MS running, mail is received into the
hold directory and never delivered.

I changed /etc/sysconfig/MailScanner to read:

MTA=postfix

and

POSTFIXINCF=/etc/postfix   # Directory containing incoming conf
POSTFIXOUTCF=/etc/postfix  # Directory containing outgoing conf

MailScanner.conf is set to:

Run As User = postfix
Run As Group = postfix
Incoming Queue Dir = /var/spool/postfix/hold
Outgoing Queue Dir = /var/spool/postfix/incoming

Permissions on postfix spool directories are set correctly.

All this stuff is identical on the two servers.

On the one not working I get a repeating message in /var/log/mail/info:

MailScanner E-Mail Virus Scanner version 4.29.7 starting...
Using Custom Function file
/usr/lib/MailScanner/MailScanner/CustomFunctions/MyExample.pm

and I see a number of defunct processes.

Any bells ringing out there?

TIA
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From steve at SSNI.CA  Mon Oct  4 01:52:51 2004
From: steve at SSNI.CA (Steve Roy)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3010.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hendrik den Hartog wrote:
> Our current MailScanner runs on Linux 8. I'm looking at
> rebuilding our firewall.
>
> Any recommnedations as to which Linux flavour to migrate
> to now that RedHat has changed?
>
I use CentOS ver 3.3
www.centos.org

 From their website:
CentOS-3 is a 100% compatible rebuild of RHEL 3 in full compliance with
RedHat's redistribution requirements. It is for people who need an
enterprise class OS without the cost of certification and support.

Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ochanis at ncc.edu  Mon Oct  4 01:52:53 2004
From: ochanis at ncc.edu (Steve Ochani)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3011.1137101227.24926.mailscanner@lists.mailscanner.info>

You could try
http://whiteboxlinux.org/

it's basicly Red Hat Enterprise Linux 3 without the non-open source packages. plus support


On 4 Oct 2004 at 13:09, Hendrik den Hartog wrote:

> Our current MailScanner runs on Linux 8. I'm looking at
> rebuilding our firewall.
>
> Any recommnedations as to which Linux flavour to migrate
> to now that RedHat has changed?
>
> Cheers!
> Hendrik


«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»§«¤»¥«¤»
Education is what remains after one has forgotten everything he
learned in school. -Albert Einstein

Steve O.
http://www.steveo.us

SUNY NCC Physical Sciences Dept. Network Admin
SUNY NCC MATH/COMPUTER Unix Admin
http://www.matcmp.ncc.edu

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Mon Oct  4 02:11:29 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3012.1137101227.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of James Gray
> Sent: Sunday, October 03, 2004 8:18 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: OT - Which Linux Now?
>
> On Mon, 4 Oct 2004 10:09 am, Hendrik den Hartog wrote:
> > Our current MailScanner runs on Linux 8. I'm looking at
> > rebuilding our firewall.
> >
> > Any recommnedations as to which Linux flavour to migrate
> > to now that RedHat has changed?
> >

This question crops up every month or two and a search of the archives for
whitebox or taolinux will give you quite a bit of information.

We have tested MailScanner and all related apps on:

        RH ES 3.0
        Whitebox Linux (RH 3.0 clone)
        TaoLinux (RH 3.0 clone)

Absolutely no problems and very easy to maintain thanks to Julian's rpm
install version.

If it's a home system and you want cutting edge - Fedora is also fine. If
it's a production system and you want to sleep at night, my personal choice
would be one of the above, No flames please - we also support clients who
run FreeBSD, Solaris, etc systems. I can absolutely say that the best OS for
you is probably the one that you're the most experienced and comfortable
with. (Amen :)

Also there is a long promised support window for RH 3.0; + 4years to go.

Hope this helps,


Steve
Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wont-i at wkh.org  Mon Oct  4 04:46:15 2004
From: wont-i at wkh.org (William K. Hardeman)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3013.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
--On Monday, October 04, 2004 13:09:24 +1300 Hendrik den Hartog
<hden@KCBBS.GEN.NZ> wrote:

> Our current MailScanner runs on Linux 8. I'm looking at
> rebuilding our firewall.
>
> Any recommnedations as to which Linux flavour to migrate
> to now that RedHat has changed?
>

We use Slackware for our servers, here. Although it's a little more work
than RH or SUSE from a package management standpoint, it's rock solid and
you don't have to play dependency hell.

Just thought I'd throw in a so-far-unmentioned alternative. :-)

Will

--
----------------------------------------------------------------------------
William K. Hardeman
wont-i@wkh.org
http://www.wkh.org

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From referencing at REZEAU.NET  Mon Oct  4 06:28:41 2004
From: referencing at REZEAU.NET (REZEAU StXphane)
Date: Thu Jan 12 21:27:07 2006
Subject: change from sendmail to postfix - messages now stuck in hold
Message-ID: <mailman.3014.1137101227.24926.mailscanner@lists.mailscanner.info>

I've just had the same problem.
All of my incoming/outgoing messages couldn't be delivered because of the
missing word "hold" in the line :

hash_queue_names = active, bounce, corrupt, hold, defer, flush, incoming

in my /etc/postfix/main.cf file.

On Mon, 4 Oct 2004 10:26:50 +1000, Brian Parish <clicknow@SWIFTDSL.COM.AU>
wrote:

>I have two servers running MailScanner - home and office.  The home
>machine was installed from scratch using a single instance of postfix as
>documented on the MS site and works fine.  The office machine was
>running an old version of MS and used two instances of sendmail.  This
>also worked, but not as well, so I moved the office machine to postfix
>and installed the latest stable version of MS.
>
>Without MS running and without the:
>
>header_checks = regexp:/etc/postfix/header_checks
>
>line in postfix's main.cf file, mail is processed in both directions,
>but with this line in action and MS running, mail is received into the
>hold directory and never delivered.
>
>I changed /etc/sysconfig/MailScanner to read:
>
>MTA=postfix
>
>and
>
>POSTFIXINCF=/etc/postfix   # Directory containing incoming conf
>POSTFIXOUTCF=/etc/postfix  # Directory containing outgoing conf
>
>MailScanner.conf is set to:
>
>Run As User = postfix
>Run As Group = postfix
>Incoming Queue Dir = /var/spool/postfix/hold
>Outgoing Queue Dir = /var/spool/postfix/incoming
>
>Permissions on postfix spool directories are set correctly.
>
>All this stuff is identical on the two servers.
>
>On the one not working I get a repeating message in /var/log/mail/info:
>
>MailScanner E-Mail Virus Scanner version 4.29.7 starting...
>Using Custom Function file
>/usr/lib/MailScanner/MailScanner/CustomFunctions/MyExample.pm
>
>and I see a number of defunct processes.
>
>Any bells ringing out there?
>
>TIA
>Brian
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Mon Oct  4 07:57:04 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:07 2006
Subject: change from sendmail to postfix - messages now stuck in hold
Message-ID: <mailman.3015.1137101227.24926.mailscanner@lists.mailscanner.info>

Well I have no hash_queue_names = line in either main.cf file.  As I've
no idea what it does I tried it on the server with the problem - no
difference.

thanks anyway, but still no wiser.

Brian

On Mon, 2004-10-04 at 15:28, REZEAU St=?ISO-8859-1?Q?=E9phane?= wrote:
> I've just had the same problem.
> All of my incoming/outgoing messages couldn't be delivered because of the
> missing word "hold" in the line :
>
> hash_queue_names = active, bounce, corrupt, hold, defer, flush, incoming
>
> in my /etc/postfix/main.cf file.
>
> On Mon, 4 Oct 2004 10:26:50 +1000, Brian Parish <clicknow@SWIFTDSL.COM.AU>
> wrote:
>
> >I have two servers running MailScanner - home and office.  The home
> >machine was installed from scratch using a single instance of postfix as
> >documented on the MS site and works fine.  The office machine was
> >running an old version of MS and used two instances of sendmail.  This
> >also worked, but not as well, so I moved the office machine to postfix
> >and installed the latest stable version of MS.
> >
> >Without MS running and without the:
> >
> >header_checks = regexp:/etc/postfix/header_checks
> >
> >line in postfix's main.cf file, mail is processed in both directions,
> >but with this line in action and MS running, mail is received into the
> >hold directory and never delivered.
> >
> >I changed /etc/sysconfig/MailScanner to read:
> >
> >MTA=postfix
> >
> >and
> >
> >POSTFIXINCF=/etc/postfix   # Directory containing incoming conf
> >POSTFIXOUTCF=/etc/postfix  # Directory containing outgoing conf
> >
> >MailScanner.conf is set to:
> >
> >Run As User = postfix
> >Run As Group = postfix
> >Incoming Queue Dir = /var/spool/postfix/hold
> >Outgoing Queue Dir = /var/spool/postfix/incoming
> >
> >Permissions on postfix spool directories are set correctly.
> >
> >All this stuff is identical on the two servers.
> >
> >On the one not working I get a repeating message in /var/log/mail/info:
> >
> >MailScanner E-Mail Virus Scanner version 4.29.7 starting...
> >Using Custom Function file
> >/usr/lib/MailScanner/MailScanner/CustomFunctions/MyExample.pm
> >
> >and I see a number of defunct processes.
> >
> >Any bells ringing out there?
> >
> >TIA
> >Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct  4 08:34:33 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:07 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3016.1137101227.24926.mailscanner@lists.mailscanner.info>

>> Our current MailScanner runs on Linux 8. I'm looking at rebuilding
>> our firewall.
>>
>> Any recommnedations as to which Linux flavour to migrate to now that
>> RedHat has changed?

We have MailScanner running on a wide variety of distros.
Whitebox - as already mentioned
Fedora Core 1
Slackware - not as "graceful" to maintain
We have also still got a few legacy machines with RH9 - not much fun by
comparison with Whitebox





Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 08:45:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3017.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Upgrade to the latest Net::DNS.

At 00:35 04/10/2004, you wrote:
>Prior to upgrading to SA3, I used to see quite a few 'NO_DNS_FOR_FROM' hits
>in my logs. Now that I have upgraded, I see none. Not a single hit.
>
>When I moved to SA3, I started from scratch, installing RH8, the latest MS,
>exim, and SA3. Everything else appears to be running fine, just zero hits
>for 'NO_DNS_FOR_FROM', even when I feed it test messages with phoney 'from'
>addresses.
>
>Any suggestions on where I should look to solve this?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 08:47:33 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Mandrake RPMs - good source
Message-ID: <mailman.3018.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 00:38 04/10/2004, you wrote:
>All the modules required in binary rpm form that install easily.  Cuts
>my install time on MailScanner by about 90%.
>
>Hope it helps someone else too.

Another way of cutting your install time: go through install.sh and comment
out all the "sleep" commands :-)
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 08:52:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: change from sendmail to postfix - messages now stuck in hold
Message-ID: <mailman.3019.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Please kill all your MailScanner processes, set
         Debug = yes
in MailScanner.conf and then run check_mailscanner.
That should print up an error message. If it just sits there, there are no
messages in the incoming queue, so wait for 1 to arrive.

At 01:26 04/10/2004, you wrote:
>I have two servers running MailScanner - home and office.  The home
>machine was installed from scratch using a single instance of postfix as
>documented on the MS site and works fine.  The office machine was
>running an old version of MS and used two instances of sendmail.  This
>also worked, but not as well, so I moved the office machine to postfix
>and installed the latest stable version of MS.
>
>Without MS running and without the:
>
>header_checks = regexp:/etc/postfix/header_checks
>
>line in postfix's main.cf file, mail is processed in both directions,
>but with this line in action and MS running, mail is received into the
>hold directory and never delivered.
>
>I changed /etc/sysconfig/MailScanner to read:
>
>MTA=postfix
>
>and
>
>POSTFIXINCF=/etc/postfix   # Directory containing incoming conf
>POSTFIXOUTCF=/etc/postfix  # Directory containing outgoing conf
>
>MailScanner.conf is set to:
>
>Run As User = postfix
>Run As Group = postfix
>Incoming Queue Dir = /var/spool/postfix/hold
>Outgoing Queue Dir = /var/spool/postfix/incoming
>
>Permissions on postfix spool directories are set correctly.
>
>All this stuff is identical on the two servers.
>
>On the one not working I get a repeating message in /var/log/mail/info:
>
>MailScanner E-Mail Virus Scanner version 4.29.7 starting...
>Using Custom Function file
>/usr/lib/MailScanner/MailScanner/CustomFunctions/MyExample.pm
>
>and I see a number of defunct processes.
>
>Any bells ringing out there?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From misterpo at IFRANCE.COM  Mon Oct  4 10:05:06 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:07 2006
Subject: MailScanner, SA and Bayes : how to update
Message-ID: <mailman.3020.1137101227.24926.mailscanner@lists.mailscanner.info>

The first results of this MailScanner/SA solution are impressive : 860
messages detected as SPAM during the week-end !

Is it dangerous to run the sa-learn process while MailScanner is running ?

I would like to go on feeding SA with spam archives...

Thanks for your help,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Mon Oct  4 10:18:25 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:07 2006
Subject: MailScanner, SA and Bayes : how to update
Message-ID: <mailman.3021.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi

nom it's fine to do this, I run a daily job to do this, it was hourly,
but the amount of corrections I get are low enough to go daily.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mister PO wrote:
> The first results of this MailScanner/SA solution are impressive : 860
> messages detected as SPAM during the week-end !
>
> Is it dangerous to run the sa-learn process while MailScanner is running ?
>
> I would like to go on feeding SA with spam archives...
>
> Thanks for your help,
>
> PO.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Peter.Bates at LSHTM.AC.UK  Mon Oct  4 11:00:47 2004
From: Peter.Bates at LSHTM.AC.UK (Peter Bates)
Date: Thu Jan 12 21:27:07 2006
Subject: Envelope senders, SA and MailScanner
Message-ID: <mailman.3022.1137101227.24926.mailscanner@lists.mailscanner.info>

Hello all...

In the recent SA 3.0.0 release announcement, I saw under 'Engine
Changes':

  - Rules can now test the "MAIL FROM:" address used in the SMTP
    transaction if it was logged to the message headers using the
    "EnvelopeFrom" pseudo-header.  This allows rules such as SPF to be
    applied.

Does MailScanner support this? Does it automatically pass the envelope
sender (seeing as MS clearly knows it), or does this require some
further configuration?

Just curious!



--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, IT Services.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 11:53:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Envelope senders, SA and MailScanner
Message-ID: <mailman.3023.1137101227.24926.mailscanner@lists.mailscanner.info>

Well spotted.
Attached is a patch to add this feature.

At 11:00 04/10/2004, you wrote:
>Hello all...
>
>In the recent SA 3.0.0 release announcement, I saw under 'Engine
>Changes':
>
>   - Rules can now test the "MAIL FROM:" address used in the SMTP
>     transaction if it was logged to the message headers using the
>     "EnvelopeFrom" pseudo-header.  This allows rules such as SPF to be
>     applied.
>
>Does MailScanner support this? Does it automatically pass the envelope
>sender (seeing as MS clearly knows it), or does this require some
>further configuration?
>
>Just curious!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: "SA.pm.patch")  692bytes. ]
    [ Unable to print this part. ]


    [ Part 3: "Attached Text" ]

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From Kevin.Spicer at BMRB.CO.UK  Mon Oct  4 12:03:14 2004
From: Kevin.Spicer at BMRB.CO.UK (Spicer, Kevin)
Date: Thu Jan 12 21:27:07 2006
Subject: Mandrake RPMs - good source
Message-ID: <mailman.3024.1137101227.24926.mailscanner@lists.mailscanner.info>

-----Original Message-----
From: Brian Parish [mailto:clicknow@SWIFTDSL.COM.AU] 

>An issue I find each time I attempt to install a new version of
MailScanner on the 
>Mandrake based server is that the src rpms will not build.  Others
work, but there is 
>obviously something "different" about the way Mandrake is set up that I
don't understand 
>and that doesn't correspond to the spec files used in MS src rpms.

I always found just passing the nodeps argument to install.sh did the
trick quite nicely.



BMRB International 
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the 
recipient and may contain confidential and/or privileged 
material.  If you have received this in error, please contact the 
sender and delete this message immediately.  Disclosure, copying 
or other action taken in respect of this email or in 
reliance on it is prohibited.  BMRB International Limited 
accepts no liability in relation to any personal emails, or 
content of any email which does not directly relate to our 
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Q.G.Campbell at NEWCASTLE.AC.UK  Mon Oct  4 13:40:45 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:07 2006
Subject: Envelope senders, SA and MailScanner
Message-ID: <mailman.3025.1137101227.24926.mailscanner@lists.mailscanner.info>

Julian

How long before this patch is available in a stable release of MS?

I was just about to start upgrading to 4.34.8-1 on 8 machines after
successfully running with 4.34.6-1 (BETA) on one of them.
 
Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 04 October 2004 11:54
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Envelope senders, SA and MailScanner
>
>Well spotted.
>Attached is a patch to add this feature.
>
>At 11:00 04/10/2004, you wrote:
>>Hello all...
>>
>>In the recent SA 3.0.0 release announcement, I saw under 'Engine
>>Changes':
>>
>>   - Rules can now test the "MAIL FROM:" address used in the SMTP
>>     transaction if it was logged to the message headers using the
>>     "EnvelopeFrom" pseudo-header.  This allows rules such as 
>SPF to be
>>     applied.
>>
>>Does MailScanner support this? Does it automatically pass the envelope
>>sender (seeing as MS clearly knows it), or does this require some
>>further configuration?
>>
>>Just curious!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 13:44:08 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Envelope senders, SA and MailScanner
Message-ID: <mailman.3026.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Start of next month.

At 13:40 04/10/2004, you wrote:
>Julian
>
>How long before this patch is available in a stable release of MS?
>
>I was just about to start upgrading to 4.34.8-1 on 8 machines after
>successfully running with 4.34.6-1 (BETA) on one of them.
>
> >-----Original Message-----
> >From: MailScanner mailing list
> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> >Sent: 04 October 2004 11:54
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Envelope senders, SA and MailScanner
> >
> >Well spotted.
> >Attached is a patch to add this feature.
> >
> >At 11:00 04/10/2004, you wrote:
> >>Hello all...
> >>
> >>In the recent SA 3.0.0 release announcement, I saw under 'Engine
> >>Changes':
> >>
> >>   - Rules can now test the "MAIL FROM:" address used in the SMTP
> >>     transaction if it was logged to the message headers using the
> >>     "EnvelopeFrom" pseudo-header.  This allows rules such as
> >SPF to be
> >>     applied.
> >>
> >>Does MailScanner support this? Does it automatically pass the envelope
> >>sender (seeing as MS clearly knows it), or does this require some
> >>further configuration?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From misterpo at IFRANCE.COM  Mon Oct  4 13:47:54 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:07 2006
Subject: MailScanner, SA and Bayes : how to update
Message-ID: <mailman.3027.1137101227.24926.mailscanner@lists.mailscanner.info>

Sorry but my knowledge of SA is very poor...

Is there an other way to teach SA than manually feeding the Bays DB with
the sa-learn command line and a sample spam file?

When should the Bayes DB be rebuilt ? After each update ?

Thanks !

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From chris.jones at ATMOSENERGY.COM  Mon Oct  4 14:01:09 2004
From: chris.jones at ATMOSENERGY.COM (Jones, Chris)
Date: Thu Jan 12 21:27:07 2006
Subject: CustomConfig.pm
Message-ID: <mailman.3028.1137101227.24926.mailscanner@lists.mailscanner.info>

I have added a function to the CustomConfig.pm but I cannot get logging
to work
Is there any reason I should not see this in the log?

Here is some entrys from the MailScanner.conf
# This is the syslog "facility" name that MailScanner uses. If you don't
# know what a syslog facility name is, then either don't change this
value
# or else go and read "man syslog.conf". The default value of "mail"
will
# cause the MailScanner logs to go into the same place as all your other
# mail logs
Syslog Facility = mail

# Spam Blacklist:
# Make this point to a ruleset, and anything in that ruleset whose value
# is "yes" will *always* be marked as spam.
# This can also be the filename of a ruleset.
# cjones changed this to support MySqlBL
#Is Definitely Spam = no
Is Definitely Spam = &MySqlBL

# Set Run In Foreground to "yes" if you want MailScanner to operate
# normally in foreground (and not as a background daemon).
# Use this if you are controlling the execution of MailScanner
# with a tool like DJB's 'supervise' (see
http://cr.yp.to/daemontools.html).
#Run In Foreground = no
#cjones changed this to debug
Run In Foreground = yes


This is from CustomConfig.pm
sub InitMySqlBL {
  my( $MySqldb );
  $MySqldb = "************* MysqlBL *****************";
  MailScanner::Log::InfoLog("Starting up MySql spam Blacklist, " .
                            "Reading from mysql %s", $MySqldb );

}
#
sub MySqlBL {
  $MySqldb = "************* MysqlBL *****************";
  MailScanner::Log::InfoLog("MySqlBlacklist: " .
                            "Is returning a 1 as a test value %s",
$MySqldb );
  return 1;

}

sub EndMySqlBL {
  my( $MySqldb );
  $MySqldb = "************* END MysqlBL *****************";
  MailScanner::Log::DebugLog("Ending  MySql spam Blacklist, " .
                            "Reading from mysql %s", $MySqldb );
}


This is all I see in the maillog:
Oct  4 07:55:41 dfw1wu22 MailScanner[21468]: Config: calling custom init
function MySqlBL

I have tried changing:
  MailScanner::Log::InfoLog("Starting up MySql spam Blacklist, " .
                            "Reading from mysql %s", $MySqldb );
To read:

  MailScanner::Log::DebugLog("Ending  MySql spam Blacklist, " .
                            "Reading from mysql %s", $MySqldb );

I don't even get it in the foreground output when I run MailScanner.

Thanks,
Chris Jones
System Engineer
Atmos Energy Corporation

"A leader must never care more about being liked than being right."
George W. Bush

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 14:45:19 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: MailScanner, SA and Bayes : how to update
Message-ID: <mailman.3029.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 13:47 04/10/2004, you wrote:
>Sorry but my knowledge of SA is very poor...
>
>Is there an other way to teach SA than manually feeding the Bays DB with
>the sa-learn command line and a sample spam file?

It automatically learns from mail that is either very spammy or very
non-spammy ("hammy"). So you don't actually need to do anything if you
don't want to.

>When should the Bayes DB be rebuilt ? After each update ?

Depending on your mail volume, every few days is usually sufficient, what
you want to do is an "expiry" run, not a rebuild.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dfilchak at sympatico.ca  Mon Oct  4 15:13:23 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:07 2006
Subject: PDF Corruption Again
Message-ID: <mailman.3030.1137101227.24926.mailscanner@lists.mailscanner.info>

Hi,

A while back, I was having a problem with PDF files being corrupted by
MailScanner. As suggested by Julian, I upgraded to the latest MailScanner at
that point and the problem was fixed. However, it has started to happen
again for no apparent reason. I have not changed anything since the upgrade
so unless there is some voodoo going on here then this should not be
happening. Any ideas anyone?

Here is my current installs:

Linux rosewood.zuka.net 2.4.20-31.9 #1 Tue Apr 13 18:04:23 EDT 2004 i686
i686 i386 GNU/Linux
This is Red Hat Linux release 9 (Shrike)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.34.4
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.03    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
5.413   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.806   DB_File
1.00    Digest
1.01    Digest::HMAC
2.20    Digest::MD5
2.01    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000000        Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
0.31    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.21    URI

David Filchak
President - Zuka Inc.
Toronto, On Canada M5V2J1
www.zuka.net | www.screamingmedia.ca

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From devonharding at gmail.com  Mon Oct  4 15:20:19 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:07 2006
Subject: End user quarantine?
Message-ID: <mailman.3031.1137101227.24926.mailscanner@lists.mailscanner.info>

This looks to be really impressive.  Let us know when the INSTALL doc
will be available or a quick version of the doc would be nice.

-Devon


On Sun, 3 Oct 2004 18:35:58 -0400, Steve Swaney <steve.swaney@fsl.com> wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Devon Harding
> > Sent: Sunday, October 03, 2004 5:41 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: End user quarantine?
> >
> > Is there an end user quarantine feature available for MailScanner?  I
> > would like the users to get an email a few time per day summarizing
> > all quarantine email with the ability to release them.  IronMail and
> > MailFrontier both have this feature.
> >
> > Thanks,
> >
> > -Devon
>
> We have a client who paid us to develop just such scripts and has asked us
> to release the code we developed as Open Source Software. They quarantine
> all spam between x and y and then send each user a daily report of what the
> have in quarantine.
>
> I haven't finished the installation directions (just to busy this week) but
> if you're perl aware you can probably use these scripts with a little
> modification.
>
> The application:
>
> 1. Sends email report once a day to any user who has spam in quarantine
>
> 2. Example format of this email report; for each quarantined email:
>
>         From:           email_address_of_sender
>         Subject:                subject_line _of_email
>         Click to view:  link_to_view
>         Click to Release:       link_to_release
>
> 3. Links the spam emails to a web accessible directory with a ".web"
> extension for viewing.
>
> 4. Enables a release link mechanism on the server
>
> 5. Can be installed with MailWatch but does not need MailWatch to operate.
>
> INSTALL instructions should be finished in a few days but if you can't wait:
>
>         http://www.fsl.com/support
>
> With many thanks to the IT staff at Douglas County Oregon, USA who worked
> with us to develop the scripts. Credit is also due to Kevin Potter,
> Information Technology Director at Douglas County who conceived of the
> concept and wrote the original shell scripts.
>
> I'll post again when the Steve
> Install instructions are complete.
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From devonharding at gmail.com  Mon Oct  4 15:31:54 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:07 2006
Subject: Cannot start DCC as deamon
Message-ID: <mailman.3032.1137101227.24926.mailscanner@lists.mailscanner.info>

Following the instruction on how to Optimize Mailscanner,
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html, for
some reason, I cannot start the DDC service.  I get the following
error:

[root@mars root]# service DCC start
DCC: cannot start dccd; SRVR_ID not set in /var/dcc/dcc_conf

I cannot find anywhere on how to  set the SRVR_ID value or what it is
supposed to be.

-Devon

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Mon Oct  4 15:41:06 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:07 2006
Subject: Cannot start DCC as deamon
Message-ID: <mailman.3033.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Devon Harding wrote:
> Following the instruction on how to Optimize Mailscanner,
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html, for
> some reason, I cannot start the DDC service.  I get the following
> error:
>
> [root@mars root]# service DCC start
> DCC: cannot start dccd; SRVR_ID not set in /var/dcc/dcc_conf
>
> I cannot find anywhere on how to  set the SRVR_ID value or what it is
> supposed to be.

Did you enable DCCD or DCCifd?

>
> -Devon
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From oliverr at TRAYPORT.COM  Mon Oct  4 16:32:03 2004
From: oliverr at TRAYPORT.COM (Oliver Rooney)
Date: Thu Jan 12 21:27:07 2006
Subject: MailScanner 4.34.8 wont start
Message-ID: <mailman.3034.1137101227.24926.mailscanner@lists.mailscanner.info>

I have just ugraded from 4.25.14 to 4.34.8, on Debian Woody with a 2.2.20
kernel, perl 5.6.1. I used upgrade_mailscanner_conf, and then moved all
files from /opt (where 4.25.14 is installed) to /usr/local/share and
adjusted paths in conf file accordingly.

However if I run check_mailscanner no mail is delived and MailScanner
logs "MailScanner[16086]: MailScanner E-Mail Virus Scanner version 4.34.8
starting..." every 10 seconds and the PID increments.

If run with "Debug = Yes" in Mailcanner.conf I get "Starting MailScanner...
In Debugging mode, not forking...
Undefined subroutine &MailScanner::Config::initialise called
at /usr/local/share/MailScanner/bin/MailScanner line 404."

Now "sub initialise" is defined in /usr/local/share/MailScanner-
4.34.8/lib/MailScanner/Config.pm but it is not in /opt/MailScanner-4.25-
14/lib/MailScanner/Config.pm. Which seems to me like a possible problem,
but my powers of perl wizardry are too weak to work out a solution.

Many thanks,

Oliver Rooney

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From devonharding at gmail.com  Mon Oct  4 16:44:23 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:07 2006
Subject: Cannot start DCC as deamon
Message-ID: <mailman.3035.1137101227.24926.mailscanner@lists.mailscanner.info>

I set 'DCCIFD_ENABLE=on' inf /var/dcc/dcc_conf as per MailScanner's instruction.


On Mon, 4 Oct 2004 10:41:06 -0400, Ugo Bellavance <ugob@camo-route.com> wrote:
>
>
> Devon Harding wrote:
> > Following the instruction on how to Optimize Mailscanner,
> > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/312.html, for
> > some reason, I cannot start the DDC service.  I get the following
> > error:
> >
> > [root@mars root]# service DCC start
> > DCC: cannot start dccd; SRVR_ID not set in /var/dcc/dcc_conf
> >
> > I cannot find anywhere on how to  set the SRVR_ID value or what it is
> > supposed to be.
>
> Did you enable DCCD or DCCifd?
>
> >
> > -Devon
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Mon Oct  4 17:06:35 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:07 2006
Subject: Cannot start DCC as deamon
Message-ID: <mailman.3036.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Devon Harding wrote:

> I set 'DCCIFD_ENABLE=on' inf /var/dcc/dcc_conf as per MailScanner's instruction.

It looks like it is trying to start DCCD, which is not what you want.
Do you have DCCD_ENABLE to on?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From combs at magnet.fsu.edu  Mon Oct  4 17:18:18 2004
From: combs at magnet.fsu.edu (Tom Combs)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0 generates garbled Makefile
Message-ID: <mailman.3037.1137101227.24926.mailscanner@lists.mailscanner.info>

Folks,

  I'm attempting to upgrade from SA 2.64 to SA 3.0 on a box running
  RHEL 3.0. When trying to run via either CPAN or from the tarfile
  using "perl Makefile.PL", I get a botched make file and can't do
  the install. It also warns about not being able to find pod2man
  even though this is in /usr/bin/pod2man.

  Here is an extract of the Makefile where is starts going haywire:


INSTALLSITELIB = /usr/lib/perl5/site_perl/5.8.0'    <-- No leading '
installsiteman1='/usr/share/man/man1'
installsiteman3='/usr/share/man/man3'
installsitescript='/usr/bin'
installstyle='lib/perl5'  <-- ???
installusrbinperl='define'
installvendorarch='/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi'
installvendorbin='/usr/bin'
installvendorhtml1=''
installvendorhtml3=''
installvendorlib='/usr/lib/perl5/vendor_perl/5.8.'
INSTALLVENDORLIB = ib/perl5'  <-- ???
installusrbinperl='def        <-- No trailing '
INSTALLARCHLIB = /usr/lib/perl5/5.8.0/i386-linux-thread-multi
INSTALLSITEARCH = /usr/lib/pe  <-- going down hill
INSTALLVENDORARCH = /usr/
INSTALLBIN = /usr/bin'
installhtml1dir=''
installhtml3dir=''
installman1
INSTALLSITEBIN = /usr
INSTALLVENDORBIN = /usr/bin'


  I'm  just doing a vanilla install and had no problem with the earlier
  version of SA. I could try to just fix the make file but if 3.0 can't
  even do the make, I'm not very comfortable running it. Has anyone else
  had this problem?

  Thanks,  Tom Combs


--
Tom Combs                                      E-mail: combs@magnet.fsu.edu
National High Magnetic Field Laboratory        Phone:  (850) 644-1657
1800 E. Paul Dirac Drive                       Tallahassee, FL 32310

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Mon Oct  4 17:18:46 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:07 2006
Subject: Update to corrupted PDF issue
Message-ID: <mailman.3038.1137101227.24926.mailscanner@lists.mailscanner.info>

Just to update my email from a couple of hours ago. I can receive emails
from other people to me that have PDF attachments and the PDF is fine.
However, if I send the PDF to a client and CC myself or send it directly to
myself, the PDF is unreadable.

I really do not know where to start here except perhaps updating to the very
latest.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From chrisk at OS-IT.NET  Mon Oct  4 17:43:46 2004
From: chrisk at OS-IT.NET (Chris Kissinger)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0 generates garbled Makefile
Message-ID: <mailman.3039.1137101227.24926.mailscanner@lists.mailscanner.info>

This is the same error as RH9, Fedora, etc. with the $LANG settings
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/121.html


Chris

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Tom Combs
Sent: Monday, October 04, 2004 9:18 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: SA 3.0 generates garbled Makefile

Folks,

  I'm attempting to upgrade from SA 2.64 to SA 3.0 on a box running
  RHEL 3.0. When trying to run via either CPAN or from the tarfile
  using "perl Makefile.PL", I get a botched make file and can't do
  the install. It also warns about not being able to find pod2man
  even though this is in /usr/bin/pod2man.

  Here is an extract of the Makefile where is starts going haywire:


INSTALLSITELIB = /usr/lib/perl5/site_perl/5.8.0'    <-- No leading '
installsiteman1='/usr/share/man/man1'
installsiteman3='/usr/share/man/man3'
installsitescript='/usr/bin'
installstyle='lib/perl5'  <-- ???
installusrbinperl='define'
installvendorarch='/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi'
installvendorbin='/usr/bin'
installvendorhtml1=''
installvendorhtml3=''
installvendorlib='/usr/lib/perl5/vendor_perl/5.8.'
INSTALLVENDORLIB = ib/perl5'  <-- ???
installusrbinperl='def        <-- No trailing '
INSTALLARCHLIB = /usr/lib/perl5/5.8.0/i386-linux-thread-multi
INSTALLSITEARCH = /usr/lib/pe  <-- going down hill
INSTALLVENDORARCH = /usr/
INSTALLBIN = /usr/bin'
installhtml1dir=''
installhtml3dir=''
installman1
INSTALLSITEBIN = /usr
INSTALLVENDORBIN = /usr/bin'


  I'm  just doing a vanilla install and had no problem with the earlier
  version of SA. I could try to just fix the make file but if 3.0 can't
  even do the make, I'm not very comfortable running it. Has anyone else
  had this problem?

  Thanks,  Tom Combs

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 17:51:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0 generates garbled Makefile
Message-ID: <mailman.3040.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I suggest you use my combined Clam+SA package available from the
MailScanner downloads page. This will install all the pre-requisites of
both packages as well.
Just because it installs Clam as well doesn't mean you have to use Clam :-)

Make sure you remove the utf8 stuff from /etc/sysconfig/i18n before you
start, too.

At 17:18 04/10/2004, you wrote:
>Folks,
>
>   I'm attempting to upgrade from SA 2.64 to SA 3.0 on a box running
>   RHEL 3.0. When trying to run via either CPAN or from the tarfile
>   using "perl Makefile.PL", I get a botched make file and can't do
>   the install. It also warns about not being able to find pod2man
>   even though this is in /usr/bin/pod2man.
>
>   Here is an extract of the Makefile where is starts going haywire:
>
>
>INSTALLSITELIB = /usr/lib/perl5/site_perl/5.8.0'    <-- No leading '
>installsiteman1='/usr/share/man/man1'
>installsiteman3='/usr/share/man/man3'
>installsitescript='/usr/bin'
>installstyle='lib/perl5'  <-- ???
>installusrbinperl='define'
>installvendorarch='/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi'
>installvendorbin='/usr/bin'
>installvendorhtml1=''
>installvendorhtml3=''
>installvendorlib='/usr/lib/perl5/vendor_perl/5.8.'
>INSTALLVENDORLIB = ib/perl5'  <-- ???
>installusrbinperl='def        <-- No trailing '
>INSTALLARCHLIB = /usr/lib/perl5/5.8.0/i386-linux-thread-multi
>INSTALLSITEARCH = /usr/lib/pe  <-- going down hill
>INSTALLVENDORARCH = /usr/
>INSTALLBIN = /usr/bin'
>installhtml1dir=''
>installhtml3dir=''
>installman1
>INSTALLSITEBIN = /usr
>INSTALLVENDORBIN = /usr/bin'
>
>
>   I'm  just doing a vanilla install and had no problem with the earlier
>   version of SA. I could try to just fix the make file but if 3.0 can't
>   even do the make, I'm not very comfortable running it. Has anyone else
>   had this problem?
>
>   Thanks,  Tom Combs
>
>
>--
>Tom Combs                                      E-mail: combs@magnet.fsu.edu
>National High Magnetic Field Laboratory        Phone:  (850) 644-1657
>1800 E. Paul Dirac Drive                       Tallahassee, FL 32310
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From G.Pentland at SOTON.AC.UK  Mon Oct  4 17:58:43 2004
From: G.Pentland at SOTON.AC.UK (Pentland G.)
Date: Thu Jan 12 21:27:07 2006
Subject: SA 3.0 generates garbled Makefile
Message-ID: <mailman.3041.1137101227.24926.mailscanner@lists.mailscanner.info>

You can just set LANG...

> LANG=en_GB ; export LANG

Then,  perl Makefile.pl etc. will work fine.

Gary

Julian Field wrote:
> I suggest you use my combined Clam+SA package available from the
> MailScanner downloads page. This will install all the pre-requisites
> of both packages as well. Just because it installs Clam as well
> doesn't mean you have to use Clam :-)   
> 
> Make sure you remove the utf8 stuff from /etc/sysconfig/i18n before
> you start, too. 
> 
> At 17:18 04/10/2004, you wrote:
>> Folks,
>> 
>>   I'm attempting to upgrade from SA 2.64 to SA 3.0 on a box running
>>   RHEL 3.0. When trying to run via either CPAN or from the tarfile
>>   using "perl Makefile.PL", I get a botched make file and can't do
>>   the install. It also warns about not being able to find pod2man
>>   even though this is in /usr/bin/pod2man.
>> 
>>   Here is an extract of the Makefile where is starts going haywire:
>> 
>> 
>> INSTALLSITELIB = /usr/lib/perl5/site_perl/5.8.0'    <-- No leading '
>> installsiteman1='/usr/share/man/man1'
>> installsiteman3='/usr/share/man/man3'
>> installsitescript='/usr/bin'
>> installstyle='lib/perl5'  <-- ???
>> installusrbinperl='define'
>>
installvendorarch='/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-m
>> ulti' installvendorbin='/usr/bin'
>> installvendorhtml1=''
>> installvendorhtml3=''
>> installvendorlib='/usr/lib/perl5/vendor_perl/5.8.'
>> INSTALLVENDORLIB = ib/perl5'  <-- ???
>> installusrbinperl='def        <-- No trailing '
>> INSTALLARCHLIB = /usr/lib/perl5/5.8.0/i386-linux-thread-multi
>> INSTALLSITEARCH = /usr/lib/pe  <-- going down hill
>> INSTALLVENDORARCH = /usr/
>> INSTALLBIN = /usr/bin'
>> installhtml1dir=''
>> installhtml3dir=''
>> installman1
>> INSTALLSITEBIN = /usr
>> INSTALLVENDORBIN = /usr/bin'
>> 
>> 
>>   I'm  just doing a vanilla install and had no problem with the
>>   earlier version of SA. I could try to just fix the make file but
>>   if 3.0 can't even do the make, I'm not very comfortable running
>> it. Has anyone else   had this problem? 
>> 
>>   Thanks,  Tom Combs
>> 
>> 
>> --
>> Tom Combs                                      E-mail:
>> combs@magnet.fsu.edu National High Magnetic Field Laboratory       
>> Phone:  (850) 644-1657 1800 E. Paul Dirac Drive                     
>> Tallahassee, FL 32310 
>> 
>> ------------------------ MailScanner list ------------------------ To
>> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
>> mailscanner' in the body of the email. Before posting, read the MAQ
>> (http://www.mailscanner.biz/maq/) and the archives
>> (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Mon Oct  4 18:46:46 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:07 2006
Subject: FW: Update to corrupted PDF issue
Message-ID: <mailman.3042.1137101227.24926.mailscanner@lists.mailscanner.info>

Not sure what happened to this email as I sent it and it never showed up on
the list. So I have forwarded it again.

Thanks Dave

> -----Original Message-----
> From: Dave Filchak [mailto:dfilchak@sympatico.ca]
> Sent: Monday, October 04, 2004 12:19 PM
> To: 'MAILSCANNER@JISCMAIL.AC.UK'
> Subject: Update to corrupted PDF issue
>
> Just to update my email from a couple of hours ago. I can
> receive emails from other people to me that have PDF
> attachments and the PDF is fine. However, if I send the PDF
> to a client and CC myself or send it directly to myself, the
> PDF is unreadable.
>
> I really do not know where to start here except perhaps
> updating to the very latest.
>
> Dave
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 19:10:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:07 2006
Subject: Update to corrupted PDF issue
Message-ID: <mailman.3043.1137101227.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:18 04/10/2004, you wrote:
>Just to update my email from a couple of hours ago. I can receive emails
>from other people to me that have PDF attachments and the PDF is fine.
>However, if I send the PDF to a client and CC myself or send it directly to
>myself, the PDF is unreadable.

What is different in the mail route between you receive email from other
people, versus CCing yourself?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dfilchak at sympatico.ca  Mon Oct  4 19:21:14 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:08 2006
Subject: Update to corrupted PDF issue
Message-ID: <mailman.3044.1137101227.24926.mailscanner@lists.mailscanner.info>

Ummmm ... Idiot move on my part. I had received an email from another list
that had a LINK to a PDF not an attachment. I had thought that I had opened
it up as an attachment earlier in the day and when you asked this question
and went back to look at the headers I realized my mistake.

Sorry ;-(

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, October 04, 2004 2:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] Update to corrupted PDF issue

At 17:18 04/10/2004, you wrote:
>Just to update my email from a couple of hours ago. I can receive
>emails from other people to me that have PDF attachments and the PDF is
fine.
>However, if I send the PDF to a client and CC myself or send it
>directly to myself, the PDF is unreadable.

What is different in the mail route between you receive email from other
people, versus CCing yourself?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ELKNET.NET  Mon Oct  4 19:51:39 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:08 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3045.1137101228.24926.mailscanner@lists.mailscanner.info>

On Mon, 4 Oct 2004 08:45:10 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>Upgrade to the latest Net::DNS.

MailScanner -V is already reporting:
0.48    Net::DNS

which I thought WAS the latest...

Spamassassin -D is also reporting:
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48

CPAN reports:
Net::DNS is up to date.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct  4 19:57:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3046.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In which case I don't know, sorry.

At 19:51 04/10/2004, you wrote:
>On Mon, 4 Oct 2004 08:45:10 +0100, Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
> >Upgrade to the latest Net::DNS.
>
>MailScanner -V is already reporting:
>0.48    Net::DNS
>
>which I thought WAS the latest...
>
>Spamassassin -D is also reporting:
>debug: is Net::DNS::Resolver available? yes
>debug: Net::DNS version: 0.48
>
>CPAN reports:
>Net::DNS is up to date.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From devonharding at gmail.com  Mon Oct  4 22:21:15 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start DCC as deamon
Message-ID: <mailman.3047.1137101228.24926.mailscanner@lists.mailscanner.info>

Got it... I did have DCCD_ENABLE set to on.  Turn'd it off and it worked.

Thanks!


On Mon, 4 Oct 2004 12:06:35 -0400, Ugo Bellavance <ugob@camo-route.com> wrote:
> Devon Harding wrote:
>
> > I set 'DCCIFD_ENABLE=on' inf /var/dcc/dcc_conf as per MailScanner's instruction.
>
> It looks like it is trying to start DCCD, which is not what you want.
> Do you have DCCD_ENABLE to on?
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From robin at PRIMUS.CA  Mon Oct  4 22:44:34 2004
From: robin at PRIMUS.CA (Robin M.)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3048.1137101228.24926.mailscanner@lists.mailscanner.info>

What are peoeple doing to stop citibank phishing.

I am seeing alot of citibank phishing mail getting through, and it turns
up in peoples mailboxes who are not listed as recipients.

What are people doing to stop this.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct  4 22:48:12 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3049.1137101228.24926.mailscanner@lists.mailscanner.info>

On Mon, 2004-10-04 at 17:44 -0400, Robin M. wrote:
> What are peoeple doing to stop citibank phishing.
>
> I am seeing alot of citibank phishing mail getting through, and it turns
> up in peoples mailboxes who are not listed as recipients.
>
> What are people doing to stop this.

Have you looked at any of the SA custom rules?

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From robin at PRIMUS.CA  Mon Oct  4 23:24:57 2004
From: robin at PRIMUS.CA (Robin M.)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3050.1137101228.24926.mailscanner@lists.mailscanner.info>

On Mon, 4 Oct 2004, Michele Neylon : Blacknight Solutions wrote:
> On Mon, 2004-10-04 at 17:44 -0400, Robin M. wrote:
> > What are peoeple doing to stop citibank phishing.
> >
> > I am seeing alot of citibank phishing mail getting through, and it turns
> > up in peoples mailboxes who are not listed as recipients.
> >
> > What are people doing to stop this.
>
> Have you looked at any of the SA custom rules?

yeah I am using the rulesdujour suite with most of the rule-sets.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hden at KCBBS.GEN.NZ  Mon Oct  4 23:26:28 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:08 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3051.1137101228.24926.mailscanner@lists.mailscanner.info>

Thanks for the responses. Didn't mean to verge on restarting
that traditional war 'which is best', was just after some
advice based on experience on where to now...

And thats just what we got. Thanks!

(We're heading of down the path of some of the RedHat variants,
Whitebox or Centos.)

Thanks
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscan at PRIS.CA  Mon Oct  4 23:32:05 2004
From: mailscan at PRIS.CA (MailScanner Mailbox)
Date: Thu Jan 12 21:27:08 2006
Subject: tiff causing DOS message
Message-ID: <mailman.3052.1137101228.24926.mailscanner@lists.mailscanner.info>

Hello

We have a customer that is attempting to send a tif file that is a little
over 3.5 mb, when trying to send he receives the following error:

The following e-mails were found to have: Virus Detected

    Sender: xxxxxx@pris.bc.ca
IP Address: 64.114.126.175
 Recipient: xxxxxx@peacecountry.com
   Subject: '...are' sticker
 MessageID: i94Kea0D007039
    Report: Denial of Service attack in message!
            Denial of Service attack in message!


The interesting part of the df file is:

--============_-1115191450==_============
Content-Type: text/plain; charset="us-ascii" ; format="flowed"

hello doris & frances,

please find the attached layout of the sticker that you requested.


thanks!

jesh 250-782-6068
--============_-1115191450==_============
Content-Id: <a05200f00bd87873eaf3f@[192.168.0.102].0.0>
Content-Type: image/tiff; name="are.tif"
 ; x-mac-type="54494646"
 ; x-mac-creator="3842494D"
Content-Disposition: attachment; filename="are.tif"
Content-Transfer-Encoding: base64


I have looked as best I can but cannot find a reason for this, we are
running MS-4.33.3 with ClamAV-0.80rc2

any pointers would be appreciated.

Rick

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Mon Oct  4 23:54:42 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3053.1137101228.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Robin M.
> Sent: Monday, October 04, 2004 6:25 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: how can I stop citibank phishing
>
> On Mon, 4 Oct 2004, Michele Neylon : Blacknight Solutions wrote:
> > On Mon, 2004-10-04 at 17:44 -0400, Robin M. wrote:
> > > What are peoeple doing to stop citibank phishing.
> > >
> > > I am seeing alot of citibank phishing mail getting through, and it
> turns
> > > up in peoples mailboxes who are not listed as recipients.
> > >
> > > What are people doing to stop this.
> >
> > Have you looked at any of the SA custom rules?
>
> yeah I am using the rulesdujour suite with most of the rule-sets.
>

<Start Rant>

At the risk of sounding defeatist, it's difficult to protect your users
against all of the possible scams on the internet. A lot of the pfishing
scams depend on speed. I know of a site that was just recently compromised
to act as an unwitting conduit for the usernames and passwords in a recent
phishing scam. It wasn't long until the scheme was discovered and stopped
but thousands of login/passwords were compromised in a very short period of
time.

How did the compromise occur? Can you Spell STr0ngP1ssw0rdS :(

While Julian, The SpamAssassin team, the SURBL crew and many others in the
open Source community are providing us with some very good defenses, you can
be sure that some of these phishing scams will slip through.

As a result we are taking some additional steps and recommending to our
customers that they do the same.

1. We sending out a monthly reminder to never, ever respond to an email that
request you click on a link to verify ANYTHING that is requested in an
email. They should forward such emails to the help desk where we will deal
with them.

2. We will vary the message monthly and make it as readable as possible so
it does get read.

You need to be repetitive with this message because every month there are
newbies in our user core who are not sophisticated enough to know of these
dangers. These are the people who fill in the usernames / passwords.

Will this solve the problem? No. There needs to be:

1. Better publicity in all ot the media regarding this type of fraud.
2. Better international enforcement to stop and prosecute Internet fraud
3. Quicker ways of early detection and cutting off access to the fraud
conduit sites.

The financial institutions need to participate with the law enforcement and
Internet community in addressing items 1-3 above. Unfortunately the trend
has been for financial institutions to publicly ignore fraud and cover up
break ins and theft.

And until they do, you and I will face higher fees to cover their losses due
to scams and fraud.

<End Rant>

This obviously a sore subject with me but not really a topic for the MS list
so feel free to send flames or comments to steve@fsl.com.

Thanks for listening,

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Tue Oct  5 00:07:31 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:08 2006
Subject: OT - Which Linux Now?
Message-ID: <mailman.3054.1137101228.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Hendrik den Hartog
> Sent: Monday, October 04, 2004 6:26 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: OT - Which Linux Now?
>
> Thanks for the responses. Didn't mean to verge on restarting
> that traditional war 'which is best', was just after some
> advice based on experience on where to now...

Don't worry someone starts it every month or two on the list.

>
> And thats just what we got. Thanks!
>
> (We're heading of down the path of some of the RedHat variants,
> Whitebox or Centos.)
>
> Thanks
> Hendrik

As A WhiteBox and TaoLinux user who has just downloaded the CentOS ISOs. It
looks like the most up2date current RH clone release is CentOS.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vboulytchev at COINFOTECH.COM  Tue Oct  5 00:11:15 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3055.1137101228.24926.mailscanner@lists.mailscanner.info>


Ladies and Gents,
        rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
serveral errors.  Some of which had inherent bzip2 syntax problems.  What
is the issue?  After editing the following /usr/lib/rpm/brp-compress, and
taking off the "-n" directive, then everything went through. Now its
doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.

What is going on???

Processing files: perl-Compress-Zlib-1.33-2
error: File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs


RPM build errors:
    File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From leduc at CTS.COM  Tue Oct  5 01:04:53 2004
From: leduc at CTS.COM (Gene LeDuc)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3056.1137101228.24926.mailscanner@lists.mailscanner.info>

Not sure whether it's catching the citibank scam specifically, but the latest
clamav (0.8 rc3?) catches phishing scams and treats them as viruses.  It was
a pleasant surprise when I first saw this happen.

On Monday 04 October 2004 02:44 pm, Robin M. wrote:
> What are peoeple doing to stop citibank phishing.
>
> I am seeing alot of citibank phishing mail getting through, and it turns
> up in peoples mailboxes who are not listed as recipients.
>
> What are people doing to stop this.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jkf at mailscanner.info  Tue Oct  5 01:56:03 2004
From: jkf at mailscanner.info (jkf@mailscanner.info)
Date: Thu Jan 12 21:27:08 2006
Subject: Automated reply from jkf@www.mailscanner.biz
Message-ID: <mailman.3057.1137101228.24926.mailscanner@lists.mailscanner.info>

Thank you for your email.
I will reply to you as soon as possible. 

From robin at PRIMUS.CA  Tue Oct  5 02:43:02 2004
From: robin at PRIMUS.CA (Robin M.)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3058.1137101228.24926.mailscanner@lists.mailscanner.info>

On Mon, 4 Oct 2004, Gene LeDuc wrote:

> Not sure whether it's catching the citibank scam specifically, but the latest
> clamav (0.8 rc3?) catches phishing scams and treats them as viruses.  It was
> a pleasant surprise when I first saw this happen.
>
oh that is good news. It looks like they are almost ready for stable
release.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james_gray at OCS.COM  Tue Oct  5 03:12:21 2004
From: james_gray at OCS.COM (James Gray)
Date: Thu Jan 12 21:27:08 2006
Subject: how can I stop citibank phishing
Message-ID: <mailman.3059.1137101228.24926.mailscanner@lists.mailscanner.info>

On Tue, 5 Oct 2004 07:44 am, Robin M. wrote:
> What are peoeple doing to stop citibank phishing.
>
> I am seeing alot of citibank phishing mail getting through, and it turns
> up in peoples mailboxes who are not listed as recipients.
>
> What are people doing to stop this.

NAI VirusScan identifies various phishing scams and treats them as viruses.
Not sure if that helps - I notice ClamAV does the same.  YMMV.

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 03:42:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3060.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 00:11 05/10/2004, you wrote:

>Ladies and Gents,
>         rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
> serveral errors.  Some of which had inherent bzip2 syntax problems.  What
> is the issue?  After editing the following /usr/lib/rpm/brp-compress, and
> taking off the "-n" directive, then everything went through. Now its
> doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.
>
>What is going on???
>
>Processing files: perl-Compress-Zlib-1.33-2
>error: File not found:
>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
>
>RPM build errors:
>     File not found:
> /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs

Something failed in the "make" stage of building perl-Compress-Zlib.
Suggest you take a good look at the output from that rebuild.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 08:27:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: tiff causing DOS message
Message-ID: <mailman.3061.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What happens when you try to scan the tif manually?

At 23:32 04/10/2004, you wrote:
>Hello
>
>We have a customer that is attempting to send a tif file that is a little
>over 3.5 mb, when trying to send he receives the following error:
>
>The following e-mails were found to have: Virus Detected
>
>     Sender: xxxxxx@pris.bc.ca
>IP Address: 64.114.126.175
>  Recipient: xxxxxx@peacecountry.com
>    Subject: '...are' sticker
>  MessageID: i94Kea0D007039
>     Report: Denial of Service attack in message!
>             Denial of Service attack in message!
>
>
>The interesting part of the df file is:
>
>--============_-1115191450==_============
>Content-Type: text/plain; charset="us-ascii" ; format="flowed"
>
>hello doris & frances,
>
>please find the attached layout of the sticker that you requested.
>
>
>thanks!
>
>jesh 250-782-6068
>--============_-1115191450==_============
>Content-Id: <a05200f00bd87873eaf3f@[192.168.0.102].0.0>
>Content-Type: image/tiff; name="are.tif"
>  ; x-mac-type="54494646"
>  ; x-mac-creator="3842494D"
>Content-Disposition: attachment; filename="are.tif"
>Content-Transfer-Encoding: base64
>
>
>I have looked as best I can but cannot find a reason for this, we are
>running MS-4.33.3 with ClamAV-0.80rc2

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From bg.mahesh at INDIAINFO.COM  Tue Oct  5 08:32:10 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:08 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3062.1137101228.24926.mailscanner@lists.mailscanner.info>

How to solve this problem :-( ?

----- Original Message -----
From: BG Mahesh <bg.mahesh@INDIAINFO.COM>
Date:         Fri, 1 Oct 2004 16:09:52 +0530
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint

> hi
>
> I am not able to install MS 4.34.8-1. The error message I get is,
>
> Installing tnef decoder
> Preparing...                ########################################### [100%]
>         package tnef-1.2.3.1-1 is already installed
>
> Now to install MailScanner itself.
>
> error: Failed dependencies:
>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed) perl-MIME-tools-5.413-1
>
> My setup
>
> Redhat Linux
> Perl 5.8.3
> MIME::QuotedPrint   : 3.03
> MIME::Tools         : 5.413
> MIME::Base64        : 3.03
>
> What am I doing wrong?
>
> --
> B.G. Mahesh
> bg.mahesh@indiainfo.com
> http://www.indiainfo.com/
>
> --
> ______________________________________________
> IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
> Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!
>
> Powered by Outblaze
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 08:48:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3063.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Try
        ./install.sh --nodeps

At 08:32 05/10/2004, you wrote:
>How to solve this problem :-( ?
>
>----- Original Message -----
>From: BG Mahesh <bg.mahesh@INDIAINFO.COM>
>Date:         Fri, 1 Oct 2004 16:09:52 +0530
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
>
> > hi
> >
> > I am not able to install MS 4.34.8-1. The error message I get is,
> >
> > Installing tnef decoder
> > Preparing...                ###########################################
> [100%]
> >         package tnef-1.2.3.1-1 is already installed
> >
> > Now to install MailScanner itself.
> >
> > error: Failed dependencies:
> >         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> perl-MIME-tools-5.413-1
> >
> > My setup
> >
> > Redhat Linux
> > Perl 5.8.3
> > MIME::QuotedPrint   : 3.03
> > MIME::Tools         : 5.413
> > MIME::Base64        : 3.03
> >
> > What am I doing wrong?
> >
> > --
> > B.G. Mahesh
> > bg.mahesh@indiainfo.com
> > http://www.indiainfo.com/
> >
> > --
> > ______________________________________________
> > IndiaInfo Mail - the free e-mail service with a difference!
> www.indiainfo.com
> > Check out our value-added Premium features, such as an extra 20MB for
> mail storage, POP3, e-mail forwarding, and ads-free mailboxes!
> >
> > Powered by Outblaze
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>
>--
>B.G. Mahesh
>bg.mahesh@indiainfo.com
>http://www.indiainfo.com/
>
>--
>______________________________________________
>IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
>Check out our value-added Premium features, such as an extra 20MB for mail
>storage, POP3, e-mail forwarding, and ads-free mailboxes!
>
>Powered by Outblaze
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From admin at thenamegame.com  Tue Oct  5 08:55:24 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3064.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:Arial;
        color:windowtext;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>All of a sudden we are seeing huge loads from MailScanner.
Reason is because it cannot start. Don&#8217;t know why but this is what we are
seeing, pages and pages of these.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:24:28 srv08 MailScanner[22370]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:24:38 srv08 MailScanner[22372]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:24:48 srv08 MailScanner[22374]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:24:58 srv08 MailScanner[22376]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:25:08 srv08 MailScanner[22466]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:25:18 srv08 MailScanner[22468]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 5 03:25:28 srv08 MailScanner[22470]: MailScanner
E-Mail Virus Scanner version 4.34.8 starting...<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>We upgraded to 4.34.8 in the hope that this will fix the
issue but it hasn&#8217;t. Same problem. Mailscanner is trying to restart but
it can&#8217;t.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I reinstall Spamassassin 3.0 which has been more of a pain
than a solution. Still cannot get SA3.0 and MailScanner to work.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I&#8217;m seeing errors in Spamassassin, something about
parser. That&#8217;s why I tried to re install it using FORCE. That has not
fixed the problem. I don&#8217;t get what the issue is all of a sudden. This
may be a perl 5.8.1 issues but its hard to tell.<o:p></o:p></span></font></p>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 09:04:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3065.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In MailScanner.conf, set
Debug = yes
Then kill all your MailScanner processes. Then run check_mailscanner with
at least 1 message in the incoming queue. That will tell you why it's not
starting.

At 08:55 05/10/2004, you wrote:
>All of a sudden we are seeing huge loads from MailScanner. Reason is
>because it cannot start. Don't know why but this is what we are seeing,
>pages and pages of these.
>
>Oct  5 03:24:28 srv08 MailScanner[22370]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:24:38 srv08 MailScanner[22372]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:24:48 srv08 MailScanner[22374]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:24:58 srv08 MailScanner[22376]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:25:08 srv08 MailScanner[22466]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:25:18 srv08 MailScanner[22468]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:25:28 srv08 MailScanner[22470]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>
>We upgraded to 4.34.8 in the hope that this will fix the issue but it
>hasn't. Same problem. Mailscanner is trying to restart but it can't.
>
>I reinstall Spamassassin 3.0 which has been more of a pain than a
>solution. Still cannot get SA3.0 and MailScanner to work.
>
>I'm seeing errors in Spamassassin, something about parser. That's why I
>tried to re install it using FORCE. That has not fixed the problem. I
>don't get what the issue is all of a sudden. This may be a perl 5.8.1
>issues but its hard to tell.
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email <jiscmail@jiscmail.ac.htm>jiscmail@jiscmail.ac.uk with
>the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ
>(<http://www.mailscanner.biz/maq/>http://www.mailscanner.biz/maq/)
>and the archives
>(<http://www.jiscmail.ac.uk/lists/mailscanner.html>http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From admin at thenamegame.com  Tue Oct  5 09:21:11 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3066.1137101228.24926.mailscanner@lists.mailscanner.info>

root@srv08 [/etc/cron.hourly]# ./check*
MailScanner manually shut down (no /var/lock/subsys/MailScanner.off file).
Not restarting.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Tuesday, October 05, 2004 4:04 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Cannot start mailScanner all of a sudden

In MailScanner.conf, set
Debug = yes
Then kill all your MailScanner processes. Then run check_mailscanner with
at least 1 message in the incoming queue. That will tell you why it's not
starting.

At 08:55 05/10/2004, you wrote:
>All of a sudden we are seeing huge loads from MailScanner. Reason is
>because it cannot start. Don't know why but this is what we are seeing,
>pages and pages of these.
>
>Oct  5 03:24:28 srv08 MailScanner[22370]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:24:38 srv08 MailScanner[22372]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:24:48 srv08 MailScanner[22374]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:24:58 srv08 MailScanner[22376]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:25:08 srv08 MailScanner[22466]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:25:18 srv08 MailScanner[22468]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  5 03:25:28 srv08 MailScanner[22470]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>
>We upgraded to 4.34.8 in the hope that this will fix the issue but it
>hasn't. Same problem. Mailscanner is trying to restart but it can't.
>
>I reinstall Spamassassin 3.0 which has been more of a pain than a
>solution. Still cannot get SA3.0 and MailScanner to work.
>
>I'm seeing errors in Spamassassin, something about parser. That's why I
>tried to re install it using FORCE. That has not fixed the problem. I
>don't get what the issue is all of a sudden. This may be a perl 5.8.1
>issues but its hard to tell.
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email <jiscmail@jiscmail.ac.htm>jiscmail@jiscmail.ac.uk with
>the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ
>(<http://www.mailscanner.biz/maq/>http://www.mailscanner.biz/maq/)
>and the archives
>(<http://www.jiscmail.ac.uk/lists/mailscanner.html>http://www.jiscmail.ac.u
k/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 09:25:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3067.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I didn't mean you to run the cron job. That is designed to do exactly what
it did.
I meant you to run the command which is on root's $PATH in /usr/sbin.

At 09:21 05/10/2004, you wrote:
>root@srv08 [/etc/cron.hourly]# ./check*
>MailScanner manually shut down (no /var/lock/subsys/MailScanner.off file).
>Not restarting.
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Tuesday, October 05, 2004 4:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Cannot start mailScanner all of a sudden
>
>In MailScanner.conf, set
>Debug = yes
>Then kill all your MailScanner processes. Then run check_mailscanner with
>at least 1 message in the incoming queue. That will tell you why it's not
>starting.
>
>At 08:55 05/10/2004, you wrote:
> >All of a sudden we are seeing huge loads from MailScanner. Reason is
> >because it cannot start. Don't know why but this is what we are seeing,
> >pages and pages of these.
> >
> >Oct  5 03:24:28 srv08 MailScanner[22370]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >Oct  5 03:24:38 srv08 MailScanner[22372]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >Oct  5 03:24:48 srv08 MailScanner[22374]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >Oct  5 03:24:58 srv08 MailScanner[22376]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >Oct  5 03:25:08 srv08 MailScanner[22466]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >Oct  5 03:25:18 srv08 MailScanner[22468]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >Oct  5 03:25:28 srv08 MailScanner[22470]: MailScanner E-Mail Virus Scanner
> >version 4.34.8 starting...
> >
> >We upgraded to 4.34.8 in the hope that this will fix the issue but it
> >hasn't. Same problem. Mailscanner is trying to restart but it can't.
> >
> >I reinstall Spamassassin 3.0 which has been more of a pain than a
> >solution. Still cannot get SA3.0 and MailScanner to work.
> >
> >I'm seeing errors in Spamassassin, something about parser. That's why I
> >tried to re install it using FORCE. That has not fixed the problem. I
> >don't get what the issue is all of a sudden. This may be a perl 5.8.1
> >issues but its hard to tell.
> >------------------------ MailScanner list ------------------------ To
> >unsubscribe, email <jiscmail@jiscmail.ac.htm>jiscmail@jiscmail.ac.uk with
> >the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ
> >(<http://www.mailscanner.biz/maq/>http://www.mailscanner.biz/maq/)
> >and the archives
> >(<http://www.jiscmail.ac.uk/lists/mailscanner.html>http://www.jiscmail.ac.u
>k/lists/mailscanner.html).
> >
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From admin at thenamegame.com  Tue Oct  5 09:45:36 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3068.1137101228.24926.mailscanner@lists.mailscanner.info>

root@srv08 [/usr/sbin]# ./MailScanner
In Debugging mode, not forking...
SA bayes lock is /root/.spamassassin/bayes.lock
Bayes lock is at /root/.spamassassin/bayes.lock
unknown type  for __REPORT_DSN: 18 at
/usr/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin.pm line 1671.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Tuesday, October 05, 2004 4:26 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Cannot start mailScanner all of a sudden

I didn't mean you to run the cron job. That is designed to do exactly what
it did.
I meant you to run the command which is on root's $PATH in /usr/sbin.

At 09:21 05/10/2004, you wrote:
>root@srv08 [/etc/cron.hourly]# ./check*
>MailScanner manually shut down (no /var/lock/subsys/MailScanner.off file).
>Not restarting.
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Tuesday, October 05, 2004 4:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Cannot start mailScanner all of a sudden
>
>In MailScanner.conf, set
>Debug = yes
>Then kill all your MailScanner processes. Then run check_mailscanner with
>at least 1 message in the incoming queue. That will tell you why it's not
>starting.
>
>At 08:55 05/10/2004, you wrote:
> >All of a sudden we are seeing huge loads from MailScanner. Reason is
> >because it cannot start. Don't know why but this is what we are seeing,
> >pages and pages of these.
> >
> >Oct  5 03:24:28 srv08 MailScanner[22370]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >Oct  5 03:24:38 srv08 MailScanner[22372]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >Oct  5 03:24:48 srv08 MailScanner[22374]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >Oct  5 03:24:58 srv08 MailScanner[22376]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >Oct  5 03:25:08 srv08 MailScanner[22466]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >Oct  5 03:25:18 srv08 MailScanner[22468]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >Oct  5 03:25:28 srv08 MailScanner[22470]: MailScanner E-Mail Virus
Scanner
> >version 4.34.8 starting...
> >
> >We upgraded to 4.34.8 in the hope that this will fix the issue but it
> >hasn't. Same problem. Mailscanner is trying to restart but it can't.
> >
> >I reinstall Spamassassin 3.0 which has been more of a pain than a
> >solution. Still cannot get SA3.0 and MailScanner to work.
> >
> >I'm seeing errors in Spamassassin, something about parser. That's why I
> >tried to re install it using FORCE. That has not fixed the problem. I
> >don't get what the issue is all of a sudden. This may be a perl 5.8.1
> >issues but its hard to tell.
> >------------------------ MailScanner list ------------------------ To
> >unsubscribe, email <jiscmail@jiscmail.ac.htm>jiscmail@jiscmail.ac.uk with
> >the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ
> >(<http://www.mailscanner.biz/maq/>http://www.mailscanner.biz/maq/)
> >and the archives
>
>(<http://www.jiscmail.ac.uk/lists/mailscanner.html>http://www.jiscmail.ac.u
>k/lists/mailscanner.html).
> >
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 09:48:51 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3069.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Sounds like your SpamAssassin installation is screwed up, as you suspected.
Remove all trace of it and then reinstall it.

At 09:45 05/10/2004, you wrote:
>root@srv08 [/usr/sbin]# ./MailScanner
>In Debugging mode, not forking...
>SA bayes lock is /root/.spamassassin/bayes.lock
>Bayes lock is at /root/.spamassassin/bayes.lock
>unknown type  for __REPORT_DSN: 18 at
>/usr/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin.pm line 1671.
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Tuesday, October 05, 2004 4:26 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Cannot start mailScanner all of a sudden
>
>I didn't mean you to run the cron job. That is designed to do exactly what
>it did.
>I meant you to run the command which is on root's $PATH in /usr/sbin.
>
>At 09:21 05/10/2004, you wrote:
> >root@srv08 [/etc/cron.hourly]# ./check*
> >MailScanner manually shut down (no /var/lock/subsys/MailScanner.off file).
> >Not restarting.
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Tuesday, October 05, 2004 4:04 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Cannot start mailScanner all of a sudden
> >
> >In MailScanner.conf, set
> >Debug = yes
> >Then kill all your MailScanner processes. Then run check_mailscanner with
> >at least 1 message in the incoming queue. That will tell you why it's not
> >starting.
> >
> >At 08:55 05/10/2004, you wrote:
> > >All of a sudden we are seeing huge loads from MailScanner. Reason is
> > >because it cannot start. Don't know why but this is what we are seeing,
> > >pages and pages of these.
> > >
> > >Oct  5 03:24:28 srv08 MailScanner[22370]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >Oct  5 03:24:38 srv08 MailScanner[22372]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >Oct  5 03:24:48 srv08 MailScanner[22374]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >Oct  5 03:24:58 srv08 MailScanner[22376]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >Oct  5 03:25:08 srv08 MailScanner[22466]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >Oct  5 03:25:18 srv08 MailScanner[22468]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >Oct  5 03:25:28 srv08 MailScanner[22470]: MailScanner E-Mail Virus
>Scanner
> > >version 4.34.8 starting...
> > >
> > >We upgraded to 4.34.8 in the hope that this will fix the issue but it
> > >hasn't. Same problem. Mailscanner is trying to restart but it can't.
> > >
> > >I reinstall Spamassassin 3.0 which has been more of a pain than a
> > >solution. Still cannot get SA3.0 and MailScanner to work.
> > >
> > >I'm seeing errors in Spamassassin, something about parser. That's why I
> > >tried to re install it using FORCE. That has not fixed the problem. I
> > >don't get what the issue is all of a sudden. This may be a perl 5.8.1
> > >issues but its hard to tell.
> > >------------------------ MailScanner list ------------------------ To
> > >unsubscribe, email <jiscmail@jiscmail.ac.htm>jiscmail@jiscmail.ac.uk with
> > >the words:
> > >'leave mailscanner' in the body of the email.
> > >Before posting, read the MAQ
> > >(<http://www.mailscanner.biz/maq/>http://www.mailscanner.biz/maq/)
> > >and the archives
> >
> >(<http://www.jiscmail.ac.uk/lists/mailscanner.html>http://www.jiscmail.ac.u
> >k/lists/mailscanner.html).
> > >
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >MailScanner thanks transtec Computers for their support
> >Buy the MailScanner book at www.MailScanner.info/store
> >
> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Tue Oct  5 11:05:16 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.3070.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Unfortunately even deleting Net::DNS and reinstalling did not get URI
started, also the 'solaris' fix did not work.

Is there any way I can do a forced re-install off all the perl modules in
install-Clam-SA.tar.gz ??



On Fri, 1 Oct 2004, Dean Jones wrote:

> Remco Barendse wrote:
>> Strange.... I can confirm the same problem.
>>
>> I don't know how to remove a perl module, after the suggestion on this
>> list I simply re-installed the tarball and restarted MailScanner but still
>> no URI hits from MS.
>>
>> Can I do a forced re-install of all the perl modules in the
>> install-SA-CLAMAV package?
>>
>
> hye,
>
> this is what i did to finally get Net::DNS to fully re-install.
> it is probably not the 'proper' way to do this, so please be careful.
> When i upgraded to SA 3 i used the CPAN shell to make sure Net::DNS was
> upgraded. apparantly this wasn't enough.
>
> Make sure spamassassin/mailscanner isn't running or doing checks while
> you do this.
> I dloaded the version of Net::DNS i needed from cpan.org.
> Then i found my perl install and lib/site_perl/5.8.4/Net
> After backing it up, i removed the DNS.pm and
> lib/site_perl/5.8.4/Net/DNS directory.
> Then i re-compiled and installed from the tar.gz i dloaded from cpan.org.
>
> Fired MailScanner back up and RBL and URIBL checks were both working.
>
> Hopefully that will do it for you.
>
>
>
>>
>> On Fri, 1 Oct 2004, Julian Field wrote:
>>
>>> I haven't changed the SA3 code, it all works on my production and
>>> development systems, as do Steve's systems.
>>>
>>> At 21:47 30/09/2004, you wrote:
>>>
>>>> This issue has been reported by myself and Ugo earlier this week
>>>> on the list.  I'm at a loss too.  When the next version of MS
>>>> comes out, I will upgrade and see if the problem remains.
>>>>
>>>> Jeff Earickson
>>>> Colby College
>>>>
>>>> On Thu, 30 Sep 2004, Dean Jones wrote:
>>>>
>>>>> Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>>> From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>>>> Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>>
>>>>> Steve Swaney wrote:
>>>>>
>>>>>>>> SNIPPED <<<
>>>>>>>
>>>>>>>
>>>>>>> Doing the command that you suggested manages to make the SURBL checks
>>>>>>> work.
>>>>>>>
>>>>>>> It almost as if there is a spamassassin option in MailScanner.conf
>>>>>>> that
>>>>>>> turns it off.
>>>>>>
>>>>>>
>>>>>>
>>>>>> There is a command in MailScanner that turns SpamAssassin off;
>>>>>>
>>>>>> Use SpamAssassin = yes
>>>>>>
>>>>>> But if you have SpamAssassin turned on in MS and the test above works,
>>>>>> MailScanner should run the exactly as the test does. How are you sure
>>>>>> thst
>>>>>> MS is not running the tests?
>>>>>
>>>>>
>>>>> Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>>
>>>>> The only way i have to guess is just by the data SA drops into the
>>>>> logs.
>>>>> It never hits on any URIBL_* scores running natively.
>>>>>
>>>>> I can forward SURBL test emails through from outside addresses and they
>>>>> don't get hit by the SURBL checks.
>>>>>
>>>>> I'm at a loss :)
>>>>> otherwise SA 3 is working great.
>>>
>>>
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> MailScanner thanks transtec Computers for their support
>>> Buy the MailScanner book at www.MailScanner.info/store
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 11:18:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.3071.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On line 249 on install.rpm-fns.sh, add "--force" to the rpm command options.

At 11:05 05/10/2004, you wrote:
>Unfortunately even deleting Net::DNS and reinstalling did not get URI
>started, also the 'solaris' fix did not work.
>
>Is there any way I can do a forced re-install off all the perl modules in
>install-Clam-SA.tar.gz ??
>
>
>
>On Fri, 1 Oct 2004, Dean Jones wrote:
>
>>Remco Barendse wrote:
>>>Strange.... I can confirm the same problem.
>>>
>>>I don't know how to remove a perl module, after the suggestion on this
>>>list I simply re-installed the tarball and restarted MailScanner but still
>>>no URI hits from MS.
>>>
>>>Can I do a forced re-install of all the perl modules in the
>>>install-SA-CLAMAV package?
>>
>>hye,
>>
>>this is what i did to finally get Net::DNS to fully re-install.
>>it is probably not the 'proper' way to do this, so please be careful.
>>When i upgraded to SA 3 i used the CPAN shell to make sure Net::DNS was
>>upgraded. apparantly this wasn't enough.
>>
>>Make sure spamassassin/mailscanner isn't running or doing checks while
>>you do this.
>>I dloaded the version of Net::DNS i needed from cpan.org.
>>Then i found my perl install and lib/site_perl/5.8.4/Net
>>After backing it up, i removed the DNS.pm and
>>lib/site_perl/5.8.4/Net/DNS directory.
>>Then i re-compiled and installed from the tar.gz i dloaded from cpan.org.
>>
>>Fired MailScanner back up and RBL and URIBL checks were both working.
>>
>>Hopefully that will do it for you.
>>
>>
>>
>>>
>>>On Fri, 1 Oct 2004, Julian Field wrote:
>>>
>>>>I haven't changed the SA3 code, it all works on my production and
>>>>development systems, as do Steve's systems.
>>>>
>>>>At 21:47 30/09/2004, you wrote:
>>>>
>>>>>This issue has been reported by myself and Ugo earlier this week
>>>>>on the list.  I'm at a loss too.  When the next version of MS
>>>>>comes out, I will upgrade and see if the problem remains.
>>>>>
>>>>>Jeff Earickson
>>>>>Colby College
>>>>>
>>>>>On Thu, 30 Sep 2004, Dean Jones wrote:
>>>>>
>>>>>>Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>>>>From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>>>>Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>>>>Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>>>
>>>>>>Steve Swaney wrote:
>>>>>>
>>>>>>>>>SNIPPED <<<
>>>>>>>>
>>>>>>>>
>>>>>>>>Doing the command that you suggested manages to make the SURBL checks
>>>>>>>>work.
>>>>>>>>
>>>>>>>>It almost as if there is a spamassassin option in MailScanner.conf
>>>>>>>>that
>>>>>>>>turns it off.
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>There is a command in MailScanner that turns SpamAssassin off;
>>>>>>>
>>>>>>>Use SpamAssassin = yes
>>>>>>>
>>>>>>>But if you have SpamAssassin turned on in MS and the test above works,
>>>>>>>MailScanner should run the exactly as the test does. How are you sure
>>>>>>>thst
>>>>>>>MS is not running the tests?
>>>>>>
>>>>>>
>>>>>>Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>>>
>>>>>>The only way i have to guess is just by the data SA drops into the
>>>>>>logs.
>>>>>>It never hits on any URIBL_* scores running natively.
>>>>>>
>>>>>>I can forward SURBL test emails through from outside addresses and they
>>>>>>don't get hit by the SURBL checks.
>>>>>>
>>>>>>I'm at a loss :)
>>>>>>otherwise SA 3 is working great.
>>>>
>>>>
>>>>--
>>>>Julian Field
>>>>www.MailScanner.info
>>>>MailScanner thanks transtec Computers for their support
>>>>Buy the MailScanner book at www.MailScanner.info/store
>>>>
>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alex at ERUS.CO.UK  Tue Oct  5 11:53:22 2004
From: alex at ERUS.CO.UK (Alex Pimperton)
Date: Thu Jan 12 21:27:08 2006
Subject: Mailscanner sends load sky-high on Debian
Message-ID: <mailman.3072.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:
> At 19:28 02/10/2004, you wrote:
>
>> Hi
>>
>> I've been having a few problems recently with mailscanner going awol and
>> sending the load average sky high on my Debian testing box.
>
>
> With Max Children = 1 you shouldn't be seeing all these children. Take a
> look in your syslog for any errors.
> Also set
>         Debug = yes
> and then try to start MailScanner. It should print out any errors if there
> are any.
> --

Setting Debug = yes and running check_mailscanner gives:

server01:/var/spool/MailScanner/incoming# check_mailscanner
Starting MailScanner...
In Debugging mode, not forking...
SA bayes lock is /var/lib/MailScanner/bayes.lock
Bayes lock is at /var/lib/MailScanner/bayes.lock
Stopping now as you are debugging me.
Could not get to parent of incoming work directory at
/usr/share/MailScanner/MailScanner/WorkArea.pm line 187.
Stopping now as you are debugging me.

The incoming work directory is set to /var/spool/MailScanner/incoming
and the permissions for that are:

drwxrwx---  2 Debian-exim Debian-exim 4096 Oct  5 11:20 incoming

Also, occasionaly in syslog i get:

Oct  3 21:52:08 server01 MailScanner[32643]: Could not open file
 >/var/spool/MailScanner/incoming/31838/1CEDKr-0000Yv-NT.header: No such
file or directory
Oct  3 21:52:08 server01 MailScanner[32643]: Cannot create + lock
headers file
/var/spool/MailScanner/incoming/31838/1CEDKr-0000Yv-NT.header,
Oct  3 21:52:10 server01 MailScanner[32576]: Could not open file
 >/var/spool/MailScanner/incoming/31838/1CEDKr-0000Yv-NT.header: No such
file or directory
Oct  3 21:52:10 server01 MailScanner[32576]: Cannot create + lock
headers file

....which all points to a permissions problem, but I can't fid anything
that looks out of place, as it works some of the time.

Regards

Alex

p.s.
server01:/var/spool/MailScanner# MailScanner -v
Running on
Linux server01.erus.co.uk 2.4.26-bytemark-uml-20040706-1 #1 Tue Jul 6
09:37:31 BST 2004 i686 GNU/Linux
This is Perl version 5.008004 (5.8.4)
This is MailScanner version 4.33.3
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.02    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.01    MIME::Base64
5.403   MIME::Decoder
5.403   MIME::Decoder::UU
5.403   MIME::Head
5.406   MIME::Parser
5.411   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime
Optional module versions are:
2.64    Mail::SpamAssassin
missing Net::LDAP
missing SAVI
missing Mail::ClamAV
0.48    Net::DNS

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From p.g.m.peters at utwente.nl  Tue Oct  5 12:20:59 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start mailScanner all of a sudden
Message-ID: <mailman.3073.1137101228.24926.mailscanner@lists.mailscanner.info>

On Tue, 5 Oct 2004 09:48:51 +0100, you wrote:

>Sounds like your SpamAssassin installation is screwed up, as you suspected.
>Remove all trace of it and then reinstall it.

I have seen SA problems on one system where the running Spamassassin was
installed through CPAN (Not mine, so I'm not sure) and SA3 was installed
through up2date (Red Hat). It didn't crash MS, but it stopped scanning
for spam. This was a 4.31.6 version of MS.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From usergroups at THEARGONCOMPANY.COM  Tue Oct  5 14:10:16 2004
From: usergroups at THEARGONCOMPANY.COM (Boskey)
Date: Thu Jan 12 21:27:08 2006
Subject: How to configure MailScanner with sendmail's expensive=true option?
Message-ID: <mailman.3074.1137101228.24926.mailscanner@lists.mailscanner.info>

Hi

I use a few mail servers with MailScanner & Sendmail (RH9) that hook up to the
net using a ppp dial up connection every 30 minutes.

I relay the messages to a Smart Host which accepts mail only if it is pop
authenticated... so I run a script which does
1. fetchmail to authenticate my dynamic IP address on the smart host
2. trigger sendmai -q to relay mail to the smart host.

Sendmail is configured with Expensive=True, but MailScanner ignores this
feature and tries to deliver the moment it gets a chance to send out mail.

I read this from the archives but was not sure if this is the solution to my
problem.

http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0209&L=mailscanner&P=R37713&I=-1

Can anyone help?

Regards

Boskey.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Tue Oct  5 14:16:44 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:08 2006
Subject: Cannot start DCC as deamon
Message-ID: <mailman.3075.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Devon Harding wrote:
> Got it... I did have DCCD_ENABLE set to on.  Turn'd it off and it worked.
>
> Thanks!


Cool.  Is it on by default now?

Btw, you should stop top-posting on mailing lists...

Ugo
>
>
> On Mon, 4 Oct 2004 12:06:35 -0400, Ugo Bellavance <ugob@camo-route.com> wrote:
>
>>Devon Harding wrote:
>>
>>
>>>I set 'DCCIFD_ENABLE=on' inf /var/dcc/dcc_conf as per MailScanner's instruction.
>>
>>It looks like it is trying to start DCCD, which is not what you want.
>>Do you have DCCD_ENABLE to on?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Oct  5 15:03:38 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3076.1137101228.24926.mailscanner@lists.mailscanner.info>

Julian

I have just upgraded two RedHat AS/ES 3 systems to 4-34.8-1 but the
attempt to ugrade a third AS 3 system failed in install.sh with:

   error: Failed dependencies:
          perl (Compress::Zlib) is needed by perl-Archive-Zip-1.13-1.

Using CPAN and "installing Compress::Zlib" I am told that it is up to
date!

However looking a bit more closely I find that on the two systems on
which 4.34.8-1 was successfully installed there is present the files 

  /usr/src/redhat/RPMS/i386/perl-Compress-Zlib-1.33-1.i396.rpm
  /usr/src/redhat/RPMS/i386/perl-Compress-Zlib-debuginfo-1.33-1.i396.rpm


These are not present in the system on which install.sh is failing. I
assume it should thus install the perl-Compress-Zlib-1.33-2.i396.rpm you
provide on the download for RedHat systems.

However this begs the question as to why the later version you provide
(1.33-2) is not installed in place of the existing version (1.33-1) on
my two successful builds.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 05 October 2004 03:42
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner-4.34.8-1 Installation Problems
>
>At 00:11 05/10/2004, you wrote:
>
>>Ladies and Gents,
>>         rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
>> serveral errors.  Some of which had inherent bzip2 syntax 
>problems.  What
>> is the issue?  After editing the following 
>/usr/lib/rpm/brp-compress, and
>> taking off the "-n" directive, then everything went through. Now its
>> doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.
>>
>>What is going on???
>>
>>Processing files: perl-Compress-Zlib-1.33-2
>>error: File not found:
>>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_per
>l/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
>>
>>RPM build errors:
>>     File not found:
>> 
>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl
>/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
>
>Something failed in the "make" stage of building perl-Compress-Zlib.
>Suggest you take a good look at the output from that rebuild.
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From p.g.m.peters at utwente.nl  Tue Oct  5 15:20:45 2004
From: p.g.m.peters at utwente.nl (Peter Peters)
Date: Thu Jan 12 21:27:08 2006
Subject: How to configure MailScanner with sendmail's expensive=true
    option?
Message-ID: <mailman.3077.1137101228.24926.mailscanner@lists.mailscanner.info>

On Tue, 5 Oct 2004 18:40:16 +0530, you wrote:

>Sendmail is configured with Expensive=True, but MailScanner ignores this
>feature and tries to deliver the moment it gets a chance to send out mail.

In MailScanner.conf you can set "Delivery Method" to "queue". Or, as
advised in the comment, use a ruleset.

--
Peter Peters, senior netwerkbeheerder
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 15:35:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: How to configure MailScanner with sendmail's expensive=true
    option?
Message-ID: <mailman.3078.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:10 05/10/2004, you wrote:
>Hi
>
>I use a few mail servers with MailScanner & Sendmail (RH9) that hook up to the
>net using a ppp dial up connection every 30 minutes.
>
>I relay the messages to a Smart Host which accepts mail only if it is pop
>authenticated... so I run a script which does
>1. fetchmail to authenticate my dynamic IP address on the smart host
>2. trigger sendmai -q to relay mail to the smart host.
>
>Sendmail is configured with Expensive=True, but MailScanner ignores this
>feature and tries to deliver the moment it gets a chance to send out mail.
>
>I read this from the archives but was not sure if this is the solution to my
>problem.
>
>http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0209&L=mailscanner&P=R37713&I=-1
>
>Can anyone help?

Set "Delivery Method = queue" in MailScanner.conf and it won't make the
initial delivery attempt, but leave your system to deliver at a time of its
own choosing.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From usergroups at THEARGONCOMPANY.COM  Tue Oct  5 16:55:11 2004
From: usergroups at THEARGONCOMPANY.COM (Rishi)
Date: Thu Jan 12 21:27:08 2006
Subject: How to configure MailScanner with sendmail's expensive=true
    option?
Message-ID: <mailman.3079.1137101228.24926.mailscanner@lists.mailscanner.info>

> Set "Delivery Method = queue" in MailScanner.conf and it won't make the
> initial delivery attempt, but leave your system to deliver at a time of its
> own choosing.

But then even internal mail between users on the Linux box is queued... The
way sendmail's expensive feature works is that internal mail is delivered
instantly, while keeping external mail in the queue to be delivered when
triggered.

Any way to accomplish this?

Regards

Rishi

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Oct  5 17:17:13 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3080.1137101228.24926.mailscanner@lists.mailscanner.info>

Julian

There appears to be a bug in the logic of install.sh. You should not be
using Perl to check for the presence of modules since Perl will find
them even when they were not installed by RPM.

This causes a problem because when you install a RPM binary it seems to
check whether dependent modules are present by reference to the RPM
database.

However a module may have been installed earlier by non-RPM means. Your
script decides whether a module is present or not by using Perl. This
will find the module when it was _not_ installed by RPM. You then skip
the necessary rpmbuild and rpm -Uvh steps needed to update the RPM
database.

This was the case with Compress-Zlib. It _is_ installed on the system
but is not in the RPM database. However the binary RPM for Archive-Zip
expects to see Compress-Zlib in the list of RPM-installed modules.



Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell
>Sent: 05 October 2004 15:04
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner-4.34.8-1 Installation Problems
>
>Julian
>
>I have just upgraded two RedHat AS/ES 3 systems to 4-34.8-1 but the
>attempt to ugrade a third AS 3 system failed in install.sh with:
>
>   error: Failed dependencies:
>          perl (Compress::Zlib) is needed by perl-Archive-Zip-1.13-1.
>
>Using CPAN and "installing Compress::Zlib" I am told that it is up to
>date!
>
>However looking a bit more closely I find that on the two systems on
>which 4.34.8-1 was successfully installed there is present the files 
>
>  /usr/src/redhat/RPMS/i386/perl-Compress-Zlib-1.33-1.i396.rpm
>  
>/usr/src/redhat/RPMS/i386/perl-Compress-Zlib-debuginfo-1.33-1.i396.rpm
>
>
>These are not present in the system on which install.sh is failing. I
>assume it should thus install the 
>perl-Compress-Zlib-1.33-2.i396.rpm you
>provide on the download for RedHat systems.
>
>However this begs the question as to why the later version you provide
>(1.33-2) is not installed in place of the existing version (1.33-1) on
>my two successful builds.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                           University of Newcastle,
>                           Newcastle upon Tyne,
>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>---------------------------------------------------------------
>---------
>"Any opinion expressed above is mine. The University can get 
>its own."  
>
>>-----Original Message-----
>>From: MailScanner mailing list 
>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>>Sent: 05 October 2004 03:42
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: MailScanner-4.34.8-1 Installation Problems
>>
>>At 00:11 05/10/2004, you wrote:
>>
>>>Ladies and Gents,
>>>         rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
>>> serveral errors.  Some of which had inherent bzip2 syntax 
>>problems.  What
>>> is the issue?  After editing the following 
>>/usr/lib/rpm/brp-compress, and
>>> taking off the "-n" directive, then everything went through. Now its
>>> doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.
>>>
>>>What is going on???
>>>
>>>Processing files: perl-Compress-Zlib-1.33-2
>>>error: File not found:
>>>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_per
>>l/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
>>>
>>>RPM build errors:
>>>     File not found:
>>> 
>>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl
>>/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
>>
>>Something failed in the "make" stage of building perl-Compress-Zlib.
>>Suggest you take a good look at the output from that rebuild.
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From chris.jones at ATMOSENERGY.COM  Tue Oct  5 17:25:32 2004
From: chris.jones at ATMOSENERGY.COM (Jones, Chris)
Date: Thu Jan 12 21:27:08 2006
Subject: Logging from CustomConfig.pm
Message-ID: <mailman.3081.1137101228.24926.mailscanner@lists.mailscanner.info>

I am trying to understand logging from within a CustomFunction. I have
set up the function "ByDomainSpamWhitelist" to work in my test
environment.
I do not see any logging from custom functions in either the mail log or
the foreground messages. I have also set my syslog to enable logging
from remote machines. Is there something else I need to enable?


The CustomConfig.pm ByDomainSpamWhiteList:

my $WhitelistDir = '/etc/MailScanner/spam.bydomain/whitelist';
#
# Initialise by-domain spam whitelist and blacklist
#
sub InitByDomainSpamWhitelist {
  MailScanner::Log::InfoLog("Starting up by-domain spam whitelist, " .
                            "reading from %s", $WhitelistDir);
  my $domains = CreateByDomainList($WhitelistDir, \%Whitelist);
  MailScanner::Log::InfoLog("Read whitelist for %d domains", $domains);
}


This is where I have enabled the ByDomainSpamWhiteList in the
MailScanner.conf
# Spam Blacklist:
# Make this point to a ruleset, and anything in that ruleset whose value

# is "yes" will *always* be marked as spam. 
# This can also be the filename of a ruleset. 
Is Definitely Spam = &ByDomainSpamWhitelist
This is where I have set logging to go to the syslog.
# This is the syslog "facility" name that MailScanner uses. If you don't

# know what a syslog facility name is, then either don't change this
value 
# or else go and read "man syslog.conf". The default value of "mail"
will 
# cause the MailScanner logs to go into the same place as all your other

# mail logs. 
Syslog Facility = mail
Trying to see log statements from the debug statements
# Set Run In Foreground to "yes" if you want MailScanner to operate
# normally in foreground (and not as a background daemon).
# Use this if you are controlling the execution of MailScanner
# with a tool like DJB's 'supervise' (see
http://cr.yp.to/daemontools.html).
Run In Foreground = yes

This is all I actually see in the /var/log/maillog
Oct  4 12:22:55 u22 MailScanner[23334]: Config: calling custom init
function ByDomainSpamWhitelist 
Oct  4 12:23:04 u22 MailScanner[23335]: MailScanner E-Mail Virus Scanner
version 4.34.6 starting... 
Oct  4 12:23:05 22 MailScanner[23335]:
spamblacklist^I^IByDomainSpamWhitelist
Oct  4 12:23:05 u22 MailScanner[23335]: End of definition file.

Thanks,
Chris Jones
System Engineer
Atmos Energy Corporation

"A leader must never care more about being liked than being right."
George W. Bush

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 17:50:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: How to configure MailScanner with sendmail's expensive=true
    option?
Message-ID: <mailman.3082.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:55 05/10/2004, you wrote:
> > Set "Delivery Method = queue" in MailScanner.conf and it won't make the
> > initial delivery attempt, but leave your system to deliver at a time of its
> > own choosing.
>
>But then even internal mail between users on the Linux box is queued... The
>way sendmail's expensive feature works is that internal mail is delivered
>instantly, while keeping external mail in the queue to be delivered when
>triggered.
>
>Any way to accomplish this?

Use a frequent queue-runner to deliver the "cheap" mail. You could even use
a ruleset to make the outgoing queue directory depend on the addresses in
the message. You run a frequent queue-runner on the "local mail" queue, and
don't run one on the "expensive" mail.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From G.Pentland at SOTON.AC.UK  Tue Oct  5 17:52:08 2004
From: G.Pentland at SOTON.AC.UK (Pentland G.)
Date: Thu Jan 12 21:27:08 2006
Subject: Feature request dodgy hack
Message-ID: <mailman.3083.1137101228.24926.mailscanner@lists.mailscanner.info>

I would like to request a "Log Silently Deleted Viruses = yes/no" style
option.

Having recently upgraded MailScanner I have performed another dodgy hack
to get this logged.

A suggestion of a non-dodgy hack to achieve this will do.

Would anyone else find this useful?

Any chance Julian?

Gary

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 17:54:13 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3084.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
But the perl module dependencies are added automatically when the RPM is
built, apparently taken from the Makefile.PL contents. I'm not sure how to
build the RPM's without it using this information. There doesn't appear to
be an easy way to do it.

Anyone know how to do this with rpmbuild?

At 17:17 05/10/2004, you wrote:
>Julian
>
>There appears to be a bug in the logic of install.sh. You should not be
>using Perl to check for the presence of modules since Perl will find
>them even when they were not installed by RPM.
>
>This causes a problem because when you install a RPM binary it seems to
>check whether dependent modules are present by reference to the RPM
>database.
>
>However a module may have been installed earlier by non-RPM means. Your
>script decides whether a module is present or not by using Perl. This
>will find the module when it was _not_ installed by RPM. You then skip
>the necessary rpmbuild and rpm -Uvh steps needed to update the RPM
>database.
>
>This was the case with Compress-Zlib. It _is_ installed on the system
>but is not in the RPM database. However the binary RPM for Archive-Zip
>expects to see Compress-Zlib in the list of RPM-installed modules.
>
>
>
>Quentin
>---
>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                            University of Newcastle,
>                            Newcastle upon Tyne,
>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
>
> >-----Original Message-----
> >From: MailScanner mailing list
> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell
> >Sent: 05 October 2004 15:04
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner-4.34.8-1 Installation Problems
> >
> >Julian
> >
> >I have just upgraded two RedHat AS/ES 3 systems to 4-34.8-1 but the
> >attempt to ugrade a third AS 3 system failed in install.sh with:
> >
> >   error: Failed dependencies:
> >          perl (Compress::Zlib) is needed by perl-Archive-Zip-1.13-1.
> >
> >Using CPAN and "installing Compress::Zlib" I am told that it is up to
> >date!
> >
> >However looking a bit more closely I find that on the two systems on
> >which 4.34.8-1 was successfully installed there is present the files
> >
> >  /usr/src/redhat/RPMS/i386/perl-Compress-Zlib-1.33-1.i396.rpm
> >
> >/usr/src/redhat/RPMS/i386/perl-Compress-Zlib-debuginfo-1.33-1.i396.rpm
> >
> >
> >These are not present in the system on which install.sh is failing. I
> >assume it should thus install the
> >perl-Compress-Zlib-1.33-2.i396.rpm you
> >provide on the download for RedHat systems.
> >
> >However this begs the question as to why the later version you provide
> >(1.33-2) is not installed in place of the existing version (1.33-1) on
> >my two successful builds.
> >
> >
> >>-----Original Message-----
> >>From: MailScanner mailing list
> >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> >>Sent: 05 October 2004 03:42
> >>To: MAILSCANNER@JISCMAIL.AC.UK
> >>Subject: Re: MailScanner-4.34.8-1 Installation Problems
> >>
> >>At 00:11 05/10/2004, you wrote:
> >>
> >>>Ladies and Gents,
> >>>         rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
> >>> serveral errors.  Some of which had inherent bzip2 syntax
> >>problems.  What
> >>> is the issue?  After editing the following
> >>/usr/lib/rpm/brp-compress, and
> >>> taking off the "-n" directive, then everything went through. Now its
> >>> doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.
> >>>
> >>>What is going on???
> >>>
> >>>Processing files: perl-Compress-Zlib-1.33-2
> >>>error: File not found:
> >>>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_per
> >>l/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
> >>>
> >>>RPM build errors:
> >>>     File not found:
> >>>
> >>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl
> >>/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
> >>
> >>Something failed in the "make" stage of building perl-Compress-Zlib.
> >>Suggest you take a good look at the output from that rebuild.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vboulytchev at COINFOTECH.COM  Tue Oct  5 18:33:06 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3085.1137101228.24926.mailscanner@lists.mailscanner.info>

Errors:
#rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm
 
SNIP
Processing files: perl-Archive-Zip-1.13-1
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
error: File not found:/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRe
d.3pm
 

RPM build errors:
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
    File not found:/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRe
d.3pm
 
 
So, went looking in the
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/
ALL FILES ARE THERE, except bziped, not a .3pm, so when i  "bzip2 -d *"
they come out.
 
 
 
Another part of the rpmbuild, which is responsible for the errors above:
 
SNIP
Appending installation info to/var/tmp/perl-Archive-Zip-1.13-1-root/usr/lib/perl5/5.8.3/i386-linux-thread-mul
i/perllocal.pod
+ '[' -x /usr/lib/rpm/brp-compress ']'
+ /usr/lib/rpm/brp-compress
bzip2: Bad flag `-n'
bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
 
   usage: bzip2 [flags and input files in any order]
 
   -h --help           print this message
   -d --decompress     force decompression
   -z --compress       force compression
   -k --keep           keep (don't delete) input files
   -f --force          overwrite existing output files
   -t --test           test compressed file integrity
   -c --stdout         output to standard out
   -q --quiet          suppress noncritical error messages
   -v --verbose        be verbose (a 2nd -v gives more)
   -L --license        display software version & license
   -V --version        display software version & license
   -s --small          use less memory (at most 2500k)
   -1 .. -9            set block size to 100k .. 900k
   --fast              alias for -1
   --best              alias for -9
 
   If invoked as `bzip2', default action is to compress.
              as `bunzip2',  default action is to decompress.
              as `bzcat', default action is to decompress to stdout.
 
   If no file names are given, bzip2 compresses or decompresses
   from standard input to standard output.  You can combine
   short flags, so `-v -4' means the same as -v4 or -4v, &c.
 
bzip2: Bad flag `-n'
SNIP
 
 
 
So what I did, is edited /usr/lib/rpm/brp-compress and took out the -n
option, which is by the way not part of bzip2........   Anyways, then
everything compiled just fine.  I am having almost same issues with zlib
as stated below. 
 
WHATS GOING ON! :(
 
 
 
 

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Boulytchev, Vasiliy
Sent: Monday, October 04, 2004 5:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner-4.34.8-1 Installation Problems

Ladies and Gents,
        rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
serveral errors.  Some of which had inherent bzip2 syntax problems.  What
is the issue?  After editing the following /usr/lib/rpm/brp-compress, and
taking off the "-n" directive, then everything went through. Now its
doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.

What is going on???

Processing files: perl-Compress-Zlib-1.33-2
error: File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs


RPM build errors:
    File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From vboulytchev at COINFOTECH.COM  Tue Oct  5 18:34:41 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3086.1137101228.24926.mailscanner@lists.mailscanner.info>

On the same note,
 
 
 
Processing files: perl-Net-CIDR-0.09-3
error: File not found:
/var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
 

RPM build errors:
    File not found:
/var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
 

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Boulytchev, Vasiliy
Sent: Tuesday, October 05, 2004 11:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner-4.34.8-1 Installation Problems

Errors:
#rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm
 
SNIP
Processing files: perl-Archive-Zip-1.13-1
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
error: File not found:/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRe
d.3pm
 

RPM build errors:
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
    File not found:/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRe
d.3pm
 
 
So, went looking in the
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/
ALL FILES ARE THERE, except bziped, not a .3pm, so when i  "bzip2 -d *"
they come out.
 
 
 
Another part of the rpmbuild, which is responsible for the errors above:
 
SNIP
Appending installation info to/var/tmp/perl-Archive-Zip-1.13-1-root/usr/lib/perl5/5.8.3/i386-linux-thread-mul
i/perllocal.pod
+ '[' -x /usr/lib/rpm/brp-compress ']'
+ /usr/lib/rpm/brp-compress
bzip2: Bad flag `-n'
bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
 
   usage: bzip2 [flags and input files in any order]
 
   -h --help           print this message
   -d --decompress     force decompression
   -z --compress       force compression
   -k --keep           keep (don't delete) input files
   -f --force          overwrite existing output files
   -t --test           test compressed file integrity
   -c --stdout         output to standard out
   -q --quiet          suppress noncritical error messages
   -v --verbose        be verbose (a 2nd -v gives more)
   -L --license        display software version & license
   -V --version        display software version & license
   -s --small          use less memory (at most 2500k)
   -1 .. -9            set block size to 100k .. 900k
   --fast              alias for -1
   --best              alias for -9
 
   If invoked as `bzip2', default action is to compress.
              as `bunzip2',  default action is to decompress.
              as `bzcat', default action is to decompress to stdout.
 
   If no file names are given, bzip2 compresses or decompresses
   from standard input to standard output.  You can combine
   short flags, so `-v -4' means the same as -v4 or -4v, &c.
 
bzip2: Bad flag `-n'
SNIP
 
 
 
So what I did, is edited /usr/lib/rpm/brp-compress and took out the -n
option, which is by the way not part of bzip2........   Anyways, then
everything compiled just fine.  I am having almost same issues with zlib
as stated below. 
 
WHATS GOING ON! :(
 
 
 
 

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Boulytchev, Vasiliy
Sent: Monday, October 04, 2004 5:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner-4.34.8-1 Installation Problems

Ladies and Gents,
        rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
serveral errors.  Some of which had inherent bzip2 syntax problems.  What
is the issue?  After editing the following /usr/lib/rpm/brp-compress, and
taking off the "-n" directive, then everything went through. Now its
doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.

What is going on???

Processing files: perl-Compress-Zlib-1.33-2
error: File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs


RPM build errors:
    File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From mike at CAMAROSS.NET  Tue Oct  5 18:36:17 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:08 2006
Subject: How to configure MailScanner with sendmail's expensive=true
    option?
Message-ID: <mailman.3087.1137101228.24926.mailscanner@lists.mailscanner.info>

Rishi wrote:
>> Set "Delivery Method = queue" in MailScanner.conf and it won't make
>> the initial delivery attempt, but leave your system to deliver at a
>> time of its own choosing.
>
> But then even internal mail between users on the Linux box is
> queued... The way sendmail's expensive feature works is that internal
> mail is delivered instantly, while keeping external mail in the queue
> to be delivered when triggered.
>
> Any way to accomplish this?
>
> Regards
>
> Rishi

In your MailScanner.conf:

Delivery Method = %rules-dir%/delivery.rules

In delivery.rules:

To:             *@yourdomain.com                batch
FromTo: default                 queue

That should do what you want.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vboulytchev at COINFOTECH.COM  Tue Oct  5 18:37:11 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3088.1137101228.24926.mailscanner@lists.mailscanner.info>

Having same issues on several machines. :(  Not just that one box. 
 

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Boulytchev, Vasiliy
Sent: Tuesday, October 05, 2004 11:35 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner-4.34.8-1 Installation Problems

On the same note,
 
 
 
Processing files: perl-Net-CIDR-0.09-3
error: File not found:
/var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
 

RPM build errors:
    File not found:
/var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
 

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Boulytchev, Vasiliy
Sent: Tuesday, October 05, 2004 11:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner-4.34.8-1 Installation Problems

Errors:
#rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm
 
SNIP
Processing files: perl-Archive-Zip-1.13-1
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
error: File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
error: File not found:/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRe
d.3pm
 

RPM build errors:
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
    File not found:
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
    File not found:/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRe
d.3pm
 
 
So, went looking in the
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/
ALL FILES ARE THERE, except bziped, not a .3pm, so when i  "bzip2 -d *"
they come out.
 
 
 
Another part of the rpmbuild, which is responsible for the errors above:
 
SNIP
Appending installation info to/var/tmp/perl-Archive-Zip-1.13-1-root/usr/lib/perl5/5.8.3/i386-linux-thread-mul
i/perllocal.pod
+ '[' -x /usr/lib/rpm/brp-compress ']'
+ /usr/lib/rpm/brp-compress
bzip2: Bad flag `-n'
bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
 
   usage: bzip2 [flags and input files in any order]
 
   -h --help           print this message
   -d --decompress     force decompression
   -z --compress       force compression
   -k --keep           keep (don't delete) input files
   -f --force          overwrite existing output files
   -t --test           test compressed file integrity
   -c --stdout         output to standard out
   -q --quiet          suppress noncritical error messages
   -v --verbose        be verbose (a 2nd -v gives more)
   -L --license        display software version & license
   -V --version        display software version & license
   -s --small          use less memory (at most 2500k)
   -1 .. -9            set block size to 100k .. 900k
   --fast              alias for -1
   --best              alias for -9
 
   If invoked as `bzip2', default action is to compress.
              as `bunzip2',  default action is to decompress.
              as `bzcat', default action is to decompress to stdout.
 
   If no file names are given, bzip2 compresses or decompresses
   from standard input to standard output.  You can combine
   short flags, so `-v -4' means the same as -v4 or -4v, &c.
 
bzip2: Bad flag `-n'
SNIP
 
 
 
So what I did, is edited /usr/lib/rpm/brp-compress and took out the -n
option, which is by the way not part of bzip2........   Anyways, then
everything compiled just fine.  I am having almost same issues with zlib
as stated below. 
 
WHATS GOING ON! :(
 
 
 
 

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

 

________________________________________________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Boulytchev, Vasiliy
Sent: Monday, October 04, 2004 5:11 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner-4.34.8-1 Installation Problems

Ladies and Gents,
        rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
serveral errors.  Some of which had inherent bzip2 syntax problems.  What
is the issue?  After editing the following /usr/lib/rpm/brp-compress, and
taking off the "-n" directive, then everything went through. Now its
doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.

What is going on???

Processing files: perl-Compress-Zlib-1.33-2
error: File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs


RPM build errors:
    File not found:/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl/5.8.3/i386-linu
-thread-multi/auto/Compress/Zlib/Zlib.bs

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From mailscanner at ecs.soton.ac.uk  Tue Oct  5 18:59:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: Feature request dodgy hack
Message-ID: <mailman.3089.1137101228.24926.mailscanner@lists.mailscanner.info>

At 17:52 05/10/2004, you wrote:
>I would like to request a "Log Silently Deleted Viruses = yes/no" style
>option.

Yes, that sounds useful.
Attached are patches to ConfigDefs.pl and Message.pm to add a "Log Silent
Viruses" configuration option. It can only be yes or no. By default it is
switched off. It cannot be a ruleset, as that sounds pretty daft to me.

# Log all occurrences of "Silent Viruses" as defined above?
# This can only be a simple yes/no value, not a ruleset.
Log Silent Viruses = no

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: "Message.pm.patch")  4.2KB. ]
    [ Unable to print this part. ]


    [ Part 3, Application/OCTET-STREAM (Name: "ConfigDefs.pl.patch")  ]
    [ 446bytes. ]
    [ Unable to print this part. ]


    [ Part 4: "Attached Text" ]

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From ssilva at SGVWATER.COM  Tue Oct  5 19:03:01 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3090.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Boulytchev, Vasiliy wrote:
| On the same note,
|
|
|
| Processing files: perl-Net-CIDR-0.09-3
| error: File not found:
| /var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
|
|
| RPM build errors:
|     File not found:
| /var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
|
|
| Thanks,
| Vasiliy Boulytchev
| Colorado Information Technologies, Inc.
| http://www.coinfotech.com <http://www.coinfotech.com/>
|
|
|
| ------------------------------------------------------------------------
| *From:* MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] *On
| Behalf Of *Boulytchev, Vasiliy
| *Sent:* Tuesday, October 05, 2004 11:33 AM
| *To:* MAILSCANNER@JISCMAIL.AC.UK
| *Subject:* Re: MailScanner-4.34.8-1 Installation Problems
|
| Errors:
| #rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm
|
| SNIP
| Processing files: perl-Archive-Zip-1.13-1
| error: File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
| error: File not found:
| /var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
| error: File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
| error: File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRead.3pm
|
|
| RPM build errors:
|     File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.3pm
|     File not found:
| /var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
|     File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3pm
|     File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::MemberRead.3pm
|
|
| So, went looking in the
| /var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/
| ALL FILES ARE THERE, except bziped, not a .3pm, so when i  "bzip2 -d *"
| they come out.
|
|
|
| Another part of the rpmbuild, which is responsible for the errors above:
|
| SNIP
| Appending installation info to
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/perllocal.pod
| + '[' -x /usr/lib/rpm/brp-compress ']'
| + /usr/lib/rpm/brp-compress
| bzip2: Bad flag `-n'
| bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
|
|    usage: bzip2 [flags and input files in any order]
|
|    -h --help           print this message
|    -d --decompress     force decompression
|    -z --compress       force compression
|    -k --keep           keep (don't delete) input files
|    -f --force          overwrite existing output files
|    -t --test           test compressed file integrity
|    -c --stdout         output to standard out
|    -q --quiet          suppress noncritical error messages
|    -v --verbose        be verbose (a 2nd -v gives more)
|    -L --license        display software version & license
|    -V --version        display software version & license
|    -s --small          use less memory (at most 2500k)
|    -1 .. -9            set block size to 100k .. 900k
|    --fast              alias for -1
|    --best              alias for -9
|
|    If invoked as `bzip2', default action is to compress.
|               as `bunzip2',  default action is to decompress.
|               as `bzcat', default action is to decompress to stdout.
|
|    If no file names are given, bzip2 compresses or decompresses
|    from standard input to standard output.  You can combine
|    short flags, so `-v -4' means the same as -v4 or -4v, &c.
|
| bzip2: Bad flag `-n'
| SNIP
|
|
|
| So what I did, is edited /usr/lib/rpm/brp-compress and took out the -n
| option, which is by the way not part of bzip2........   Anyways, then
| everything compiled just fine.  I am having almost same issues with zlib
| as stated below.
|
| WHATS GOING ON! :(
|
|
|
|
|
| Thanks,
| Vasiliy Boulytchev
| Colorado Information Technologies, Inc.
| http://www.coinfotech.com <http://www.coinfotech.com/>
|
|
|
If you are not building as root, do you have a valid .rpmmacros file for
the user you are building as?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBYuHURADw9lziUqQRAqrMAJ0VGWift0ovPNWbMl53mErTI8en5wCfXzkO
/1ZII5o+JpSfdQ1AoKefYYM=
=NZKU
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Tue Oct  5 19:07:53 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:08 2006
Subject: where went SAVI-Perl?
Message-ID: <mailman.3091.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian,

I would suggest adding SAVI-perl-0.15 to the perl.tar directory.
I was using the output of "MailScanner -v" to compare the version
numbers of MS perl modules to what is listed at CPAN, to see if
I was up-to-date.  A search for "SAVI" out there yielded really
old stuff for this code -- version 0.10.  Has Paul Henson dropped
support for this?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Tue Oct  5 19:24:01 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:08 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3092.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I've noticed the same problem, my settings listed below.  I've done
some poking thru the SA 3.0 code to try and figure out what is going
on, but I don't really know what I'm looking at.  This smells like
a bug in SA 3.0; it worked in 2.64 for me.  I contemplated filing
a bug report for SA 3.0, but I realize that my report would be
vague enough to annoy the SpamAssassin maintainers.  Anybody have
any suggestions on how to give them more info?  A debug run of
MS/SA yields little except:

debug: dns_available set to yes in config file, skipping test

Jeff Earickson
Colby College

My setup:

./MailScanner -v
Running on
SunOS basalt 5.9 Generic_117171-10 sun4u sparc SUNW,Netra-T12
This is Perl version 5.008005 (5.8.5)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.03    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.73    File::Basename
2.08    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.05    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
0.15    SAVI
1.2     Sys::Hostname::Long
2.42    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.34    URI


On Mon, 4 Oct 2004, Alan wrote:

> Date: Mon, 4 Oct 2004 00:35:19 +0100
> From: Alan <mailscanner@ELKNET.NET>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: NO_DNS_FOR_FROM
>
> Prior to upgrading to SA3, I used to see quite a few 'NO_DNS_FOR_FROM' hits
> in my logs. Now that I have upgraded, I see none. Not a single hit.
>
> When I moved to SA3, I started from scratch, installing RH8, the latest MS,
> exim, and SA3. Everything else appears to be running fine, just zero hits
> for 'NO_DNS_FOR_FROM', even when I feed it test messages with phoney 'from'
> addresses.
>
> Any suggestions on where I should look to solve this?
> Thanks!
> -Alan
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 19:37:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: where went SAVI-Perl?
Message-ID: <mailman.3093.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Google produced this:
http://www.csupomona.edu/~henson/www/projects/SAVI-Perl/dist/
which is his master site. 0.15 is still there.

At 19:07 05/10/2004, you wrote:
>Julian,
>
>I would suggest adding SAVI-perl-0.15 to the perl.tar directory.
>I was using the output of "MailScanner -v" to compare the version
>numbers of MS perl modules to what is listed at CPAN, to see if
>I was up-to-date.  A search for "SAVI" out there yielded really
>old stuff for this code -- version 0.10.  Has Paul Henson dropped
>support for this?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Tue Oct  5 20:14:24 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:08 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3094.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:24 PM 10/5/2004, Jeff A. Earickson wrote:
>I've noticed the same problem, my settings listed below.  I've done
>some poking thru the SA 3.0 code to try and figure out what is going
>on, but I don't really know what I'm looking at.  This smells like
>a bug in SA 3.0; it worked in 2.64 for me.

It would appear there was a bug, but Dan Q tried to fix it before releasing
SA 3.0 final.
http://bugzilla.spamassassin.org/show_bug.cgi?id=3494

In which Dan Q tried to fix NO_DNS_FOR_FROM prior to 3.0's release.

I'd double-check to make sure you've got a fully final copy of SA 3.0, not
a release candidate.

grep NO_DNS_FOR_FROM /usr/share/spamassassin/*.cf

Should return these lines:

20_dnsbl_tests.cf:header NO_DNS_FOR_FROM                eval:check_dns_sender()
20_dnsbl_tests.cf:describe NO_DNS_FOR_FROM      Envelope sender has no MX
or A DNS records
20_dnsbl_tests.cf:tflags NO_DNS_FOR_FROM                net
30_text_de.cf:lang de describe NO_DNS_FOR_FROM Domain der Absendeadresse
nicht im DNS registriert (kein MX/A Eintrag)
30_text_fr.cf:lang fr describe NO_DNS_FOR_FROM  Adresse From: inconnue en
DNS (pas d'enregistrement MX)
30_text_nl.cf:lang nl describe NO_DNS_FOR_FROM                 Domein in
Van heeft geen MX of A DNS record
30_text_pl.cf:lang pl describe NO_DNS_FOR_FROM



If you see this line:

20_head_tests.cf header NO_DNS_FOR_FROM         eval:check_for_from_dns()

You've got rules from an outdated release. I know the old code was in pre4
and earlier, and not in rc3 and later, but I don't have copies of rc1 and
rc2 on hand to check those.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From combs at magnet.fsu.edu  Tue Oct  5 21:08:39 2004
From: combs at magnet.fsu.edu (Tom Combs)
Date: Thu Jan 12 21:27:08 2006
Subject: Why aren't RBL checks running?
Message-ID: <mailman.3095.1137101228.24926.mailscanner@lists.mailscanner.info>

Hello,

I'm in the process of setting up an email server using MS 4.34.8-1
and Spamassassin 3.0. For some reason, the RBL checks don't appear
to be running.

In my MailScanner.conf file I have:

   Spam List = spamcop.net


in spam.lists.conf there is:

   spamcop.net                  bl.spamcop.net.


 and in spam.assassin.prefs.conf, I have

   skip_rbl_checks 1


 On my other server, I'm use to seeing messages in the log file like:

    RBL checks: i917AbsS018169 found in spamcop.net

 and

   .... to magnet.fsu.edu is spam, spamcop.net


 But I'm not seeing any of this on the new server and I do have the spam logging
 turned on.

 My old server is a Solaris box and my new server is a RedHat AS 3.0 system so
 I'm wondering if it is something peculiar between the two OS environments.
 Since I really don't know how the RBL checks worked, I turned off iptables
 in case I was blocking the traffic. That doesn't seem to help.

 Does anyone have any suggestions as what could be wrong? Is there a way
 to test the RBLs other then looking for results in the log files?

 Thanks a bunch!     --Tom



--
Tom Combs                                      E-mail: combs@magnet.fsu.edu
National High Magnetic Field Laboratory        Phone:  (850) 644-1657
1800 E. Paul Dirac Drive                       Tallahassee, FL 32310

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct  5 21:18:22 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:08 2006
Subject: Why aren't RBL checks running?
Message-ID: <mailman.3096.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Is mail coming to this system straight from the outside world, or is it all
coming via one of your own servers? The MailScanner "Spam List" checks only
check the other end of the incoming SMTP connection. So if it's all coming
via one of your own servers, it won't find anything. The RBL checks that
SpamAssassin can do will still work, though.

At 21:08 05/10/2004, you wrote:
>Hello,
>
>I'm in the process of setting up an email server using MS 4.34.8-1
>and Spamassassin 3.0. For some reason, the RBL checks don't appear
>to be running.
>
>In my MailScanner.conf file I have:
>
>    Spam List = spamcop.net
>
>
>in spam.lists.conf there is:
>
>    spamcop.net                  bl.spamcop.net.
>
>
>  and in spam.assassin.prefs.conf, I have
>
>    skip_rbl_checks 1
>
>
>  On my other server, I'm use to seeing messages in the log file like:
>
>     RBL checks: i917AbsS018169 found in spamcop.net
>
>  and
>
>    .... to magnet.fsu.edu is spam, spamcop.net
>
>
>  But I'm not seeing any of this on the new server and I do have the spam
> logging
>  turned on.
>
>  My old server is a Solaris box and my new server is a RedHat AS 3.0
> system so
>  I'm wondering if it is something peculiar between the two OS environments.
>  Since I really don't know how the RBL checks worked, I turned off iptables
>  in case I was blocking the traffic. That doesn't seem to help.
>
>  Does anyone have any suggestions as what could be wrong? Is there a way
>  to test the RBLs other then looking for results in the log files?
>
>  Thanks a bunch!     --Tom

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Kevin at MICA.NET  Tue Oct  5 21:25:54 2004
From: Kevin at MICA.NET (Kevin Hanser)
Date: Thu Jan 12 21:27:08 2006
Subject: Multiple actions in a ruleset
Message-ID: <mailman.3097.1137101228.24926.mailscanner@lists.mailscanner.info>

I just want to clarify the syntax if I want to have a ruleset rule that
has multiple actions.  For example, a domain that wants their spam
quarantined, but still receive a notification.  

The ruleset I think to do this would be:

To: domain.com          store notify

I just want to confirm the syntax for multiple actions like this... Do I
separate them w/a space as I have here, or do I use a comma, like this:

To: domain.com          store,notify

I want to confirm this because I just noticed a bug in my msre
application when you have multiple actions like this, and I want to
confirm the correct syntax before I correct my application.

Thx

k

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscan at PRIS.CA  Tue Oct  5 21:36:25 2004
From: mailscan at PRIS.CA (MailScanner Mailbox)
Date: Thu Jan 12 21:27:08 2006
Subject: tiff causing DOS message
Message-ID: <mailman.3098.1137101228.24926.mailscanner@lists.mailscanner.info>

Hello Julian

Scanning the file by itself produces the following output:

----------- SCAN SUMMARY -----------
Known viruses: 24829
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 2.46 MB
I/O buffer size: 131072 bytes
Time: 103.994 sec (1 m 43 s)

Now when I look at this, it took almost 2 minutes to scan the file, I'm
assuming that this is what is causing the DOS message. When I scan a file
of similar size it only takes a little over a 1/3 of the time.


----------- SCAN SUMMARY -----------
Known viruses: 24829
Scanned directories: 0
Scanned files: 1
Infected files: 0
Data scanned: 3.33 MB
I/O buffer size: 131072 bytes
Time: 28.532 sec (0 m 28 s)


So now that I think I know why its doing it, is there a way to prevent
this from happening.

Thank you for the help

Rick


On Tue, 5 Oct 2004, Julian Field wrote:

> What happens when you try to scan the tif manually?
>
> At 23:32 04/10/2004, you wrote:
> >Hello
> >
> >We have a customer that is attempting to send a tif file that is a little
> >over 3.5 mb, when trying to send he receives the following error:
> >
> >The following e-mails were found to have: Virus Detected
> >
> >     Sender: xxxxxx@pris.bc.ca
> >IP Address: 64.114.126.175
> >  Recipient: xxxxxx@peacecountry.com
> >    Subject: '...are' sticker
> >  MessageID: i94Kea0D007039
> >     Report: Denial of Service attack in message!
> >             Denial of Service attack in message!
> >
> >
> >The interesting part of the df file is:
> >
> >--============_-1115191450==_============
> >Content-Type: text/plain; charset="us-ascii" ; format="flowed"
> >
> >hello doris & frances,
> >
> >please find the attached layout of the sticker that you requested.
> >
> >
> >thanks!
> >
> >jesh 250-782-6068
> >--============_-1115191450==_============
> >Content-Id: <a05200f00bd87873eaf3f@[192.168.0.102].0.0>
> >Content-Type: image/tiff; name="are.tif"
> >  ; x-mac-type="54494646"
> >  ; x-mac-creator="3842494D"
> >Content-Disposition: attachment; filename="are.tif"
> >Content-Transfer-Encoding: base64
> >
> >
> >I have looked as best I can but cannot find a reason for this, we are
> >running MS-4.33.3 with ClamAV-0.80rc2
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From combs at magnet.fsu.edu  Tue Oct  5 21:37:45 2004
From: combs at magnet.fsu.edu (Tom Combs)
Date: Thu Jan 12 21:27:08 2006
Subject: Why aren't RBL checks running?
Message-ID: <mailman.3099.1137101228.24926.mailscanner@lists.mailscanner.info>

Julian,

  Yes that's true, all the email coming to the new server is being sent
  via the current production server so that must be why the RBLs aren't
  finding anything.  Good to know that I'm not on any of the RBLs!

  Thanks again, I'm always amazed and your quality and quantity of
  work/help.    --Tom



>Date: Tue, 5 Oct 2004 21:18:22 +0100
>From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>Subject: Re: Why aren't RBL checks running?
>Comments: To: Tom Combs <combs@magnet.fsu.edu>
>To: MAILSCANNER@JISCMAIL.AC.UK

>
>Is mail coming to this system straight from the outside world, or is it all
>coming via one of your own servers? The MailScanner "Spam List" checks only
>check the other end of the incoming SMTP connection. So if it's all coming
>via one of your own servers, it won't find anything. The RBL checks that
>SpamAssassin can do will still work, though.
>
>
Tom Combs                                      E-mail: combs@magnet.fsu.edu
National High Magnetic Field Laboratory        Phone:  (850) 644-1657
1800 E. Paul Dirac Drive                       Tallahassee, FL 32310

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dean at SAHRA.ARIZONA.EDU  Tue Oct  5 22:32:06 2004
From: dean at SAHRA.ARIZONA.EDU (Dean Jones)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner + SA3 + SURBL not registering.
Message-ID: <mailman.3100.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hate to come back to this issue but i guess i will :)

Upgraded to Mailscanner 4.34.8 today and SURBL checks stopped again.

the only thing i changed was installing the new MIME-Base64 and
MIME-Tools (and requirements) via CPAN.
Then i installed the new MailScanner.

All config files are in the right places and RBL is working..
guess i'm back to square one! heh



Julian Field wrote:
> On line 249 on install.rpm-fns.sh, add "--force" to the rpm command
> options.
>
> At 11:05 05/10/2004, you wrote:
>
>> Unfortunately even deleting Net::DNS and reinstalling did not get URI
>> started, also the 'solaris' fix did not work.
>>
>> Is there any way I can do a forced re-install off all the perl modules in
>> install-Clam-SA.tar.gz ??
>>
>>
>>
>> On Fri, 1 Oct 2004, Dean Jones wrote:
>>
>>> Remco Barendse wrote:
>>>
>>>> Strange.... I can confirm the same problem.
>>>>
>>>> I don't know how to remove a perl module, after the suggestion on this
>>>> list I simply re-installed the tarball and restarted MailScanner but
>>>> still
>>>> no URI hits from MS.
>>>>
>>>> Can I do a forced re-install of all the perl modules in the
>>>> install-SA-CLAMAV package?
>>>
>>>
>>> hye,
>>>
>>> this is what i did to finally get Net::DNS to fully re-install.
>>> it is probably not the 'proper' way to do this, so please be careful.
>>> When i upgraded to SA 3 i used the CPAN shell to make sure Net::DNS was
>>> upgraded. apparantly this wasn't enough.
>>>
>>> Make sure spamassassin/mailscanner isn't running or doing checks while
>>> you do this.
>>> I dloaded the version of Net::DNS i needed from cpan.org.
>>> Then i found my perl install and lib/site_perl/5.8.4/Net
>>> After backing it up, i removed the DNS.pm and
>>> lib/site_perl/5.8.4/Net/DNS directory.
>>> Then i re-compiled and installed from the tar.gz i dloaded from
>>> cpan.org.
>>>
>>> Fired MailScanner back up and RBL and URIBL checks were both working.
>>>
>>> Hopefully that will do it for you.
>>>
>>>
>>>
>>>>
>>>> On Fri, 1 Oct 2004, Julian Field wrote:
>>>>
>>>>> I haven't changed the SA3 code, it all works on my production and
>>>>> development systems, as do Steve's systems.
>>>>>
>>>>> At 21:47 30/09/2004, you wrote:
>>>>>
>>>>>> This issue has been reported by myself and Ugo earlier this week
>>>>>> on the list.  I'm at a loss too.  When the next version of MS
>>>>>> comes out, I will upgrade and see if the problem remains.
>>>>>>
>>>>>> Jeff Earickson
>>>>>> Colby College
>>>>>>
>>>>>> On Thu, 30 Sep 2004, Dean Jones wrote:
>>>>>>
>>>>>>> Date: Thu, 30 Sep 2004 12:49:31 -0700
>>>>>>> From: Dean Jones <dean@SAHRA.ARIZONA.EDU>
>>>>>>> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>>>>>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>>>>>> Subject: Re: MailScanner + SA3 + SURBL not registering.
>>>>>>>
>>>>>>> Steve Swaney wrote:
>>>>>>>
>>>>>>>>>> SNIPPED <<<
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> Doing the command that you suggested manages to make the SURBL
>>>>>>>>> checks
>>>>>>>>> work.
>>>>>>>>>
>>>>>>>>> It almost as if there is a spamassassin option in MailScanner.conf
>>>>>>>>> that
>>>>>>>>> turns it off.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> There is a command in MailScanner that turns SpamAssassin off;
>>>>>>>>
>>>>>>>> Use SpamAssassin = yes
>>>>>>>>
>>>>>>>> But if you have SpamAssassin turned on in MS and the test above
>>>>>>>> works,
>>>>>>>> MailScanner should run the exactly as the test does. How are you
>>>>>>>> sure
>>>>>>>> thst
>>>>>>>> MS is not running the tests?
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> Use SpamAssassin is set to yes, and SA is doing other checks.
>>>>>>>
>>>>>>> The only way i have to guess is just by the data SA drops into the
>>>>>>> logs.
>>>>>>> It never hits on any URIBL_* scores running natively.
>>>>>>>
>>>>>>> I can forward SURBL test emails through from outside addresses
>>>>>>> and they
>>>>>>> don't get hit by the SURBL checks.
>>>>>>>
>>>>>>> I'm at a loss :)
>>>>>>> otherwise SA 3 is working great.
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Julian Field
>>>>> www.MailScanner.info
>>>>> MailScanner thanks transtec Computers for their support
>>>>> Buy the MailScanner book at www.MailScanner.info/store
>>>>>
>>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>>
>>>>> ------------------------ MailScanner list ------------------------
>>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>> 'leave mailscanner' in the body of the email.
>>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From clicknow at SWIFTDSL.COM.AU  Tue Oct  5 23:30:01 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:08 2006
Subject: change from sendmail to postfix - messages now stuck in hold
Message-ID: <mailman.3101.1137101228.24926.mailscanner@lists.mailscanner.info>

On Mon, 2004-10-04 at 17:52, Julian Field wrote:
> Please kill all your MailScanner processes, set
>          Debug = yes
> in MailScanner.conf and then run check_mailscanner.
> That should print up an error message. If it just sits there, there are no
> messages in the incoming queue, so wait for 1 to arrive.

OK - seems that the problem was permissions.
/var/spool/MailScanner/incoming was owned by root.  Changed this to
postfix and all seems OK.  I presume that this is the correct owner?

thanks and regards
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From nicks at ONTHENET.COM.AU  Wed Oct  6 00:33:21 2004
From: nicks at ONTHENET.COM.AU (Nick Slager)
Date: Thu Jan 12 21:27:08 2006
Subject: change from sendmail to postfix - messages now stuck in hold
Message-ID: <mailman.3102.1137101228.24926.mailscanner@lists.mailscanner.info>

Thus spake Brian Parish (clicknow@SWIFTDSL.COM.AU):

> OK - seems that the problem was permissions.
> /var/spool/MailScanner/incoming was owned by root.  Changed this to
> postfix and all seems OK.  I presume that this is the correct owner?

Yes :-)


Nick

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vboulytchev at COINFOTECH.COM  Wed Oct  6 00:38:41 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3103.1137101228.24926.mailscanner@lists.mailscanner.info>

I am building as root...


Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Scott Silva
Sent: Tuesday, October 05, 2004 12:03 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner-4.34.8-1 Installation Problems


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Boulytchev, Vasiliy wrote:
| On the same note,
|
|
|
| Processing files: perl-Net-CIDR-0.09-3
| error: File not found:
| /var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
|
|
| RPM build errors:
|     File not found:
| /var/tmp/perl-Net-CIDR-0.09-3-root/usr/share/man/man3/Net::CIDR.3pm
|
|
| Thanks,
| Vasiliy Boulytchev
| Colorado Information Technologies, Inc.
| http://www.coinfotech.com <http://www.coinfotech.com/>
|
|
|
| ----------------------------------------------------------------------
| --
| *From:* MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
| *On Behalf Of *Boulytchev, Vasiliy
| *Sent:* Tuesday, October 05, 2004 11:33 AM
| *To:* MAILSCANNER@JISCMAIL.AC.UK
| *Subject:* Re: MailScanner-4.34.8-1 Installation Problems
|
| Errors:
| #rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm
|
| SNIP
| Processing files: perl-Archive-Zip-1.13-1
| error: File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.
3pm
| error: File not found:
| /var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.
| 3pm
| error: File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3
pm
| error: File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Membe
rRead.3pm
|
|
| RPM build errors:
|     File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Tree.
3pm
|     File not found:
| /var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip.3pm
|     File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::FAQ.3
pm
|     File not found:
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/Archive::Zip::Membe
rRead.3pm
|
|
| So, went looking in the
| /var/tmp/perl-Archive-Zip-1.13-1-root/usr/share/man/man3/
| ALL FILES ARE THERE, except bziped, not a .3pm, so when i  "bzip2 -d *"
| they come out.
|
|
|
| Another part of the rpmbuild, which is responsible for the errors above:
|
| SNIP
| Appending installation info to
|
/var/tmp/perl-Archive-Zip-1.13-1-root/usr/lib/perl5/5.8.3/i386-linux-thread-
multi/perllocal.pod
| + '[' -x /usr/lib/rpm/brp-compress ']'
| + /usr/lib/rpm/brp-compress
| bzip2: Bad flag `-n'
| bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
|
|    usage: bzip2 [flags and input files in any order]
|
|    -h --help           print this message
|    -d --decompress     force decompression
|    -z --compress       force compression
|    -k --keep           keep (don't delete) input files
|    -f --force          overwrite existing output files
|    -t --test           test compressed file integrity
|    -c --stdout         output to standard out
|    -q --quiet          suppress noncritical error messages
|    -v --verbose        be verbose (a 2nd -v gives more)
|    -L --license        display software version & license
|    -V --version        display software version & license
|    -s --small          use less memory (at most 2500k)
|    -1 .. -9            set block size to 100k .. 900k
|    --fast              alias for -1
|    --best              alias for -9
|
|    If invoked as `bzip2', default action is to compress.
|               as `bunzip2',  default action is to decompress.
|               as `bzcat', default action is to decompress to stdout.
|
|    If no file names are given, bzip2 compresses or decompresses
|    from standard input to standard output.  You can combine
|    short flags, so `-v -4' means the same as -v4 or -4v, &c.
|
| bzip2: Bad flag `-n'
| SNIP
|
|
|
| So what I did, is edited /usr/lib/rpm/brp-compress and took out the -n
| option, which is by the way not part of bzip2........   Anyways, then
| everything compiled just fine.  I am having almost same issues with
| zlib as stated below.
|
| WHATS GOING ON! :(
|
|
|
|
|
| Thanks,
| Vasiliy Boulytchev
| Colorado Information Technologies, Inc.
| http://www.coinfotech.com <http://www.coinfotech.com/>
|
|
|
If you are not building as root, do you have a valid .rpmmacros file for the
user you are building as?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBYuHURADw9lziUqQRAqrMAJ0VGWift0ovPNWbMl53mErTI8en5wCfXzkO
/1ZII5o+JpSfdQ1AoKefYYM=
=NZKU
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From vboulytchev at COINFOTECH.COM  Wed Oct  6 00:40:14 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:08 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3104.1137101228.24926.mailscanner@lists.mailscanner.info>

Is it just some systems having issues?  This is on Mandrake 10.0


Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Tuesday, October 05, 2004 10:54 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner-4.34.8-1 Installation Problems


But the perl module dependencies are added automatically when the RPM is
built, apparently taken from the Makefile.PL contents. I'm not sure how to
build the RPM's without it using this information. There doesn't appear to
be an easy way to do it.

Anyone know how to do this with rpmbuild?

At 17:17 05/10/2004, you wrote:
>Julian
>
>There appears to be a bug in the logic of install.sh. You should not be
>using Perl to check for the presence of modules since Perl will find
>them even when they were not installed by RPM.
>
>This causes a problem because when you install a RPM binary it seems to
>check whether dependent modules are present by reference to the RPM
>database.
>
>However a module may have been installed earlier by non-RPM means. Your
>script decides whether a module is present or not by using Perl. This
>will find the module when it was _not_ installed by RPM. You then skip
>the necessary rpmbuild and rpm -Uvh steps needed to update the RPM
>database.
>
>This was the case with Compress-Zlib. It _is_ installed on the system
>but is not in the RPM database. However the binary RPM for Archive-Zip
>expects to see Compress-Zlib in the list of RPM-installed modules.
>
>
>
>Quentin
>---
>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                            University of Newcastle,
>                            Newcastle upon Tyne,
>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>-----------------------------------------------------------------------
>- "Any opinion expressed above is mine. The University can get its
>own."
>
> >-----Original Message-----
> >From: MailScanner mailing list
> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Quentin Campbell
> >Sent: 05 October 2004 15:04
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner-4.34.8-1 Installation Problems
> >
> >Julian
> >
> >I have just upgraded two RedHat AS/ES 3 systems to 4-34.8-1 but the
> >attempt to ugrade a third AS 3 system failed in install.sh with:
> >
> >   error: Failed dependencies:
> >          perl (Compress::Zlib) is needed by perl-Archive-Zip-1.13-1.
> >
> >Using CPAN and "installing Compress::Zlib" I am told that it is up to
> >date!
> >
> >However looking a bit more closely I find that on the two systems on
> >which 4.34.8-1 was successfully installed there is present the files
> >
> >  /usr/src/redhat/RPMS/i386/perl-Compress-Zlib-1.33-1.i396.rpm
> >
> >/usr/src/redhat/RPMS/i386/perl-Compress-Zlib-debuginfo-1.33-1.i396.rp
> >m
> >
> >
> >These are not present in the system on which install.sh is failing. I
> >assume it should thus install the perl-Compress-Zlib-1.33-2.i396.rpm
> >you provide on the download for RedHat systems.
> >
> >However this begs the question as to why the later version you
> >provide
> >(1.33-2) is not installed in place of the existing version (1.33-1)
> >on my two successful builds.
> >
> >
> >>-----Original Message-----
> >>From: MailScanner mailing list
> >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> >>Sent: 05 October 2004 03:42
> >>To: MAILSCANNER@JISCMAIL.AC.UK
> >>Subject: Re: MailScanner-4.34.8-1 Installation Problems
> >>
> >>At 00:11 05/10/2004, you wrote:
> >>
> >>>Ladies and Gents,
> >>>         rpmbuild --rebuild perl-Archive-Zip-1.13-1.src.rpm yields
> >>>serveral errors.  Some of which had inherent bzip2 syntax
> >>problems.  What
> >>> is the issue?  After editing the following
> >>/usr/lib/rpm/brp-compress, and
> >>> taking off the "-n" directive, then everything went through. Now
> >>> its doing some more weirdness with perl-Compress-Zlib-1.33-2.src.rpm.
> >>>
> >>>What is going on???
> >>>
> >>>Processing files: perl-Compress-Zlib-1.33-2
> >>>error: File not found:
> >>>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_per
> >>l/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
> >>>
> >>>RPM build errors:
> >>>     File not found:
> >>>
> >>/var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib/perl5/site_perl
> >>/5.8.3/i386-linux-thread-multi/auto/Compress/Zlib/Zlib.bs
> >>
> >>Something failed in the "make" stage of building perl-Compress-Zlib.
> >>Suggest you take a good look at the output from that rebuild.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From admin at thenamegame.com  Wed Oct  6 04:15:58 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:08 2006
Subject: Auto-Whitelist growing
Message-ID: <mailman.3105.1137101228.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:Arial;
        color:windowtext;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Since upgrading to SA3.0 the auto-whitelist file is growing
by leaps and bound. Anyone know why?<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-rw-------&nbsp;&nbsp;&nbsp; 1 root&nbsp;&nbsp;&nbsp;&nbsp; root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1290240 Oct&nbsp; 5 22:59
auto-whitelist<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>This file is in the same directory as my bayes files. Why is
it being populated?<o:p></o:p></span></font></p>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From bg.mahesh at INDIAINFO.COM  Wed Oct  6 07:28:05 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:08 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3106.1137101228.24926.mailscanner@lists.mailscanner.info>

% ./install.sh ignore-perl --nodeps

Installing tnef decoder

Preparing...                ########################################### [100%]
        package tnef-1.2.3.1-1 is already installed

Now to install MailScanner itself.

error: Failed dependencies:
        perl(MIME::QuotedPrint) >= 3.03 is needed by (installed) perl-MIME-tools-5.413-1

----- Original Message -----
From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
Date:         Tue, 5 Oct 2004 08:48:57 +0100
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Installation problems with MS 4.34.8-1/MIME::QuotedPrint

> Try
>         ./install.sh --nodeps
>
> At 08:32 05/10/2004, you wrote:
> >How to solve this problem :-( ?
> >
> >----- Original Message -----
> >From: BG Mahesh <bg.mahesh@INDIAINFO.COM>
> >Date:         Fri, 1 Oct 2004 16:09:52 +0530
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
> >
> > > hi
> > >
> > > I am not able to install MS 4.34.8-1. The error message I get is,
> > >
> > > Installing tnef decoder
> > > Preparing...                ###########################################
> > [100%]
> > >         package tnef-1.2.3.1-1 is already installed
> > >
> > > Now to install MailScanner itself.
> > >
> > > error: Failed dependencies:
> > >         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> > perl-MIME-tools-5.413-1
> > >
> > > My setup
> > >
> > > Redhat Linux
> > > Perl 5.8.3
> > > MIME::QuotedPrint   : 3.03
> > > MIME::Tools         : 5.413
> > > MIME::Base64        : 3.03
> > >
> > > What am I doing wrong?
> > >
> > > --
> > > B.G. Mahesh
> > > bg.mahesh@indiainfo.com
> > > http://www.indiainfo.com/
> > >
> > > --
> > > ______________________________________________
> > > IndiaInfo Mail - the free e-mail service with a difference!
> > www.indiainfo.com
> > > Check out our value-added Premium features, such as an extra 20MB for
> > mail storage, POP3, e-mail forwarding, and ads-free mailboxes!
> > >
> > > Powered by Outblaze
> > >
> > > ------------------------ MailScanner list ------------------------
> > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > 'leave mailscanner' in the body of the email.
> > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >
> >
> >--
> >B.G. Mahesh
> >bg.mahesh@indiainfo.com
> >http://www.indiainfo.com/
> >
> >--
> >______________________________________________
> >IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
> >Check out our value-added Premium features, such as an extra 20MB for mail
> >storage, POP3, e-mail forwarding, and ads-free mailboxes!
> >
> >Powered by Outblaze
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From kevin at KEVINSPICER.CO.UK  Wed Oct  6 09:10:28 2004
From: kevin at KEVINSPICER.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:27:09 2006
Subject: MailScanner-MRTG new STABLE release
Message-ID: <mailman.3107.1137101229.24926.mailscanner@lists.mailscanner.info>

This stable release is a recommended upgrade for anyone running releases
prior to v0.09.03 (users of 0.09.03 need not upgrade as it is
functionally identical to this release, the only difference being a
single cosmetic change - a link to subscribe to this list!). 

On a personal note, I will be away on honeymoon for two weeks from this
weekend, and I don't think my wife will take kindly to me slipping off
to read my email. Please accept my apologies in advance if I'm not able
to deal with any support issues in a timely manner.

Please note that there are some changes in the config file on this
release. The recomended way to upgrade the config file is by using
upgrade_MailScanner_conf. For example on an rpm based system... 

$ cd /etc/MailScanner 
$ upgrade_MailScanner_conf mailscanner-mrtg.conf
mailscanner-mrtg.conf.rpmnew > mailscanner-mrtg.conf.new 
$ mv mailscanner-mrtg.conf mailscanner-mrtg.conf.old 
$ mv mailscanner-mrtg.conf.new mailscanner-mrtg.conf 

New features and improvements since the 0.08 branch include the
following... 
*Implementation of a timeout on data collection runs, to reduce impact
on heavily laden systems 
*New way of counting quarantine files, to make it quicker and less
resource intensive 
*Support for multiple quarantine and queue directories 
*Quarantine counts messages as well as files 
*Two new graphs. Batch Size and Processing Speed 
*Logging to syslog 
*Added helpful descriptions to the graphs 
*Now will not attempt to restart MailScanner if MailScanner was shut
down using its init script. 
*More flexible way of dealing with all the various names MTA's use when
logging 

Important fixes include....
*Fix spam ratio to work properly for people using RBL's in their MTA 
*Fix the Load average graph to show loads higher than 4, rather than
clipping. 

See the full changelog for details of other fixes.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From mailscanner at ecs.soton.ac.uk  Wed Oct  6 09:52:27 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: tiff causing DOS message
Message-ID: <mailman.3108.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
That will be it. I can't remember whether you can change the timeout in
MailScanner.conf or not, it's something that people never normally need to
tweak.

At 21:36 05/10/2004, you wrote:
>Hello Julian
>
>Scanning the file by itself produces the following output:
>
>----------- SCAN SUMMARY -----------
>Known viruses: 24829
>Scanned directories: 0
>Scanned files: 1
>Infected files: 0
>Data scanned: 2.46 MB
>I/O buffer size: 131072 bytes
>Time: 103.994 sec (1 m 43 s)
>
>Now when I look at this, it took almost 2 minutes to scan the file, I'm
>assuming that this is what is causing the DOS message. When I scan a file
>of similar size it only takes a little over a 1/3 of the time.
>
>
>----------- SCAN SUMMARY -----------
>Known viruses: 24829
>Scanned directories: 0
>Scanned files: 1
>Infected files: 0
>Data scanned: 3.33 MB
>I/O buffer size: 131072 bytes
>Time: 28.532 sec (0 m 28 s)
>
>
>So now that I think I know why its doing it, is there a way to prevent
>this from happening.
>
>Thank you for the help
>
>Rick
>
>
>On Tue, 5 Oct 2004, Julian Field wrote:
>
> > What happens when you try to scan the tif manually?
> >
> > At 23:32 04/10/2004, you wrote:
> > >Hello
> > >
> > >We have a customer that is attempting to send a tif file that is a little
> > >over 3.5 mb, when trying to send he receives the following error:
> > >
> > >The following e-mails were found to have: Virus Detected
> > >
> > >     Sender: xxxxxx@pris.bc.ca
> > >IP Address: 64.114.126.175
> > >  Recipient: xxxxxx@peacecountry.com
> > >    Subject: '...are' sticker
> > >  MessageID: i94Kea0D007039
> > >     Report: Denial of Service attack in message!
> > >             Denial of Service attack in message!
> > >
> > >
> > >The interesting part of the df file is:
> > >
> > >--============_-1115191450==_============
> > >Content-Type: text/plain; charset="us-ascii" ; format="flowed"
> > >
> > >hello doris & frances,
> > >
> > >please find the attached layout of the sticker that you requested.
> > >
> > >
> > >thanks!
> > >
> > >jesh 250-782-6068
> > >--============_-1115191450==_============
> > >Content-Id: <a05200f00bd87873eaf3f@[192.168.0.102].0.0>
> > >Content-Type: image/tiff; name="are.tif"
> > >  ; x-mac-type="54494646"
> > >  ; x-mac-creator="3842494D"
> > >Content-Disposition: attachment; filename="are.tif"
> > >Content-Transfer-Encoding: base64
> > >
> > >
> > >I have looked as best I can but cannot find a reason for this, we are
> > >running MS-4.33.3 with ClamAV-0.80rc2

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 09:54:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Multiple actions in a ruleset
Message-ID: <mailman.3109.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 21:25 05/10/2004, you wrote:
>I just want to clarify the syntax if I want to have a ruleset rule that
>has multiple actions.  For example, a domain that wants their spam
>quarantined, but still receive a notification.
>
>The ruleset I think to do this would be:
>
>To: domain.com          store notify
>
>I just want to confirm the syntax for multiple actions like this... Do I
>separate them w/a space as I have here, or do I use a comma, like this:
>
>To: domain.com          store,notify

You need to have a space in between them. Extra spaces and commas are fine
too, but there must be at least one space. So
         store, notify
and
         store notify
are okay, but
         store,notify
is not.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 09:58:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Auto-Whitelist growing
Message-ID: <mailman.3110.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:15 06/10/2004, you wrote:
>Since upgrading to SA3.0 the auto-whitelist file is growing by leaps and
>bound. Anyone know why?
>
>-rw-------    1 root     root      1290240 Oct  5 22:59 auto-whitelist
>
>This file is in the same directory as my bayes files. Why is it being
>populated?

You need to turn off the auto_whitelist setting in
spam.assassin.prefs.conf. For some reason, turning it off from the API
doesn't appear to work any more. I might remove the MailScanner.conf option
that does this.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 10:00:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3111.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I'm going to ask for the dependency on MIME::QuotedPrint to be removed. It
comes as part of MIME::Base64 anyway, so if you have the right version of
that, you must have the right version of MIME::QuotedPrint as well.

At 07:28 06/10/2004, you wrote:
>% ./install.sh ignore-perl --nodeps
>
>Installing tnef decoder
>
>Preparing...                ########################################### [100%]
>         package tnef-1.2.3.1-1 is already installed
>
>Now to install MailScanner itself.
>
>error: Failed dependencies:
>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> perl-MIME-tools-5.413-1
>
>----- Original Message -----
>From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>Date:         Tue, 5 Oct 2004 08:48:57 +0100
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
>
> > Try
> >         ./install.sh --nodeps
> >
> > At 08:32 05/10/2004, you wrote:
> > >How to solve this problem :-( ?
> > >
> > >----- Original Message -----
> > >From: BG Mahesh <bg.mahesh@INDIAINFO.COM>
> > >Date:         Fri, 1 Oct 2004 16:09:52 +0530
> > >To: MAILSCANNER@JISCMAIL.AC.UK
> > >Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
> > >
> > > > hi
> > > >
> > > > I am not able to install MS 4.34.8-1. The error message I get is,
> > > >
> > > > Installing tnef decoder
> > > > Preparing...                ###########################################
> > > [100%]
> > > >         package tnef-1.2.3.1-1 is already installed
> > > >
> > > > Now to install MailScanner itself.
> > > >
> > > > error: Failed dependencies:
> > > >         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> > > perl-MIME-tools-5.413-1
> > > >
> > > > My setup
> > > >
> > > > Redhat Linux
> > > > Perl 5.8.3
> > > > MIME::QuotedPrint   : 3.03
> > > > MIME::Tools         : 5.413
> > > > MIME::Base64        : 3.03
> > > >
> > > > What am I doing wrong?
> > > >
> > > > --
> > > > B.G. Mahesh
> > > > bg.mahesh@indiainfo.com
> > > > http://www.indiainfo.com/
> > > >
> > > > --
> > > > ______________________________________________
> > > > IndiaInfo Mail - the free e-mail service with a difference!
> > > www.indiainfo.com
> > > > Check out our value-added Premium features, such as an extra 20MB for
> > > mail storage, POP3, e-mail forwarding, and ads-free mailboxes!
> > > >
> > > > Powered by Outblaze
> > > >
> > > > ------------------------ MailScanner list ------------------------
> > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > > 'leave mailscanner' in the body of the email.
> > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > >
> > >
> > >
> > >--
> > >B.G. Mahesh
> > >bg.mahesh@indiainfo.com
> > >http://www.indiainfo.com/
> > >
> > >--
> > >______________________________________________
> > >IndiaInfo Mail - the free e-mail service with a difference!
> www.indiainfo.com
> > >Check out our value-added Premium features, such as an extra 20MB for mail
> > >storage, POP3, e-mail forwarding, and ads-free mailboxes!
> > >
> > >Powered by Outblaze
> > >
> > >------------------------ MailScanner list ------------------------
> > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > >'leave mailscanner' in the body of the email.
> > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>
>--
>B.G. Mahesh
>bg.mahesh@indiainfo.com
>http://www.indiainfo.com/
>
>--
>______________________________________________
>IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
>Check out our value-added Premium features, such as an extra 20MB for mail
>storage, POP3, e-mail forwarding, and ads-free mailboxes!
>
>Powered by Outblaze
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 10:25:44 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3112.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Please can you try 4.34.8-2 which is available from

RedHat:
www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz

SuSE:
www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-2.suse.tar.gz

Others:
www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-2.tar.gz

I have removed the MIME::QuotedPrint dependency, and made the MIME::Base64
dependency more strict instead.

At 07:28 06/10/2004, you wrote:
>% ./install.sh ignore-perl --nodeps
>
>Installing tnef decoder
>
>Preparing...                ########################################### [100%]
>         package tnef-1.2.3.1-1 is already installed
>
>Now to install MailScanner itself.
>
>error: Failed dependencies:
>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> perl-MIME-tools-5.413-1
>
>----- Original Message -----
>From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>Date:         Tue, 5 Oct 2004 08:48:57 +0100
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
>
> > Try
> >         ./install.sh --nodeps
> >
> > At 08:32 05/10/2004, you wrote:
> > >How to solve this problem :-( ?
> > >
> > >----- Original Message -----
> > >From: BG Mahesh <bg.mahesh@INDIAINFO.COM>
> > >Date:         Fri, 1 Oct 2004 16:09:52 +0530
> > >To: MAILSCANNER@JISCMAIL.AC.UK
> > >Subject: Installation problems with MS 4.34.8-1/MIME::QuotedPrint
> > >
> > > > hi
> > > >
> > > > I am not able to install MS 4.34.8-1. The error message I get is,
> > > >
> > > > Installing tnef decoder
> > > > Preparing...                ###########################################
> > > [100%]
> > > >         package tnef-1.2.3.1-1 is already installed
> > > >
> > > > Now to install MailScanner itself.
> > > >
> > > > error: Failed dependencies:
> > > >         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> > > perl-MIME-tools-5.413-1
> > > >
> > > > My setup
> > > >
> > > > Redhat Linux
> > > > Perl 5.8.3
> > > > MIME::QuotedPrint   : 3.03
> > > > MIME::Tools         : 5.413
> > > > MIME::Base64        : 3.03
> > > >
> > > > What am I doing wrong?
> > > >
> > > > --
> > > > B.G. Mahesh
> > > > bg.mahesh@indiainfo.com
> > > > http://www.indiainfo.com/
> > > >
> > > > --
> > > > ______________________________________________
> > > > IndiaInfo Mail - the free e-mail service with a difference!
> > > www.indiainfo.com
> > > > Check out our value-added Premium features, such as an extra 20MB for
> > > mail storage, POP3, e-mail forwarding, and ads-free mailboxes!
> > > >
> > > > Powered by Outblaze
> > > >
> > > > ------------------------ MailScanner list ------------------------
> > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > > 'leave mailscanner' in the body of the email.
> > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > >
> > >
> > >
> > >--
> > >B.G. Mahesh
> > >bg.mahesh@indiainfo.com
> > >http://www.indiainfo.com/
> > >
> > >--
> > >______________________________________________
> > >IndiaInfo Mail - the free e-mail service with a difference!
> www.indiainfo.com
> > >Check out our value-added Premium features, such as an extra 20MB for mail
> > >storage, POP3, e-mail forwarding, and ads-free mailboxes!
> > >
> > >Powered by Outblaze
> > >
> > >------------------------ MailScanner list ------------------------
> > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > >'leave mailscanner' in the body of the email.
> > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>
>--
>B.G. Mahesh
>bg.mahesh@indiainfo.com
>http://www.indiainfo.com/
>
>--
>______________________________________________
>IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
>Check out our value-added Premium features, such as an extra 20MB for mail
>storage, POP3, e-mail forwarding, and ads-free mailboxes!
>
>Powered by Outblaze
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcin.rozek at IOS.EDU.PL  Wed Oct  6 10:27:20 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Ro¿ek)
Date: Thu Jan 12 21:27:09 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3113.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Boulytchev, Vasiliy wrote:
> Is it just some systems having issues?  This is on Mandrake 10.0
I had the same issue on Mandrake. Workaround is to remove -n from brp-compress
(as already mentioned), install from cpan all perl modules that doesn't want to
--rebuild and then install with --nodeps --force the rest that builds but
complain about rpm's dependences.
After that MS works fine (with sophossavi, clamavmodule and spamassasin 3)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcin.rozek at IOS.EDU.PL  Wed Oct  6 11:52:17 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Ro¿ek)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3114.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:
> Please can you try 4.34.8-2 which is available from
>
> RedHat:
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz
Still no luck...


Attempting to build and install perl-MIME-Base64-3.03-1
Instalacja perl-MIME-Base64-3.03-1.src.rpm
Wykonywanie(%prep): /bin/sh -e /var/tmp/rpm-tmp.68280
+ umask 022
+ cd /usr/src/RPM/BUILD
+ cd /usr/src/RPM/BUILD
+ rm -rf MIME-Base64-3.03
+ /usr/bin/gzip -dc /usr/src/RPM/SOURCES/MIME-Base64-3.03.tar.gz
+ tar -xf -
+ STATUS=0
+ '[' 0 -ne 0 ']'
+ cd MIME-Base64-3.03
+ exit 0
Wykonywanie(%build): /bin/sh -e /var/tmp/rpm-tmp.68280
+ umask 022
+ cd /usr/src/RPM/BUILD
+ cd MIME-Base64-3.03
+ CFLAGS=-O2 -fomit-frame-pointer -pipe -march=i586 -mcpu=pentiumpro
+ perl Makefile.PL PREFIX=/var/tmp/perl-MIME-Base64-root/usr
Checking if your kit is complete...
Looks good
Writing Makefile for MIME::Base64
+ make
cp QuotedPrint.pm blib/lib/MIME/QuotedPrint.pm
cp Base64.pm blib/lib/MIME/Base64.pm
/usr/bin/perl5.8.3 /usr/lib/perl5/5.8.3/ExtUtils/xsubpp  -typemap
/usr/lib/perl5/5.8.3/ExtUtils/typemap  Base64.xs > Base64.xsc && mv Base64.xsc
Base64.c
gcc -c   -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -fno-strict-aliasing
-I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
-I/usr/include/gdbm -O2 -fomit-frame-pointer -pipe -march=i586 -mcpu=pentiumpro
   -DVERSION=\"3.03\" -DXS_VERSION=\"3.03\" -fPIC
"-I/usr/lib/perl5/5.8.3/i386-linux-thread-multi/CORE"   Base64.c
Running Mkbootstrap for MIME::Base64 ()
chmod 644 Base64.bs
rm -f blib/arch/auto/MIME/Base64/Base64.so
LD_RUN_PATH="" gcc  -shared -L/usr/local/lib Base64.o  -o
blib/arch/auto/MIME/Base64/Base64.so
chmod 755 blib/arch/auto/MIME/Base64/Base64.so
cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs
chmod 644 blib/arch/auto/MIME/Base64/Base64.bs
cp decode-qp blib/script/decode-qp
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-qp
cp encode-qp blib/script/encode-qp
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-qp
cp decode-base64 blib/script/decode-base64
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-base64
cp encode-base64 blib/script/encode-base64
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-base64
Manifying blib/man3/MIME::QuotedPrint.3pm
Manifying blib/man3/MIME::Base64.3pm
+ make test
Running Mkbootstrap for MIME::Base64 ()
chmod 644 Base64.bs
rm -f blib/arch/auto/MIME/Base64/Base64.so
LD_RUN_PATH="" gcc  -shared -L/usr/local/lib Base64.o  -o
blib/arch/auto/MIME/Base64/Base64.so
chmod 755 blib/arch/auto/MIME/Base64/Base64.so
cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs
chmod 644 blib/arch/auto/MIME/Base64/Base64.bs
cp decode-qp blib/script/decode-qp
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-qp
cp encode-qp blib/script/encode-qp
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-qp
cp decode-base64 blib/script/decode-base64
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-base64
PERL_DL_NONLAZY=1 /usr/bin/perl5.8.3 "-MExtUtils::Command::MM" "-e"
"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/bad-sv..........skipped
         all skipped: Perl::API needed for this test
t/base64..........ok
t/quoted-print....ok
t/unicode.........ok
t/warn............ok
All tests successful, 1 test skipped.
Files=5, Tests=339,  1 wallclock secs ( 0.26 cusr +  0.07 csys =  0.33 CPU)
+ exit 0
Wykonywanie(%install): /bin/sh -e /var/tmp/rpm-tmp.92698
+ umask 022
+ cd /usr/src/RPM/BUILD
+ cd MIME-Base64-3.03
+ rm -rf /var/tmp/perl-MIME-Base64-root
++ perl -V:installarchlib
+ eval 'installarchlib='\''/usr/lib/perl5/5.8.3/i386-linux-thread-multi'\'';'
++ installarchlib=/usr/lib/perl5/5.8.3/i386-linux-thread-multi
+ mkdir -p
/var/tmp/perl-MIME-Base64-root//usr/lib/perl5/5.8.3/i386-linux-thread-multi
+ make install
Running Mkbootstrap for MIME::Base64 ()
chmod 644 Base64.bs
rm -f blib/arch/auto/MIME/Base64/Base64.so
LD_RUN_PATH="" gcc  -shared -L/usr/local/lib Base64.o  -o
blib/arch/auto/MIME/Base64/Base64.so
chmod 755 blib/arch/auto/MIME/Base64/Base64.so
cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs
chmod 644 blib/arch/auto/MIME/Base64/Base64.bs
cp decode-qp blib/script/decode-qp
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-qp
cp encode-qp blib/script/encode-qp
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-qp
cp decode-base64 blib/script/decode-base64
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-base64
cp encode-base64 blib/script/encode-base64
/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-base64
Installing
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.so
Installing
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
Files found in blib/arch: installing files in blib/lib into architecture
dependent library tree
Installing
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/QuotedPrint.pm
Installing
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/Base64.pm
Installing /var/tmp/perl-MIME-Base64-root/usr/share/man/man3/MIME::QuotedPrint.3pm
Installing /var/tmp/perl-MIME-Base64-root/usr/share/man/man3/MIME::Base64.3pm
Installing /var/tmp/perl-MIME-Base64-root/usr/bin/decode-qp
Installing /var/tmp/perl-MIME-Base64-root/usr/bin/encode-qp
Installing /var/tmp/perl-MIME-Base64-root/usr/bin/decode-base64
Installing /var/tmp/perl-MIME-Base64-root/usr/bin/encode-base64
Writing
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/.packlist
Appending installation info to
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/perllocal.pod
+ '[' -x /usr/lib/rpm/brp-compress ']'
+ /usr/lib/rpm/brp-compress
+ find /var/tmp/perl-MIME-Base64-root/usr -type f -print
+ sed 's@^/var/tmp/perl-MIME-Base64-root@@g'
+ grep -v perllocal.pod
+ grep -v '\.packlist'
++ cat MIME-Base64-3.03-filelist
+ '[' '/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.so
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/QuotedPrint.pm
/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/Base64.pm
/usr/share/man/man3/MIME::Base64.3pm.bz2
/usr/share/man/man3/MIME::QuotedPrint.3pm.bz2
/usr/bin/decode-qp
/usr/bin/encode-qp
/usr/bin/decode-base64
/usr/bin/encode-base64X' = X ']'
+ /usr/lib/rpm/brp-mandrake
Cleaning files...done
Compressing files...done
Stripping files...done
Relativisation of symlinks...done
Clean perl...done
Building libraries symlinks...done
Processing files: perl-MIME-Base64-3.03-1
error: File not found:
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs


RPM build errors:
     File not found:
/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs



Missing file /usr/src/RPM/RPMS/i386/perl-MIME-Base64-3.03-1.i386.rpm.
Maybe it did not build correctly?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 12:04:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3115.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In which case you're going to have to install it from CPAN instead. It's
only MIME::Base64 which you'll have to do that way. It's installing the
file in the right place but then some other bit of the RPM building process
is sitting on it.

At 11:52 06/10/2004, you wrote:
>Julian Field wrote:
>>Please can you try 4.34.8-2 which is available from
>>
>>RedHat:
>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz
>Still no luck...
>
>
>Attempting to build and install perl-MIME-Base64-3.03-1
>Instalacja perl-MIME-Base64-3.03-1.src.rpm
>Wykonywanie(%prep): /bin/sh -e /var/tmp/rpm-tmp.68280
>+ umask 022
>+ cd /usr/src/RPM/BUILD
>+ cd /usr/src/RPM/BUILD
>+ rm -rf MIME-Base64-3.03
>+ /usr/bin/gzip -dc /usr/src/RPM/SOURCES/MIME-Base64-3.03.tar.gz
>+ tar -xf -
>+ STATUS=0
>+ '[' 0 -ne 0 ']'
>+ cd MIME-Base64-3.03
>+ exit 0
>Wykonywanie(%build): /bin/sh -e /var/tmp/rpm-tmp.68280
>+ umask 022
>+ cd /usr/src/RPM/BUILD
>+ cd MIME-Base64-3.03
>+ CFLAGS=-O2 -fomit-frame-pointer -pipe -march=i586 -mcpu=pentiumpro
>+ perl Makefile.PL PREFIX=/var/tmp/perl-MIME-Base64-root/usr
>Checking if your kit is complete...
>Looks good
>Writing Makefile for MIME::Base64
>+ make
>cp QuotedPrint.pm blib/lib/MIME/QuotedPrint.pm
>cp Base64.pm blib/lib/MIME/Base64.pm
>/usr/bin/perl5.8.3 /usr/lib/perl5/5.8.3/ExtUtils/xsubpp  -typemap
>/usr/lib/perl5/5.8.3/ExtUtils/typemap  Base64.xs > Base64.xsc && mv Base64.xsc
>Base64.c
>gcc -c   -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -fno-strict-aliasing
>-I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64
>-I/usr/include/gdbm -O2 -fomit-frame-pointer -pipe -march=i586
>-mcpu=pentiumpro
>   -DVERSION=\"3.03\" -DXS_VERSION=\"3.03\" -fPIC
>"-I/usr/lib/perl5/5.8.3/i386-linux-thread-multi/CORE"   Base64.c
>Running Mkbootstrap for MIME::Base64 ()
>chmod 644 Base64.bs
>rm -f blib/arch/auto/MIME/Base64/Base64.so
>LD_RUN_PATH="" gcc  -shared -L/usr/local/lib Base64.o  -o
>blib/arch/auto/MIME/Base64/Base64.so
>chmod 755 blib/arch/auto/MIME/Base64/Base64.so
>cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs
>chmod 644 blib/arch/auto/MIME/Base64/Base64.bs
>cp decode-qp blib/script/decode-qp
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/decode-qp
>cp encode-qp blib/script/encode-qp
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/encode-qp
>cp decode-base64 blib/script/decode-base64
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/decode-base64
>cp encode-base64 blib/script/encode-base64
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/encode-base64
>Manifying blib/man3/MIME::QuotedPrint.3pm
>Manifying blib/man3/MIME::Base64.3pm
>+ make test
>Running Mkbootstrap for MIME::Base64 ()
>chmod 644 Base64.bs
>rm -f blib/arch/auto/MIME/Base64/Base64.so
>LD_RUN_PATH="" gcc  -shared -L/usr/local/lib Base64.o  -o
>blib/arch/auto/MIME/Base64/Base64.so
>chmod 755 blib/arch/auto/MIME/Base64/Base64.so
>cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs
>chmod 644 blib/arch/auto/MIME/Base64/Base64.bs
>cp decode-qp blib/script/decode-qp
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/decode-qp
>cp encode-qp blib/script/encode-qp
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/encode-qp
>cp decode-base64 blib/script/decode-base64
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/decode-base64
>PERL_DL_NONLAZY=1 /usr/bin/perl5.8.3 "-MExtUtils::Command::MM" "-e"
>"test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
>t/bad-sv..........skipped
>         all skipped: Perl::API needed for this test
>t/base64..........ok
>t/quoted-print....ok
>t/unicode.........ok
>t/warn............ok
>All tests successful, 1 test skipped.
>Files=5, Tests=339,  1 wallclock secs ( 0.26 cusr +  0.07 csys =  0.33 CPU)
>+ exit 0
>Wykonywanie(%install): /bin/sh -e /var/tmp/rpm-tmp.92698
>+ umask 022
>+ cd /usr/src/RPM/BUILD
>+ cd MIME-Base64-3.03
>+ rm -rf /var/tmp/perl-MIME-Base64-root
>++ perl -V:installarchlib
>+ eval 'installarchlib='\''/usr/lib/perl5/5.8.3/i386-linux-thread-multi'\'';'
>++ installarchlib=/usr/lib/perl5/5.8.3/i386-linux-thread-multi
>+ mkdir -p
>/var/tmp/perl-MIME-Base64-root//usr/lib/perl5/5.8.3/i386-linux-thread-multi
>+ make install
>Running Mkbootstrap for MIME::Base64 ()
>chmod 644 Base64.bs
>rm -f blib/arch/auto/MIME/Base64/Base64.so
>LD_RUN_PATH="" gcc  -shared -L/usr/local/lib Base64.o  -o
>blib/arch/auto/MIME/Base64/Base64.so
>chmod 755 blib/arch/auto/MIME/Base64/Base64.so
>cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs
>chmod 644 blib/arch/auto/MIME/Base64/Base64.bs
>cp decode-qp blib/script/decode-qp
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/decode-qp
>cp encode-qp blib/script/encode-qp
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/encode-qp
>cp decode-base64 blib/script/decode-base64
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/decode-base64
>cp encode-base64 blib/script/encode-base64
>/usr/bin/perl5.8.3 "-MExtUtils::MY" -e "MY->fixin(shift)"
>blib/script/encode-base64
>Installing
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.so
>Installing
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
>Files found in blib/arch: installing files in blib/lib into architecture
>dependent library tree
>Installing
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/QuotedPrint.pm
>Installing
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/Base64.pm
>Installing
>/var/tmp/perl-MIME-Base64-root/usr/share/man/man3/MIME::QuotedPrint.3pm
>Installing /var/tmp/perl-MIME-Base64-root/usr/share/man/man3/MIME::Base64.3pm
>Installing /var/tmp/perl-MIME-Base64-root/usr/bin/decode-qp
>Installing /var/tmp/perl-MIME-Base64-root/usr/bin/encode-qp
>Installing /var/tmp/perl-MIME-Base64-root/usr/bin/decode-base64
>Installing /var/tmp/perl-MIME-Base64-root/usr/bin/encode-base64
>Writing
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/.packlist
>Appending installation info to
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/perllocal.pod
>+ '[' -x /usr/lib/rpm/brp-compress ']'
>+ /usr/lib/rpm/brp-compress
>+ find /var/tmp/perl-MIME-Base64-root/usr -type f -print
>+ sed 's@^/var/tmp/perl-MIME-Base64-root@@g'
>+ grep -v perllocal.pod
>+ grep -v '\.packlist'
>++ cat MIME-Base64-3.03-filelist
>+ '[' '/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.so
>/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
>/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/QuotedPrint.pm
>/usr/lib/perl5/5.8.3/i386-linux-thread-multi/MIME/Base64.pm
>/usr/share/man/man3/MIME::Base64.3pm.bz2
>/usr/share/man/man3/MIME::QuotedPrint.3pm.bz2
>/usr/bin/decode-qp
>/usr/bin/encode-qp
>/usr/bin/decode-base64
>/usr/bin/encode-base64X' = X ']'
>+ /usr/lib/rpm/brp-mandrake
>Cleaning files...done
>Compressing files...done
>Stripping files...done
>Relativisation of symlinks...done
>Clean perl...done
>Building libraries symlinks...done
>Processing files: perl-MIME-Base64-3.03-1
>error: File not found:
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
>
>
>RPM build errors:
>     File not found:
>/var/tmp/perl-MIME-Base64-root/usr/lib/perl5/5.8.3/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
>
>
>
>Missing file /usr/src/RPM/RPMS/i386/perl-MIME-Base64-3.03-1.i386.rpm.
>Maybe it did not build correctly?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From bg.mahesh at INDIAINFO.COM  Wed Oct  6 12:57:23 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3116.1137101229.24926.mailscanner@lists.mailscanner.info>

Still doesn't works..

# pwd
/usr/local/src/MailScanner-4.34.8-2

Installing tnef decoder

Preparing...                ########################################### [100%]
        package tnef-1.2.3.1-1 is already installed

Now to install MailScanner itself.

error: Failed dependencies:
        perl(MIME::QuotedPrint) >= 3.03 is needed by (installed) perl-MIME-tools-5.413-2



----- Original Message -----
From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
Date:         Wed, 6 Oct 2004 10:25:44 +0100
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Please try this: Re: Installation problems with MS 4.34.8-1/MIME::QuotedPrint

> Please can you try 4.34.8-2 which is available from
>
> RedHat:
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz
>
> SuSE:
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-2.suse.tar.gz
>
> Others:
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-2.tar.gz
>
> I have removed the MIME::QuotedPrint dependency, and made the MIME::Base64
> dependency more strict instead.
>

--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 13:54:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3117.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Force it to uninstall MIME::Base64 and MIME-tools with
rpm -e --nodeps perl-MIME-Base64 perl-MIME-tools
then try again.

At 12:57 06/10/2004, you wrote:
>Still doesn't works..
>
># pwd
>/usr/local/src/MailScanner-4.34.8-2
>
>Installing tnef decoder
>
>Preparing...                ########################################### [100%]
>         package tnef-1.2.3.1-1 is already installed
>
>Now to install MailScanner itself.
>
>error: Failed dependencies:
>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
> perl-MIME-tools-5.413-2
>
>
>
>----- Original Message -----
>From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>Date:         Wed, 6 Oct 2004 10:25:44 +0100
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Please try this: Re: Installation problems with MS
>4.34.8-1/MIME::QuotedPrint
>
> > Please can you try 4.34.8-2 which is available from
> >
> > RedHat:
> >
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz
> >
> > SuSE:
> >
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-2.suse.tar.gz
> >
> > Others:
> >
> www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-2.tar.gz
> >
> > I have removed the MIME::QuotedPrint dependency, and made the MIME::Base64
> > dependency more strict instead.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From devonharding at gmail.com  Wed Oct  6 14:00:14 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:09 2006
Subject: End user quarantine?
Message-ID: <mailman.3118.1137101229.24926.mailscanner@lists.mailscanner.info>

Steve, has the Docs been completed yet?  Curious on how to Install.


On Mon, 4 Oct 2004 10:20:19 -0400, Devon Harding <devonharding@gmail.com> wrote:
> This looks to be really impressive.  Let us know when the INSTALL doc
> will be available or a quick version of the doc would be nice.
>
> -Devon
>
>
>
>
> On Sun, 3 Oct 2004 18:35:58 -0400, Steve Swaney <steve.swaney@fsl.com> wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > Behalf Of Devon Harding
> > > Sent: Sunday, October 03, 2004 5:41 PM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: End user quarantine?
> > >
> > > Is there an end user quarantine feature available for MailScanner?  I
> > > would like the users to get an email a few time per day summarizing
> > > all quarantine email with the ability to release them.  IronMail and
> > > MailFrontier both have this feature.
> > >
> > > Thanks,
> > >
> > > -Devon
> >
> > We have a client who paid us to develop just such scripts and has asked us
> > to release the code we developed as Open Source Software. They quarantine
> > all spam between x and y and then send each user a daily report of what the
> > have in quarantine.
> >
> > I haven't finished the installation directions (just to busy this week) but
> > if you're perl aware you can probably use these scripts with a little
> > modification.
> >
> > The application:
> >
> > 1. Sends email report once a day to any user who has spam in quarantine
> >
> > 2. Example format of this email report; for each quarantined email:
> >
> >         From:           email_address_of_sender
> >         Subject:                subject_line _of_email
> >         Click to view:  link_to_view
> >         Click to Release:       link_to_release
> >
> > 3. Links the spam emails to a web accessible directory with a ".web"
> > extension for viewing.
> >
> > 4. Enables a release link mechanism on the server
> >
> > 5. Can be installed with MailWatch but does not need MailWatch to operate.
> >
> > INSTALL instructions should be finished in a few days but if you can't wait:
> >
> >         http://www.fsl.com/support
> >
> > With many thanks to the IT staff at Douglas County Oregon, USA who worked
> > with us to develop the scripts. Credit is also due to Kevin Potter,
> > Information Technology Director at Douglas County who conceived of the
> > concept and wrote the original shell scripts.
> >
> > I'll post again when the Steve
> > Install instructions are complete.
> >
> > Steve Swaney
> > President
> > Fortress Systems Ltd.
> > www.fsl.com
> > steve.swaney@fsl.com
> >
> > --
> > This message has been scanned for viruses and
> > dangerous content by MailScanner, and is
> > believed to be clean.
> >
> > Fortress Systems Ltd.
> > www.fsl.com
> >
> >
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From xterm1 at TATORZ.COM  Wed Oct  6 14:01:35 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:09 2006
Subject: An FYI with wbel 3.0
Message-ID: <mailman.3119.1137101229.24926.mailscanner@lists.mailscanner.info>

        Just a little

        For your information.

        I recently installed WhiteBox 3.0, and before I did updates via up2date
        I installed Mailscanner. When I dd finally start updates, the packages
        MailScanner installs breaks dependencies in the newer perl packages!

        Other then that I commend all that work on MailScanner! it is one fine
        product

        Brian

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 14:32:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3120.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Sorry, now I realise where it is getting all this information from!

Please can you try 4.34.8-3 which is available from

RedHat:

www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-3.rpm.tar.gz

SuSE:

www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-3.suse.tar.gz

Others:

www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-3.tar.gz

At 13:54 06/10/2004, you wrote:
>Force it to uninstall MIME::Base64 and MIME-tools with
>rpm -e --nodeps perl-MIME-Base64 perl-MIME-tools
>then try again.
>
>At 12:57 06/10/2004, you wrote:
>>Still doesn't works..
>>
>># pwd
>>/usr/local/src/MailScanner-4.34.8-2
>>
>>Installing tnef decoder
>>
>>Preparing...                ###########################################
>>[100%]
>>         package tnef-1.2.3.1-1 is already installed
>>
>>Now to install MailScanner itself.
>>
>>error: Failed dependencies:
>>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
>>perl-MIME-tools-5.413-2
>>
>>
>>
>>----- Original Message -----
>>From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>>Date:         Wed, 6 Oct 2004 10:25:44 +0100
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Please try this: Re: Installation problems with MS
>>4.34.8-1/MIME::QuotedPrint
>>
>> > Please can you try 4.34.8-2 which is available from
>> >
>> > RedHat:
>> >
>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz
>> >
>> > SuSE:
>> >
>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-2.suse.tar.gz
>> >
>> > Others:
>> >
>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-2.tar.gz
>> >
>> > I have removed the MIME::QuotedPrint dependency, and made the MIME::Base64
>> > dependency more strict instead.
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From danslists at CONPOINT.COM  Wed Oct  6 14:34:25 2004
From: danslists at CONPOINT.COM (Dan Spray)
Date: Thu Jan 12 21:27:09 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3121.1137101229.24926.mailscanner@lists.mailscanner.info>

Okay, so now that I am back in the office, is there anyway to avoid having
all of the recipients whitelisted when just one of the recipients has
requested to be whitelisted?

Dan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Friday, October 01, 2004 10:04 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

At 15:26 01/10/2004, you wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > Behalf Of Julian Field
> > Sent: Friday, October 01, 2004 9:10 AM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Need clarification on whitelist rules
> >
> >
> > At 14:56 01/10/2004, you wrote:
> > > > -----Original Message-----
> > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > Behalf Of Julian Field
> > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: Need clarification on whitelist rules
> > > >
> > > >
> > ><snip>
> > > >
> > > > What you need is a Custom Function that edits the recipients
> > list in each
> > > > message, according to whether they want to be filtered or
> > not. I've done
> > > > something like this already, just haven't yet published it.
> > > >
> > > > What form would people like it in? Added to the per-user
> > white and black
> > > > list code?
> > > > It would have to be a simple "remove them from the message if
> > > > it's in their
> > > > blacklist or not in their whitelist".
> > > >
> > > > Can people see any problems with this? Something is nagging
> > me that this
> > > > isn't the correct functionality, but I can't see what the
> > right answer is
> > > > for definite.
> > > > --
> > >
> > >I guess my first question is how it's tagged as spam when there is a
rule
> > >file for the spam scoring settings? If user A tagges as spam
> > with a score of
> > >5.0 and user B tagges it with a score of 7.5 how does the message get
> > >tagged, since a score of 6.5 would flag as spam for user A and
> > ham for user
> > >B?
> >
> > We use it only for automatic spam deletion. In your example, user A
would
> > be removed from the list of recipients, and it would be normally
delivered
> > to user B. To use it for anything other than spam deletion is pretty
much
> > impossible.
> >
> > --
>
>Isn't this what you are proposing above?
>
> > > > It would have to be a simple "remove them from the message if
> > > > it's in their
> > > > blacklist or not in their whitelist".
>
>so if you handle the white/black listing here if it's spam and whitelisted
>don't remove them and if it's ham but blacklisted do remove them, or am I
>missing something?


>  I would think where every the per user scoring is checked
>if the whitelist/blacklist was checked as well it would simply adjust the
>actual tagging as spam or ham the same as the scoring based tagging would,
>the difference being if it scores as 6.5 and the user threshold is 7.5 but
>it's blacklisted it would be tagged as spam and not ham?

I don't understand that sentence at all, sorry.

>  I'm sorry if I am
>coming across dense just looking for a way to simplify the overall code
>changes

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jaearick at COLBY.EDU  Wed Oct  6 14:52:27 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:09 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3122.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have a production release of 3.0.0.  I have added a comment about
our issues with this to the bottom of bug 3494, and marked it "reopen".
We will see what happens.  They will probably need more info out of
anybody who has encountered this issue (ie, "MailScanner -v" output).

Jeff Earickson
Colby College

On Tue, 5 Oct 2004, Matt Kettler wrote:

> Date: Tue, 5 Oct 2004 15:14:24 -0400
> From: Matt Kettler <mkettler@EVI-INC.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: NO_DNS_FOR_FROM
>
> At 02:24 PM 10/5/2004, Jeff A. Earickson wrote:
>> I've noticed the same problem, my settings listed below.  I've done
>> some poking thru the SA 3.0 code to try and figure out what is going
>> on, but I don't really know what I'm looking at.  This smells like
>> a bug in SA 3.0; it worked in 2.64 for me.
>
> It would appear there was a bug, but Dan Q tried to fix it before releasing
> SA 3.0 final.
> http://bugzilla.spamassassin.org/show_bug.cgi?id=3494
>
> In which Dan Q tried to fix NO_DNS_FOR_FROM prior to 3.0's release.
>
> I'd double-check to make sure you've got a fully final copy of SA 3.0, not
> a release candidate.
>
> grep NO_DNS_FOR_FROM /usr/share/spamassassin/*.cf
>
> Should return these lines:
>
> 20_dnsbl_tests.cf:header NO_DNS_FOR_FROM
> eval:check_dns_sender()
> 20_dnsbl_tests.cf:describe NO_DNS_FOR_FROM      Envelope sender has no MX
> or A DNS records
> 20_dnsbl_tests.cf:tflags NO_DNS_FOR_FROM                net
> 30_text_de.cf:lang de describe NO_DNS_FOR_FROM Domain der Absendeadresse
> nicht im DNS registriert (kein MX/A Eintrag)
> 30_text_fr.cf:lang fr describe NO_DNS_FOR_FROM  Adresse From: inconnue en
> DNS (pas d'enregistrement MX)
> 30_text_nl.cf:lang nl describe NO_DNS_FOR_FROM                 Domein in
> Van heeft geen MX of A DNS record
> 30_text_pl.cf:lang pl describe NO_DNS_FOR_FROM
>
>
>
> If you see this line:
>
> 20_head_tests.cf header NO_DNS_FOR_FROM         eval:check_for_from_dns()
>
> You've got rules from an outdated release. I know the old code was in pre4
> and earlier, and not in rc3 and later, but I don't have copies of rc1 and
> rc2 on hand to check those.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 15:31:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3123.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Only if you are deleting it and not delivering it to the people who didn't
whitelist it.
For each recipient, you can either
1) whitelist and deliver it
2) delete it
Then it's easy, and I've done it before.

At 14:34 06/10/2004, you wrote:
>Okay, so now that I am back in the office, is there anyway to avoid having
>all of the recipients whitelisted when just one of the recipients has
>requested to be whitelisted?
>
>Dan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Friday, October 01, 2004 10:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Need clarification on whitelist rules
>
>At 15:26 01/10/2004, you wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Friday, October 01, 2004 9:10 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: Need clarification on whitelist rules
> > >
> > >
> > > At 14:56 01/10/2004, you wrote:
> > > > > -----Original Message-----
> > > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > Behalf Of Julian Field
> > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > Subject: Re: Need clarification on whitelist rules
> > > > >
> > > > >
> > > ><snip>
> > > > >
> > > > > What you need is a Custom Function that edits the recipients
> > > list in each
> > > > > message, according to whether they want to be filtered or
> > > not. I've done
> > > > > something like this already, just haven't yet published it.
> > > > >
> > > > > What form would people like it in? Added to the per-user
> > > white and black
> > > > > list code?
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their
> > > > > blacklist or not in their whitelist".
> > > > >
> > > > > Can people see any problems with this? Something is nagging
> > > me that this
> > > > > isn't the correct functionality, but I can't see what the
> > > right answer is
> > > > > for definite.
> > > > > --
> > > >
> > > >I guess my first question is how it's tagged as spam when there is a
>rule
> > > >file for the spam scoring settings? If user A tagges as spam
> > > with a score of
> > > >5.0 and user B tagges it with a score of 7.5 how does the message get
> > > >tagged, since a score of 6.5 would flag as spam for user A and
> > > ham for user
> > > >B?
> > >
> > > We use it only for automatic spam deletion. In your example, user A
>would
> > > be removed from the list of recipients, and it would be normally
>delivered
> > > to user B. To use it for anything other than spam deletion is pretty
>much
> > > impossible.
> > >
> > > --
> >
> >Isn't this what you are proposing above?
> >
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their
> > > > > blacklist or not in their whitelist".
> >
> >so if you handle the white/black listing here if it's spam and whitelisted
> >don't remove them and if it's ham but blacklisted do remove them, or am I
> >missing something?
>
>
> >  I would think where every the per user scoring is checked
> >if the whitelist/blacklist was checked as well it would simply adjust the
> >actual tagging as spam or ham the same as the scoring based tagging would,
> >the difference being if it scores as 6.5 and the user threshold is 7.5 but
> >it's blacklisted it would be tagged as spam and not ham?
>
>I don't understand that sentence at all, sorry.
>
> >  I'm sorry if I am
> >coming across dense just looking for a way to simplify the overall code
> >changes
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 15:34:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: An FYI with wbel 3.0
Message-ID: <mailman.3124.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What version did you install? In 4.34 I have done some more work recently
on the dependencies between MIME::QuotedPrint and MIME-tools, which have
been causing problems for the past couple of weeks or so. I haven't yet
published that new work, I'm having some testing done first.

At 14:01 06/10/2004, you wrote:
>         Just a little
>
>         For your information.
>
>         I recently installed WhiteBox 3.0, and before I did updates via
> up2date
>         I installed Mailscanner. When I dd finally start updates, the
> packages
>         MailScanner installs breaks dependencies in the newer perl packages!
>
>         Other then that I commend all that work on MailScanner! it is one
> fine
>         product
>
>         Brian

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct  6 15:38:59 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:09 2006
Subject: An FYI with wbel 3.0
Message-ID: <mailman.3125.1137101229.24926.mailscanner@lists.mailscanner.info>

>         Just a little
>
>         For your information.
>
>         I recently installed WhiteBox 3.0, and before I did updates
>         via up2date I installed Mailscanner. When I dd finally start
>         updates, the packages MailScanner installs breaks
> dependencies in the newer perl packages!
>
>         Other then that I commend all that work on
> MailScanner! it is one fine
>         product

FWIW we run MS on whitebox and have never seen any issues across multiple
installs.



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From xterm1 at TATORZ.COM  Wed Oct  6 15:46:19 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:09 2006
Subject: An FYI with wbel 3.0
Message-ID: <mailman.3126.1137101229.24926.mailscanner@lists.mailscanner.info>

   mailscanner-4.34.8-1

|-----Original Message-----
|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
|Behalf Of Julian Field
|Sent: Wednesday, October 06, 2004 10:34 AM
|To: MAILSCANNER@JISCMAIL.AC.UK
|Subject: Re: An FYI with wbel 3.0
|
|
|What version did you install? In 4.34 I have done some more work recently
|on the dependencies between MIME::QuotedPrint and MIME-tools, which have
|been causing problems for the past couple of weeks or so. I haven't yet
|published that new work, I'm having some testing done first.
|MailScanner thanks transtec Computers for their support.

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscan at PRIS.CA  Wed Oct  6 15:50:19 2004
From: mailscan at PRIS.CA (MailScanner Mailbox)
Date: Thu Jan 12 21:27:09 2006
Subject: tiff causing DOS message
Message-ID: <mailman.3127.1137101229.24926.mailscanner@lists.mailscanner.info>

Hello Julian

I changed the Virus Scanner Timeout from the default 300 to 450 and that
seem to have taken care of the problem.

Thanks

Rick

On Wed, 6 Oct 2004, Julian Field wrote:

> That will be it. I can't remember whether you can change the timeout in
> MailScanner.conf or not, it's something that people never normally need to
> tweak.
>
> At 21:36 05/10/2004, you wrote:
> >Hello Julian
> >
> >Scanning the file by itself produces the following output:
> >
> >----------- SCAN SUMMARY -----------
> >Known viruses: 24829
> >Scanned directories: 0
> >Scanned files: 1
> >Infected files: 0
> >Data scanned: 2.46 MB
> >I/O buffer size: 131072 bytes
> >Time: 103.994 sec (1 m 43 s)
> >
> >Now when I look at this, it took almost 2 minutes to scan the file, I'm
> >assuming that this is what is causing the DOS message. When I scan a file
> >of similar size it only takes a little over a 1/3 of the time.
> >
> >
> >----------- SCAN SUMMARY -----------
> >Known viruses: 24829
> >Scanned directories: 0
> >Scanned files: 1
> >Infected files: 0
> >Data scanned: 3.33 MB
> >I/O buffer size: 131072 bytes
> >Time: 28.532 sec (0 m 28 s)
> >
> >
> >So now that I think I know why its doing it, is there a way to prevent
> >this from happening.
> >
> >Thank you for the help
> >
> >Rick
> >
> >
> >On Tue, 5 Oct 2004, Julian Field wrote:
> >
> > > What happens when you try to scan the tif manually?
> > >
> > > At 23:32 04/10/2004, you wrote:
> > > >Hello
> > > >
> > > >We have a customer that is attempting to send a tif file that is a little
> > > >over 3.5 mb, when trying to send he receives the following error:
> > > >
> > > >The following e-mails were found to have: Virus Detected
> > > >
> > > >     Sender: xxxxxx@pris.bc.ca
> > > >IP Address: 64.114.126.175
> > > >  Recipient: xxxxxx@peacecountry.com
> > > >    Subject: '...are' sticker
> > > >  MessageID: i94Kea0D007039
> > > >     Report: Denial of Service attack in message!
> > > >             Denial of Service attack in message!
> > > >
> > > >
> > > >The interesting part of the df file is:
> > > >
> > > >--============_-1115191450==_============
> > > >Content-Type: text/plain; charset="us-ascii" ; format="flowed"
> > > >
> > > >hello doris & frances,
> > > >
> > > >please find the attached layout of the sticker that you requested.
> > > >
> > > >
> > > >thanks!
> > > >
> > > >jesh 250-782-6068
> > > >--============_-1115191450==_============
> > > >Content-Id: <a05200f00bd87873eaf3f@[192.168.0.102].0.0>
> > > >Content-Type: image/tiff; name="are.tif"
> > > >  ; x-mac-type="54494646"
> > > >  ; x-mac-creator="3842494D"
> > > >Content-Disposition: attachment; filename="are.tif"
> > > >Content-Transfer-Encoding: base64
> > > >
> > > >
> > > >I have looked as best I can but cannot find a reason for this, we are
> > > >running MS-4.33.3 with ClamAV-0.80rc2
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From danslists at CONPOINT.COM  Wed Oct  6 15:53:20 2004
From: danslists at CONPOINT.COM (Dan Spray)
Date: Thu Jan 12 21:27:09 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3128.1137101229.24926.mailscanner@lists.mailscanner.info>

That is the problem though.  I have a customer who has asked to be
whitelisted so I add them to the spam.whitelist.rules file.  Then a spam
message comes in and is addressed to 10 people, ONE of which is the customer
that wanted to be whitelisted.  The message however is declared whitelisted
and is delivered to all 10 people even though it is actually scored as spam.

Dan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, October 06, 2004 9:32 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

Only if you are deleting it and not delivering it to the people who didn't
whitelist it.
For each recipient, you can either
1) whitelist and deliver it
2) delete it
Then it's easy, and I've done it before.

At 14:34 06/10/2004, you wrote:
>Okay, so now that I am back in the office, is there anyway to avoid having
>all of the recipients whitelisted when just one of the recipients has
>requested to be whitelisted?
>
>Dan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Friday, October 01, 2004 10:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Need clarification on whitelist rules
>
>At 15:26 01/10/2004, you wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Friday, October 01, 2004 9:10 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: Need clarification on whitelist rules
> > >
> > >
> > > At 14:56 01/10/2004, you wrote:
> > > > > -----Original Message-----
> > > > > From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > Behalf Of Julian Field
> > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > Subject: Re: Need clarification on whitelist rules
> > > > >
> > > > >
> > > ><snip>
> > > > >
> > > > > What you need is a Custom Function that edits the recipients
> > > list in each
> > > > > message, according to whether they want to be filtered or
> > > not. I've done
> > > > > something like this already, just haven't yet published it.
> > > > >
> > > > > What form would people like it in? Added to the per-user
> > > white and black
> > > > > list code?
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their
> > > > > blacklist or not in their whitelist".
> > > > >
> > > > > Can people see any problems with this? Something is nagging
> > > me that this
> > > > > isn't the correct functionality, but I can't see what the
> > > right answer is
> > > > > for definite.
> > > > > --
> > > >
> > > >I guess my first question is how it's tagged as spam when there is a
>rule
> > > >file for the spam scoring settings? If user A tagges as spam
> > > with a score of
> > > >5.0 and user B tagges it with a score of 7.5 how does the message get
> > > >tagged, since a score of 6.5 would flag as spam for user A and
> > > ham for user
> > > >B?
> > >
> > > We use it only for automatic spam deletion. In your example, user A
>would
> > > be removed from the list of recipients, and it would be normally
>delivered
> > > to user B. To use it for anything other than spam deletion is pretty
>much
> > > impossible.
> > >
> > > --
> >
> >Isn't this what you are proposing above?
> >
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their
> > > > > blacklist or not in their whitelist".
> >
> >so if you handle the white/black listing here if it's spam and
whitelisted
> >don't remove them and if it's ham but blacklisted do remove them, or am I
> >missing something?
>
>
> >  I would think where every the per user scoring is checked
> >if the whitelist/blacklist was checked as well it would simply adjust the
> >actual tagging as spam or ham the same as the scoring based tagging
would,
> >the difference being if it scores as 6.5 and the user threshold is 7.5
but
> >it's blacklisted it would be tagged as spam and not ham?
>
>I don't understand that sentence at all, sorry.
>
> >  I'm sorry if I am
> >coming across dense just looking for a way to simplify the overall code
> >changes
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 16:08:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3129.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In which case put a Custom Function on "Is Definitely Not Spam" (i.e. the
spam whitelist) and use that to mess with the list of recipients of the
message. That might work.

At 15:53 06/10/2004, you wrote:
>That is the problem though.  I have a customer who has asked to be
>whitelisted so I add them to the spam.whitelist.rules file.  Then a spam
>message comes in and is addressed to 10 people, ONE of which is the customer
>that wanted to be whitelisted.  The message however is declared whitelisted
>and is delivered to all 10 people even though it is actually scored as spam.
>
>Dan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Wednesday, October 06, 2004 9:32 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Need clarification on whitelist rules
>
>Only if you are deleting it and not delivering it to the people who didn't
>whitelist it.
>For each recipient, you can either
>1) whitelist and deliver it
>2) delete it
>Then it's easy, and I've done it before.
>
>At 14:34 06/10/2004, you wrote:
> >Okay, so now that I am back in the office, is there anyway to avoid having
> >all of the recipients whitelisted when just one of the recipients has
> >requested to be whitelisted?
> >
> >Dan
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Friday, October 01, 2004 10:04 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Need clarification on whitelist rules
> >
> >At 15:26 01/10/2004, you wrote:
> > > > -----Original Message-----
> > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > Behalf Of Julian Field
> > > > Sent: Friday, October 01, 2004 9:10 AM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: Need clarification on whitelist rules
> > > >
> > > >
> > > > At 14:56 01/10/2004, you wrote:
> > > > > > -----Original Message-----
> > > > > > From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > > Behalf Of Julian Field
> > > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > > Subject: Re: Need clarification on whitelist rules
> > > > > >
> > > > > >
> > > > ><snip>
> > > > > >
> > > > > > What you need is a Custom Function that edits the recipients
> > > > list in each
> > > > > > message, according to whether they want to be filtered or
> > > > not. I've done
> > > > > > something like this already, just haven't yet published it.
> > > > > >
> > > > > > What form would people like it in? Added to the per-user
> > > > white and black
> > > > > > list code?
> > > > > > It would have to be a simple "remove them from the message if
> > > > > > it's in their
> > > > > > blacklist or not in their whitelist".
> > > > > >
> > > > > > Can people see any problems with this? Something is nagging
> > > > me that this
> > > > > > isn't the correct functionality, but I can't see what the
> > > > right answer is
> > > > > > for definite.
> > > > > > --
> > > > >
> > > > >I guess my first question is how it's tagged as spam when there is a
> >rule
> > > > >file for the spam scoring settings? If user A tagges as spam
> > > > with a score of
> > > > >5.0 and user B tagges it with a score of 7.5 how does the message get
> > > > >tagged, since a score of 6.5 would flag as spam for user A and
> > > > ham for user
> > > > >B?
> > > >
> > > > We use it only for automatic spam deletion. In your example, user A
> >would
> > > > be removed from the list of recipients, and it would be normally
> >delivered
> > > > to user B. To use it for anything other than spam deletion is pretty
> >much
> > > > impossible.
> > > >
> > > > --
> > >
> > >Isn't this what you are proposing above?
> > >
> > > > > > It would have to be a simple "remove them from the message if
> > > > > > it's in their
> > > > > > blacklist or not in their whitelist".
> > >
> > >so if you handle the white/black listing here if it's spam and
>whitelisted
> > >don't remove them and if it's ham but blacklisted do remove them, or am I
> > >missing something?
> >
> >
> > >  I would think where every the per user scoring is checked
> > >if the whitelist/blacklist was checked as well it would simply adjust the
> > >actual tagging as spam or ham the same as the scoring based tagging
>would,
> > >the difference being if it scores as 6.5 and the user threshold is 7.5
>but
> > >it's blacklisted it would be tagged as spam and not ham?
> >
> >I don't understand that sentence at all, sorry.
> >
> > >  I'm sorry if I am
> > >coming across dense just looking for a way to simplify the overall code
> > >changes
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >MailScanner thanks transtec Computers for their support
> >Buy the MailScanner book at www.MailScanner.info/store
> >
> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From randyf at SIBERNET.COM  Wed Oct  6 16:16:24 2004
From: randyf at SIBERNET.COM (Randy Fishel)
Date: Thu Jan 12 21:27:09 2006
Subject: tiff causing DOS message
Message-ID: <mailman.3130.1137101229.24926.mailscanner@lists.mailscanner.info>

  I have had a small flurry of DoS warnings recently, and took notice this
morning when a couple of automated notices were tagged as DoS attacks.
The log shows a sophossavi timeout, but scanning all the messages in
today's quarantine complete in 7 seconds.

  I am running MS4.33.3 and Sophossavi on Solaris.

-rf

On Wed, 6 Oct 2004, Julian Field wrote:

> That will be it. I can't remember whether you can change the timeout in
> MailScanner.conf or not, it's something that people never normally need to
> tweak.
>
> At 21:36 05/10/2004, you wrote:
> >Hello Julian
> >
> >Scanning the file by itself produces the following output:
> >
> >----------- SCAN SUMMARY -----------
> >Known viruses: 24829
> >Scanned directories: 0
> >Scanned files: 1
> >Infected files: 0
> >Data scanned: 2.46 MB
> >I/O buffer size: 131072 bytes
> >Time: 103.994 sec (1 m 43 s)
> >
> >Now when I look at this, it took almost 2 minutes to scan the file, I'm
> >assuming that this is what is causing the DOS message. When I scan a file
> >of similar size it only takes a little over a 1/3 of the time.
> >
> >
> >----------- SCAN SUMMARY -----------
> >Known viruses: 24829
> >Scanned directories: 0
> >Scanned files: 1
> >Infected files: 0
> >Data scanned: 3.33 MB
> >I/O buffer size: 131072 bytes
> >Time: 28.532 sec (0 m 28 s)
> >
> >
> >So now that I think I know why its doing it, is there a way to prevent
> >this from happening.
> >
> >Thank you for the help
> >
> >Rick
> >
> >
> >On Tue, 5 Oct 2004, Julian Field wrote:
> >
> > > What happens when you try to scan the tif manually?
> > >
> > > At 23:32 04/10/2004, you wrote:
> > > >Hello
> > > >
> > > >We have a customer that is attempting to send a tif file that is a little
> > > >over 3.5 mb, when trying to send he receives the following error:
> > > >
> > > >The following e-mails were found to have: Virus Detected
> > > >
> > > >     Sender: xxxxxx@pris.bc.ca
> > > >IP Address: 64.114.126.175
> > > >  Recipient: xxxxxx@peacecountry.com
> > > >    Subject: '...are' sticker
> > > >  MessageID: i94Kea0D007039
> > > >     Report: Denial of Service attack in message!
> > > >             Denial of Service attack in message!
> > > >
> > > >
> > > >The interesting part of the df file is:
> > > >
> > > >--============_-1115191450==_============
> > > >Content-Type: text/plain; charset="us-ascii" ; format="flowed"
> > > >
> > > >hello doris & frances,
> > > >
> > > >please find the attached layout of the sticker that you requested.
> > > >
> > > >
> > > >thanks!
> > > >
> > > >jesh 250-782-6068
> > > >--============_-1115191450==_============
> > > >Content-Id: <a05200f00bd87873eaf3f@[192.168.0.102].0.0>
> > > >Content-Type: image/tiff; name="are.tif"
> > > >  ; x-mac-type="54494646"
> > > >  ; x-mac-creator="3842494D"
> > > >Content-Disposition: attachment; filename="are.tif"
> > > >Content-Transfer-Encoding: base64
> > > >
> > > >
> > > >I have looked as best I can but cannot find a reason for this, we are
> > > >running MS-4.33.3 with ClamAV-0.80rc2
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From eric.sauvageau at gmail.com  Wed Oct  6 16:17:47 2004
From: eric.sauvageau at gmail.com (Eric Sauvageau)
Date: Thu Jan 12 21:27:09 2006
Subject: Disabling virus scanning but not spam checking?
Message-ID: <mailman.3131.1137101229.24926.mailscanner@lists.mailscanner.info>

Hi,

I have a few customers who only require the spam filtering but not the
virus checking.

I was hoping to be able to use a ruleset on the Virus Scanning option,
unfortunately this option disables ALL mail processing, and not just
virus scanning.

Any suggestion/code patch I could apply?

Having separate options to disable Virus Scanning and Disable All
Processing would probably be a good idea IMHO.

Thanks!

---
Eric

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Oct  6 16:26:39 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:09 2006
Subject: Envelope senders, SA and MailScanner  (& patch)
Message-ID: <mailman.3132.1137101229.24926.mailscanner@lists.mailscanner.info>

Julian

I applied this patch to a 4.34.8-1 system and re-started MailScanner but
am not seeing the EnvelopEFrom: header in the delivered messages. 

I have not followed the SA.pm code through in detail but was the
intention to only add this header to the copy of the message passed to
SpamAssassin?

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 04 October 2004 11:54
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Envelope senders, SA and MailScanner
>
>Well spotted.
>Attached is a patch to add this feature.
>
>At 11:00 04/10/2004, you wrote:
>>Hello all...
>>
>>In the recent SA 3.0.0 release announcement, I saw under 'Engine
>>Changes':
>>
>>   - Rules can now test the "MAIL FROM:" address used in the SMTP
>>     transaction if it was logged to the message headers using the
>>     "EnvelopeFrom" pseudo-header.  This allows rules such as 
>SPF to be
>>     applied.
>>
>>Does MailScanner support this? Does it automatically pass the envelope
>>sender (seeing as MS clearly knows it), or does this require some
>>further configuration?
>>
>>Just curious!
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From lists at NORCOMCABLE.CA  Wed Oct  6 16:27:03 2004
From: lists at NORCOMCABLE.CA (Dan)
Date: Thu Jan 12 21:27:09 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3133.1137101229.24926.mailscanner@lists.mailscanner.info>

I had this problem as well.
I assume you are using Sendmail.

Following this guide in the FAQ solved the problem for me.

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html

regards,
-dan


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dan Spray
Sent: October 6, 2004 9:53 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

That is the problem though.  I have a customer who has asked to be
whitelisted so I add them to the spam.whitelist.rules file.  Then a spam
message comes in and is addressed to 10 people, ONE of which is the customer
that wanted to be whitelisted.  The message however is declared whitelisted
and is delivered to all 10 people even though it is actually scored as spam.

Dan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, October 06, 2004 9:32 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

Only if you are deleting it and not delivering it to the people who didn't
whitelist it.
For each recipient, you can either
1) whitelist and deliver it
2) delete it
Then it's easy, and I've done it before.

At 14:34 06/10/2004, you wrote:
>Okay, so now that I am back in the office, is there anyway to avoid
>having all of the recipients whitelisted when just one of the
>recipients has requested to be whitelisted?
>
>Dan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Friday, October 01, 2004 10:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Need clarification on whitelist rules
>
>At 15:26 01/10/2004, you wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list
> > > [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Friday, October 01, 2004 9:10 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: Need clarification on whitelist rules
> > >
> > >
> > > At 14:56 01/10/2004, you wrote:
> > > > > -----Original Message-----
> > > > > From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > Behalf Of Julian Field
> > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > Subject: Re: Need clarification on whitelist rules
> > > > >
> > > > >
> > > ><snip>
> > > > >
> > > > > What you need is a Custom Function that edits the recipients
> > > list in each
> > > > > message, according to whether they want to be filtered or
> > > not. I've done
> > > > > something like this already, just haven't yet published it.
> > > > >
> > > > > What form would people like it in? Added to the per-user
> > > white and black
> > > > > list code?
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their blacklist or not in their whitelist".
> > > > >
> > > > > Can people see any problems with this? Something is nagging
> > > me that this
> > > > > isn't the correct functionality, but I can't see what the
> > > right answer is
> > > > > for definite.
> > > > > --
> > > >
> > > >I guess my first question is how it's tagged as spam when there
> > > >is a
>rule
> > > >file for the spam scoring settings? If user A tagges as spam
> > > with a score of
> > > >5.0 and user B tagges it with a score of 7.5 how does the message
> > > >get tagged, since a score of 6.5 would flag as spam for user A
> > > >and
> > > ham for user
> > > >B?
> > >
> > > We use it only for automatic spam deletion. In your example, user
> > > A
>would
> > > be removed from the list of recipients, and it would be normally
>delivered
> > > to user B. To use it for anything other than spam deletion is
> > > pretty
>much
> > > impossible.
> > >
> > > --
> >
> >Isn't this what you are proposing above?
> >
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their blacklist or not in their whitelist".
> >
> >so if you handle the white/black listing here if it's spam and
whitelisted
> >don't remove them and if it's ham but blacklisted do remove them, or
> >am I missing something?
>
>
> >  I would think where every the per user scoring is checked if the
> >whitelist/blacklist was checked as well it would simply adjust the
> >actual tagging as spam or ham the same as the scoring based tagging
would,
> >the difference being if it scores as 6.5 and the user threshold is
> >7.5
but
> >it's blacklisted it would be tagged as spam and not ham?
>
>I don't understand that sentence at all, sorry.
>
> >  I'm sorry if I am
> >coming across dense just looking for a way to simplify the overall
> >code changes
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support Buy the
>MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support Buy the MailScanner
book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 16:44:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: An FYI with wbel 3.0
Message-ID: <mailman.3134.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
If you want to try it out, change the 1 to a 3 in the URL and download it
again.
This has 1 important troublesome dependency removed, which you may find
helps quite a lot.

You will need to
rpm -e --nodeps perl-MIME-Base64 perl-MIME-tools
before you run the install.sh script.

At 15:46 06/10/2004, you wrote:
>    mailscanner-4.34.8-1
>
>|-----Original Message-----
>|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
>|Behalf Of Julian Field
>|Sent: Wednesday, October 06, 2004 10:34 AM
>|To: MAILSCANNER@JISCMAIL.AC.UK
>|Subject: Re: An FYI with wbel 3.0
>|
>|
>|What version did you install? In 4.34 I have done some more work recently
>|on the dependencies between MIME::QuotedPrint and MIME-tools, which have
>|been causing problems for the past couple of weeks or so. I haven't yet
>|published that new work, I'm having some testing done first.
>|MailScanner thanks transtec Computers for their support.
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.
>MailScanner thanks transtec Computers for their support.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Steve.Swaney at FSL.COM  Wed Oct  6 16:48:40 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:09 2006
Subject: QuarantineReport
Message-ID: <mailman.3135.1137101229.24926.mailscanner@lists.mailscanner.info>

I have finished the INSTALL documentation for QuarantineReport. The
application and the documentation may be downloaded from:

        http://www.fsl.com/support

QuarantineReport is a small application that's intended to:

* Create a daily report for each user who has messages in MailScanner
    Quarantine
* Quarantine Create a web link to view the message in Quarantine
* Provide a link to allow the user to release the message from Quarantine
* Email the report to the user

The report will contain this information for each message in Quarantine:

        From: address_of_sender
        Subject: subject_of message
        Link_to_View
        Link_to_Release

The application can also verify that recipient is a valid user by checking a
file or performing an LDAP search.

While these script are supplied as unsupported software. Please email me off
list if you find errors or have problems.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct  6 16:54:08 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:09 2006
Subject: {SPAM?} Re: Max Children
Message-ID: <mailman.3136.1137101229.24926.mailscanner@lists.mailscanner.info>

>>
> Doesn't adding {Spam?} to emails originating from within your
> company give the impression that your own users are sending spam?
If that is being added to the mails they might be :)



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From eric.sauvageau at gmail.com  Wed Oct  6 17:09:57 2004
From: eric.sauvageau at gmail.com (Eric Sauvageau)
Date: Thu Jan 12 21:27:09 2006
Subject: Disabling virus scanning but not spam checking?
Message-ID: <mailman.3137.1137101229.24926.mailscanner@lists.mailscanner.info>

Hi,

I'm using the Sept 1st release.  I finally went ahead and configured
everything, and it does work as expected indeed.  I got confused by
the (possibly outdated) comment in my config file:

# NOTE: This switch actually switches on/off all processing of the email
#       messages. If you just want to switch off actual virus scanning,
#       then set "Virus Scanners = none" instead.

Thanks!

---
Eric


On Wed, 06 Oct 2004 16:45:15 +0100, Julian Field
<mailscanner@ecs.soton.ac.uk> wrote:
> Use a newer MailScanner, and the control are more fine grained.
>
>
>
> At 16:17 06/10/2004, you wrote:
> >Hi,
> >
> >I have a few customers who only require the spam filtering but not the
> >virus checking.
> >
> >I was hoping to be able to use a ruleset on the Virus Scanning option,
> >unfortunately this option disables ALL mail processing, and not just
> >virus scanning.
> >
> >Any suggestion/code patch I could apply?
> >
> >Having separate options to disable Virus Scanning and Disable All
> >Processing would probably be a good idea IMHO.
> >
> >Thanks!
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Wed Oct  6 17:10:51 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:09 2006
Subject: autoupdate for generic?
Message-ID: <mailman.3138.1137101229.24926.mailscanner@lists.mailscanner.info>

Hi there,

i just installed the latest MailScanner-Version.

and now i found the following alongside with the other updates from the
virus-scanners:

Oct  6 18:05:00 mail update.virus.scanners: Running autoupdate for generic
Oct  6 18:05:00 mail Generic-autoupdate[4140]: Generic scanner
successfully updated


Where does this come from?

It says in the generic-autoupdate and -wrapper-script soemthing about own
virus-scanners..

but i never did one on my own..

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From admin at thenamegame.com  Wed Oct  6 17:24:18 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:09 2006
Subject: Auto-Whitelist growing
Message-ID: <mailman.3139.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
 namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
 name="country-region"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
 name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.emailstyle17
        {font-family:Arial;
        color:windowtext;}
span.EmailStyle18
        {mso-style-type:personal-reply;
        font-family:Arial;
        color:navy;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>There is no such option. Howcome there are
so many options missing from this file I mean we just upgraded and copied
rpmnew over the stop of the old so I would image the option should be there and
if not why not?<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p>&nbsp;</o:p></span></font></p>

<div>

<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>

<hr size=2 width="100%" align=center tabindex=-1>

</span></font></div>

<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> David While
[mailto:David.While@uce.ac.uk] <br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, October 06, 2004
4:27 AM<br>
<b><span style='font-weight:bold'>To:</span></b> admin@thenamegame.com<br>
<b><span style='font-weight:bold'>Subject:</span></b> RE: Auto-Whitelist
growing</span></font><o:p></o:p></p>

</div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p>&nbsp;</o:p></span></font></p>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Have you turned off the auto whitelisting feature in SpamAssassin? It
is on by default. <o:p></o:p></span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>&nbsp;<o:p></o:p></span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Set use_auto_whitelist 0 in spam.assassin.prefs.conf to turn it off.<o:p></o:p></span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>&nbsp;<o:p></o:p></span></font></p>

</div>

<div>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>David While<o:p></o:p></span></font></p>

</div>

<div>

<p class=MsoNormal><st1:place w:st="on"><st1:City w:st="on"><font size=3
  face="Times New Roman"><span style='font-size:12.0pt'>University of Central</span></font></st1:City>
 <st1:country-region w:st="on">England</st1:country-region></st1:place>.<o:p></o:p></p>

</div>

<blockquote style='margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>

<div>

<p class=MsoNormal style='margin-bottom:12.0pt'><font size=2
face="Times New Roman"><span style='font-size:10.0pt'>-----Original
Message----- <br>
<b><span style='font-weight:bold'>From:</span></b> MailScanner mailing
list&nbsp;on behalf of&nbsp;Michael Freeman <br>
<b><span style='font-weight:bold'>Sent:</span></b> Wed 06/10/2004 04:15 <br>
<b><span style='font-weight:bold'>To:</span></b> MAILSCANNER@JISCMAIL.AC.UK <br>
<b><span style='font-weight:bold'>Cc:</span></b> <br>
<b><span style='font-weight:bold'>Subject:</span></b> Auto-Whitelist growing</span></font><o:p></o:p></p>

</div>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Since upgrading to SA3.0 the auto-whitelist file is growing
by leaps and bound. Anyone know why?</span></font><o:p></o:p></p>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>&nbsp;<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>-rw-------&nbsp;&nbsp;&nbsp; 1 root&nbsp;&nbsp;&nbsp;&nbsp;
root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1290240 Oct&nbsp; 5 22:59 auto-whitelist</span></font><o:p></o:p></p>

<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>&nbsp;<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>This file is in the same directory as my bayes files. Why is
it being populated?</span></font><o:p></o:p></p>

</blockquote>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 17:24:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: An FYI with wbel 3.0
Message-ID: <mailman.3140.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Correction. This still isn't right. I have removed any mention of
MIME::QuotedPrint that I can find, but it hasn't had the slightest effect :-(

At 16:44 06/10/2004, you wrote:
>If you want to try it out, change the 1 to a 3 in the URL and download it
>again.
>This has 1 important troublesome dependency removed, which you may find
>helps quite a lot.
>
>You will need to
>rpm -e --nodeps perl-MIME-Base64 perl-MIME-tools
>before you run the install.sh script.
>
>At 15:46 06/10/2004, you wrote:
>>    mailscanner-4.34.8-1
>>
>>|-----Original Message-----
>>|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
>>|Behalf Of Julian Field
>>|Sent: Wednesday, October 06, 2004 10:34 AM
>>|To: MAILSCANNER@JISCMAIL.AC.UK
>>|Subject: Re: An FYI with wbel 3.0
>>|
>>|
>>|What version did you install? In 4.34 I have done some more work recently
>>|on the dependencies between MIME::QuotedPrint and MIME-tools, which have
>>|been causing problems for the past couple of weeks or so. I haven't yet
>>|published that new work, I'm having some testing done first.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sanjay.patel at REXWIRE.COM  Wed Oct  6 17:30:37 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:09 2006
Subject: MailScanner and Horde
Message-ID: <mailman.3141.1137101229.24926.mailscanner@lists.mailscanner.info>

The horde web mail component allows end users to take control of their own
spam issues including blacklisting and white listing.

I am certain it uses spamassassin in the backend for this. Has anyone tried
using MailScanner for the backend?

-Sanjay

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, October 06, 2004 12:25 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: An FYI with wbel 3.0

Correction. This still isn't right. I have removed any mention of
MIME::QuotedPrint that I can find, but it hasn't had the slightest effect
:-(

At 16:44 06/10/2004, you wrote:
>If you want to try it out, change the 1 to a 3 in the URL and download
>it again.
>This has 1 important troublesome dependency removed, which you may find
>helps quite a lot.
>
>You will need to
>rpm -e --nodeps perl-MIME-Base64 perl-MIME-tools before you run the
>install.sh script.
>
>At 15:46 06/10/2004, you wrote:
>>    mailscanner-4.34.8-1
>>
>>|-----Original Message-----
>>|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
>>|Behalf Of Julian Field
>>|Sent: Wednesday, October 06, 2004 10:34 AM
>>|To: MAILSCANNER@JISCMAIL.AC.UK
>>|Subject: Re: An FYI with wbel 3.0
>>|
>>|
>>|What version did you install? In 4.34 I have done some more work
>>|recently on the dependencies between MIME::QuotedPrint and
>>|MIME-tools, which have been causing problems for the past couple of
>>|weeks or so. I haven't yet published that new work, I'm having some
testing done first.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From alex at ERUS.CO.UK  Wed Oct  6 17:30:58 2004
From: alex at ERUS.CO.UK (Alex Pimperton)
Date: Thu Jan 12 21:27:09 2006
Subject: Max Children
Message-ID: <mailman.3142.1137101229.24926.mailscanner@lists.mailscanner.info>

I check for spam with my own mailscanner box (I'm not a company, and it
helps spot spammers, compromised hosts etc), but the one below me is out of
my control and currently all my mail passes through it.

Any ideas about my original problem?

Alex



-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dustin Baer
Sent: 06 October 2004 16:41
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: {SPAM?} Re: Max Children

Michele Neylon :: Blacknight Solutions wrote:

>>Alex,
>>
>>Why do you check for spam for email coming from your servers?
>>
>>X-Essex-MailScanner-SpamCheck: spam, SpamAssassin
>>(score=5.033, required 5,
>>                         autolearn=disabled, HTML_MESSAGE 0.00,
>>                         RM_hm_EmtyMsgid 0.32, SARE_BAYES_7x5 0.80,
>>                         SARE_BAYES_8x5 0.80, SARE_BAYES_9x5 1.20,
>>                         SARE_MSGID_EMPTY 1.67,
>>VBOUNCE2_BD_CHECKER 0.25)
>>X-Essex-MailScanner-SpamScore: sssss
>>X-MailScanner-From: alex@erus.co.uk
>>
>>Dustin
>>
>>
>
>Probably for the same reason that we do :)
>It's saved our bacon more than once!
>
Doesn't adding {Spam?} to emails originating from within your company
give the impression that your own users are sending spam?

Dustin
--
Dustin Baer
Transport Extranet Network Services
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Wed Oct  6 17:31:35 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:09 2006
Subject: MailScanner and Horde (please ignore previous e-mail)
Message-ID: <mailman.3143.1137101229.24926.mailscanner@lists.mailscanner.info>

The horde web mail component allows end users to take control of their own
spam issues including blacklisting and white listing.

I am certain it uses spamassassin in the backend for this. Has anyone tried
using MailScanner for the backend?

-Sanjay

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From JHuber at MICROSOURCE.COM  Wed Oct  6 17:32:54 2004
From: JHuber at MICROSOURCE.COM (Jeremy Huber)
Date: Thu Jan 12 21:27:09 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3144.1137101229.24926.mailscanner@lists.mailscanner.info>

I've got a case where our brand new server that I put MailScanner on is
just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2, MS
4.33.3, and SA 2.63 (I've turned off the virus scanning temporarily).
We only push somewhere around 50k messages a day through it, so I'm not
sure why it's so slow.  It almost always has hundreds of messages in the
inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
speed is usually around 600 bytes per second.  That seems insanely slow,
but I didn't what's "good."  I've got SA using DCC and Pyzor as well as
maybe 6 of the rulesets out of the rdj (one of which being the
blacklist).  Am I just making SA do too much, and that's why it's so
slow?

Thanks for any help you guys can give!

Jeremy

--
Jeremy Huber, SCSA, LCP
jhuber@microsource.com
Datacenter Engineer
Microsource, Inc

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From admin at thenamegame.com  Wed Oct  6 17:37:37 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:09 2006
Subject: I dont understand why we are still seeing bayes warnings
Message-ID: <mailman.3145.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:Arial;
        color:windowtext;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>We upgraded all of our bayes db&#8217;s to the new format
for SA3.0.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I just don&#8217;t understand why we are seeing these
messages sometimes;<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct&nbsp; 3 12:36:02 srv08 spamd[7436]: bayes: bayes db version 0
is not able to be used,&nbsp; <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>aborting! at
/usr/lib/perl5/site_perl/5.8.1/Mail/SpamAssassin/BayesStore/DBM.pm line 160.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If bayes db was not able to be used then why is the bayes db
not kicking out this warning everytime a message is autolearn=spam?<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Not even sure what bayes db verson 0 is.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From dean at SAHRA.ARIZONA.EDU  Wed Oct  6 17:45:39 2004
From: dean at SAHRA.ARIZONA.EDU (Dean Jones)
Date: Thu Jan 12 21:27:09 2006
Subject: Bayes rebuild
Message-ID: <mailman.3146.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hey everyone,

I had a quick question about SA 3 and mailscanner..

Should i do the Bayes rebuild from within MailScanner.conf or should i
do it seperately from cron?
How often should Bayes be rebuilt?

Advice that i received back in the SA 2.6 days suggested rebuilding
seperately from MailScanner to avoid a bug.

Any suggestions/ideas would be appreciated!
thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 17:54:36 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3147.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Okay, that was -3. Now I've created -4 which I have tested on a RHEL system
and it seems to be rather cleaner. Would you believe that when rpmbuild
constructs the dependency list, it actually looks at the "use" statements
in the Perl scripts and scrapes version numbers out of them! Yuch!
up2date -u on the RHEL box no longer complains about these modules.

RedHat:
www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-4.rpm.tar.gz

SuSE:
www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-4.suse.tar.gz

Others:
www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-4.tar.gz

At 14:32 06/10/2004, you wrote:
>Sorry, now I realise where it is getting all this information from!
>
>Please can you try 4.34.8-3 which is available from
>
>RedHat:
>
>www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-3.rpm.tar.gz
>
>SuSE:
>
>www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-3.suse.tar.gz
>
>Others:
>
>www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-3.tar.gz
>
>At 13:54 06/10/2004, you wrote:
>>Force it to uninstall MIME::Base64 and MIME-tools with
>>rpm -e --nodeps perl-MIME-Base64 perl-MIME-tools
>>then try again.
>>
>>At 12:57 06/10/2004, you wrote:
>>>Still doesn't works..
>>>
>>># pwd
>>>/usr/local/src/MailScanner-4.34.8-2
>>>
>>>Installing tnef decoder
>>>
>>>Preparing...                ###########################################
>>>[100%]
>>>         package tnef-1.2.3.1-1 is already installed
>>>
>>>Now to install MailScanner itself.
>>>
>>>error: Failed dependencies:
>>>         perl(MIME::QuotedPrint) >= 3.03 is needed by (installed)
>>>perl-MIME-tools-5.413-2
>>>
>>>
>>>
>>>----- Original Message -----
>>>From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
>>>Date:         Wed, 6 Oct 2004 10:25:44 +0100
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Please try this: Re: Installation problems with MS
>>>4.34.8-1/MIME::QuotedPrint
>>>
>>> > Please can you try 4.34.8-2 which is available from
>>> >
>>> > RedHat:
>>> >
>>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/rpm/MailScanner-4.34.8-2.rpm.tar.gz
>>> >
>>> > SuSE:
>>> >
>>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/suse/MailScanner-4.34.8-2.suse.tar.gz
>>> >
>>> > Others:
>>> >
>>>www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-2.tar.gz
>>> >
>>> > I have removed the MIME::QuotedPrint dependency, and made the
>>> MIME::Base64
>>> > dependency more strict instead.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ldg at TLS.NET  Wed Oct  6 17:56:19 2004
From: ldg at TLS.NET (Dave Goodrich)
Date: Thu Jan 12 21:27:09 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3148.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Jeremy Huber wrote:

> I've got a case where our brand new server that I put MailScanner on is
> just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2, MS
> 4.33.3, and SA 2.63 (I've turned off the virus scanning temporarily).
> We only push somewhere around 50k messages a day through it, so I'm not
> sure why it's so slow.  It almost always has hundreds of messages in the
> inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
> speed is usually around 600 bytes per second.  That seems insanely slow,
> but I didn't what's "good."  I've got SA using DCC and Pyzor as well as
> maybe 6 of the rulesets out of the rdj (one of which being the
> blacklist).  Am I just making SA do too much, and that's why it's so
> slow?
We are running FreeBSD 4.8 on a dual 1.8 ghz with 2GB ram and processing
60k+ messages a day inbound. I don't run spamassassin except for a very
small number of domains ( 2 of 250 ). MailScanner 4.41.6, also running
mailscannerMRTG. I never have more than 20 messages in the incoming
queue, no more than 11 copies of mailscanner running, load is around 1.

I would try turning off the SA dns checks, I've found them to be huge
load. I don't run them on any of my SA installs, I do use spamcop at the
smtp level.

DAve

>
> Thanks for any help you guys can give!
>
> Jeremy
>
> --
> Jeremy Huber, SCSA, LCP
> jhuber@microsource.com
> Datacenter Engineer
> Microsource, Inc
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

--
Systems Administrator
http://www.tls.net
Get rid of Unwanted Emails...get TLS Spam Blocker!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Wed Oct  6 17:59:13 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:09 2006
Subject: The Party Line on Bayes settings?
Message-ID: <mailman.3149.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian et. al,

Could you say a few words about the recommended settings for using
Bayes with SA 3.0 and the latest MailScanner?  I had the common
problem of bayes_toks.expire files piling up after upgrading to
SA 3.0.  I read thru the FAQ on Bayes lock files
(http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/303.html)
and followed this advice.  I used to have (with MS 4.33 and SA 2.64)
Rebuild Bayes Every = 86400, but I now use the factory default of
zero.  I have a cron job that runs the attached shell script once
a day, to learn spam/ham and do the force-expire/sync, which came
out of list posting months ago.

I'm getting to the point where I'm really wondering if I'm doing
Bayes correctly any more.  I'm sure I'm not the only one.  Maybe
Julian's wisdom on this could make it to the MAQ?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>


    [ Part 2, Application/OCTET-STREAM (Name: "bayes.learn")  1.6KB. ]
    [ Unable to print this part. ]


From mailscanner at ecs.soton.ac.uk  Wed Oct  6 18:00:19 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Disabling virus scanning but not spam checking?
Message-ID: <mailman.3150.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Fixed.

At 17:09 06/10/2004, you wrote:
>Hi,
>
>I'm using the Sept 1st release.  I finally went ahead and configured
>everything, and it does work as expected indeed.  I got confused by
>the (possibly outdated) comment in my config file:
>
># NOTE: This switch actually switches on/off all processing of the email
>#       messages. If you just want to switch off actual virus scanning,
>#       then set "Virus Scanners = none" instead.
>
>Thanks!
>
>---
>Eric
>
>
>On Wed, 06 Oct 2004 16:45:15 +0100, Julian Field
><mailscanner@ecs.soton.ac.uk> wrote:
> > Use a newer MailScanner, and the control are more fine grained.
> >
> >
> >
> > At 16:17 06/10/2004, you wrote:
> > >Hi,
> > >
> > >I have a few customers who only require the spam filtering but not the
> > >virus checking.
> > >
> > >I was hoping to be able to use a ruleset on the Virus Scanning option,
> > >unfortunately this option disables ALL mail processing, and not just
> > >virus scanning.
> > >
> > >Any suggestion/code patch I could apply?
> > >
> > >Having separate options to disable Virus Scanning and Disable All
> > >Processing would probably be a good idea IMHO.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 18:00:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: autoupdate for generic?
Message-ID: <mailman.3151.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:10 06/10/2004, you wrote:
>Hi there,
>
>i just installed the latest MailScanner-Version.
>
>and now i found the following alongside with the other updates from the
>virus-scanners:
>
>Oct  6 18:05:00 mail update.virus.scanners: Running autoupdate for generic
>Oct  6 18:05:00 mail Generic-autoupdate[4140]: Generic scanner
>successfully updated
>
>
>Where does this come from?
>
>It says in the generic-autoupdate and -wrapper-script soemthing about own
>virus-scanners..
>
>but i never did one on my own..

In which case the generic-autoupdate won't do anything. Don't worry about
it, just ignore it.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 18:01:48 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Auto-Whitelist growing
Message-ID: <mailman.3152.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html>
<body>
Most of the possible options are not put into the prefs files by the
SpamAssassin folks. You need to read the docs. &quot;man
Mail::SpamAssassin::Conf&quot; will tell you all the
possibilities.<br><br>
At 17:24 06/10/2004, you wrote:<br>
<blockquote type=cite class=cite cite=""><font face="arial" size=2 color="#000080">There
is no such option. Howcome there are so many options missing from this
file I mean we just upgraded and copied rpmnew over the stop of the old
so I would image the option should be there and if not why not?<br>
&nbsp;<br>
<hr>
<div align="center"></font></div>
<font face="tahoma" size=2><b>From:</b> David While
[<a href="mailto:David.While@uce.ac.uk" eudora="autourl">mailto:David.While@uce.ac.uk</a>]
<br>
<b>Sent:</b> Wednesday, October 06, 2004 4:27 AM<br>
<b>To:</b> admin@thenamegame.com<br>
<b>Subject:</b> RE: Auto-Whitelist growing<br>
</font><font face="Times New Roman, Times">&nbsp;<br>
Have you turned off the auto whitelisting feature in SpamAssassin? It is
on by default. <br>
&nbsp;<br>
Set use_auto_whitelist 0 in spam.assassin.prefs.conf to turn it
off.<br>
&nbsp;<br>
David While<br>
University of Central</font> England.<br>

<dl>
<dd><font face="Times New Roman, Times" size=2>-----Original Message-----
<br>

<dd>From:</b> MailScanner mailing list on behalf of Michael Freeman
<br>

<dd>Sent:</b> Wed 06/10/2004 04:15 <br>

<dd>To:</b> MAILSCANNER@JISCMAIL.AC.UK <br>

<dd>Cc:</b> <br>

<dd>Subject:</b> Auto-Whitelist growing<br>
</font>
<dd><font face="arial" size=2>Since upgrading to SA3.0 the auto-whitelist
file is growing by leaps and bound. Anyone know why?<br>
</font>
<dd><font face="Times New Roman, Times">&nbsp;<br>
</font>
<dd><font face="arial" size=2>-rw-------&nbsp;&nbsp;&nbsp; 1
root&nbsp;&nbsp;&nbsp;&nbsp; root&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1290240
Oct&nbsp; 5 22:59 auto-whitelist<br>
</font>
<dd><font face="Times New Roman, Times">&nbsp;<br>
</font>
<dd><font face="arial" size=2>This file is in the same directory as my
bayes files. Why is it being populated?<br>
</font><br>

</dl>------------------------ MailScanner list ------------------------
To unsubscribe, email
<a href="jiscmail@jiscmail.ac.htm">jiscmail@jiscmail.ac.uk</a> with the
words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ
(<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>
and the archives
(<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
------------------------ MailScanner list ------------------------ To
unsubscribe, email
<a href="jiscmail@jiscmail.ac.htm">jiscmail@jiscmail.ac.uk</a> with the
words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ
(<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>
and the archives
(<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</blockquote></body>
<br>
<div>-- </div>
<div>Julian Field</div>
<div><a href="http://www.mailscanner.info/" EUDORA=AUTOURL>www.MailScanner.info</a></div>
<div>Professional Support Services at
<a href="http://www.mailscanner.biz/" EUDORA=AUTOURL>www.MailScanner.biz</a></div>
<div>MailScanner thanks transtec Computers for their support</div>
<div>Buy the MailScanner book at
<a href="http://www.mailscanner.info/store" EUDORA=AUTOURL>www.MailScanner.info/store</a></div>
<br>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From jaearick at COLBY.EDU  Wed Oct  6 18:02:15 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:09 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3153.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Quick advice, run MailScanner in debug mode and see what happens.
I'll bet that it gets slow on DNS lookups.  It always helps to run
a caching DNS (stealth secondary) on your mail server.

Jeff Earickson
Colby College

On Wed, 6 Oct 2004, Jeremy Huber wrote:

> Date: Wed, 6 Oct 2004 10:32:54 -0600
> From: Jeremy Huber <JHuber@MICROSOURCE.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: How to find a slowdown?
>
> I've got a case where our brand new server that I put MailScanner on is
> just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2, MS
> 4.33.3, and SA 2.63 (I've turned off the virus scanning temporarily).
> We only push somewhere around 50k messages a day through it, so I'm not
> sure why it's so slow.  It almost always has hundreds of messages in the
> inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
> speed is usually around 600 bytes per second.  That seems insanely slow,
> but I didn't what's "good."  I've got SA using DCC and Pyzor as well as
> maybe 6 of the rulesets out of the rdj (one of which being the
> blacklist).  Am I just making SA do too much, and that's why it's so
> slow?
>
> Thanks for any help you guys can give!
>
> Jeremy
>
> --
> Jeremy Huber, SCSA, LCP
> jhuber@microsource.com
> Datacenter Engineer
> Microsource, Inc
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 18:04:55 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Envelope senders, SA and MailScanner  (& patch)
Message-ID: <mailman.3154.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:26 06/10/2004, you wrote:
>I applied this patch to a 4.34.8-1 system and re-started MailScanner but
>am not seeing the EnvelopEFrom: header in the delivered messages.

You won't, because...

>I have not followed the SA.pm code through in detail but was the
>intention to only add this header to the copy of the message passed to
>SpamAssassin?

Yes. I don't want to permanently add it to the message, MailScanner can
already do this with a customisable header anyway.

> >-----Original Message-----
> >From: MailScanner mailing list
> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> >Sent: 04 October 2004 11:54
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Envelope senders, SA and MailScanner
> >
> >Well spotted.
> >Attached is a patch to add this feature.
> >
> >At 11:00 04/10/2004, you wrote:
> >>Hello all...
> >>
> >>In the recent SA 3.0.0 release announcement, I saw under 'Engine
> >>Changes':
> >>
> >>   - Rules can now test the "MAIL FROM:" address used in the SMTP
> >>     transaction if it was logged to the message headers using the
> >>     "EnvelopeFrom" pseudo-header.  This allows rules such as
> >SPF to be
> >>     applied.
> >>
> >>Does MailScanner support this? Does it automatically pass the envelope
> >>sender (seeing as MS clearly knows it), or does this require some
> >>further configuration?
> >>
> >>Just curious!

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ssilva at SGVWATER.COM  Wed Oct  6 18:12:54 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:09 2006
Subject: Disabling virus scanning but not spam checking?
Message-ID: <mailman.3155.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Eric Sauvageau wrote:
| Hi,
|
| I have a few customers who only require the spam filtering but not the
| virus checking.
|
| I was hoping to be able to use a ruleset on the Virus Scanning option,
| unfortunately this option disables ALL mail processing, and not just
| virus scanning.
|
| Any suggestion/code patch I could apply?
|
| Having separate options to disable Virus Scanning and Disable All
| Processing would probably be a good idea IMHO.
"Virus Scanning = yes" and leave "Virus Scanners =" blank
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBZCeVRADw9lziUqQRAnMOAJ9Zmy63D9nE+ux3OTDdw47HAf6rLACeJqxV
45kuwBfqmNOD4hfzZuAsvns=
=eTRb
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From xterm1 at TATORZ.COM  Wed Oct  6 18:26:57 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3156.1137101229.24926.mailscanner@lists.mailscanner.info>

Julian
    I went ahead and did the ./install.sh on MailScanner-4.34.8-4

        Before I seen your post on rpm -e --nodeps ...
        As for the installation it went fine!

        up2date -u is also fixed!  Way to go!!


        Brian



|-----Original Message-----
|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
|Behalf Of Julian Field
|Sent: Wednesday, October 06, 2004 12:55 PM
|To: MAILSCANNER@JISCMAIL.AC.UK
|Subject: Re: Please try this: Re: Installation problems with MS
|4.34.8-1/MIME::QuotedPrint
|
|
|Okay, that was -3. Now I've created -4 which I have tested on a RHEL system
|and it seems to be rather cleaner. Would you believe that when rpmbuild
|constructs the dependency list, it actually looks at the "use" statements
|in the Perl scripts and scrapes version numbers out of them! Yuch!
|up2date -u on the RHEL box no longer complains about these modules.
|MailScanner thanks transtec Computers for their support.


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From derek at CSOLVE.NET  Wed Oct  6 18:29:58 2004
From: derek at CSOLVE.NET (Derek Buttineau | Compu-SOLVE)
Date: Thu Jan 12 21:27:09 2006
Subject: FreeBSD Installation Issue
Message-ID: <mailman.3157.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Okay, I'm having a rather strange problem here attempted to install
MailScanner from the latest FreeBSD port.. and I'm wonder if it's
perhaps just something I've missed in my dazed stupor!

It appears to me that the variables within my MailScanner.conf file
aren't being used by the program (though I have confirmed that the
config file is being parsed as it'll yell at me good if I duplicate any
of the entries, etc)  But the config values themselves are defaulting.
IE Incoming Mail Queue is defaulting to /var/spool/mqueue.in even though
I've changed it in the configuration file...

Some detail:

In my /usr/local/etc/MailScanner/MailScanner.conf file I have defined:

# Set location of incoming mail queue
#
# This can be any one of
# 1. A directory name
#    Example: /var/spool/mqueue.in
# 2. A wildcard giving directory names
#    Example: /var/spool/mqueue.in/*
# 3. The name of a file containing a list of directory names,
#    which can in turn contain wildcards.
#    Example: /usr/local/etc/MailScanner/mqueue.in.list.conf
#
Incoming Queue Dir = /var/spool/exim.ms/input

# Set location of outgoing mail queue.
# This can also be the filename of a ruleset.
Outgoing Queue Dir = /var/spool/exim/input

Yet when I try to start it I get:

In Debugging mode, not forking...
Can't use string ("/var/spool/mqueue.in") as an ARRAY ref while "strict
refs" in use at /usr/local/libexec/MailScanner/MailScanner line 915.


Note: I can get rid of the error by tweaking the perl code slightly.. ie
on line 915 changing:

 my @inqdirs = @{MailScanner::Config::Value('inqueuedir')};

To

 my @inqdirs = (MailScanner::Config::Value('inqueuedir');

But I don't really want to, and besides it doesn't address the fact that
it shouldn't be using that /var/spool/mqueue.in setting either :(


This is with the current port as well (4.33.3-1), hopefully it's
something simple.. otherwise I might wait for the next port to be
released or try and build it from source instead, but any suggestions
would be more than welcomed.

Thanks in advance. :)

--
Regards,

Derek Buttineau
Internet Systems Developer
Compu-SOLVE Internet Services
Compu-SOLVE Technologies Inc.

705.725.1212 x255

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct  6 18:36:19 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:09 2006
Subject: ANNOUNCE: MailScanner Stable 4.34.8 released
Message-ID: <mailman.3158.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian (looks like the previous message didn't go to the list),

I upgraded one of my servers to 4.34.8 and my filename.rules.conf got 
replaced by the one in the installation RPM.  No rpmnew or rpmsave...

Since I customized it with French comments, I was surprised to see 
English comments in emails sent to users...

Could you make sure this doesn't happen again?  I always look for rpmnew 
files after an upgrade, but I didn't I needed also to look at other 
files also.

I also had problems with perl-ExtUtils-MakeMaker-6.05-1:
le fichier /usr/share/man/man3/ExtUtils::testlib.3pm.gz de 
l'installation de perl-ExtUtils-MakeMaker-6.05-1 entre en conflit avec 
le fichier du paquetage perl-5.8.0-88.7

Sorry for the French error message.  It says that it is conflicting with 
my Perl 5.8 RPM...  I had to force install it.

Thanks again!

PS: Here is the output of MS -V on that server:
Running on
Linux smtpi1.usherbrooke.ca 2.4.21-15.0.4.EL #1 Sat Jul 31 01:33:50 EDT 
2004 i686 i686 i386 GNU/Linux
This is Red Hat Enterprise Linux AS release 3 (Taroon Update 3)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.03    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.00    Digest
1.01    Digest::HMAC
2.20    Digest::MD5
2.10    Digest::SHA1
missing Inline
missing Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
missing Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.31    URI

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mkettler at EVI-INC.COM  Wed Oct  6 18:36:54 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:09 2006
Subject: Bayes rebuild
Message-ID: <mailman.3159.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12:45 PM 10/6/2004, Dean Jones wrote:
>Should i do the Bayes rebuild from within MailScanner.conf or should i
>do it seperately from cron?

Either works. I generally do both, and treat the cronjob as a backup
measure. However, at Julian's request I've been running without the cronjob
to verify it also performs expiry when needed, and it does.

>How often should Bayes be rebuilt?

Daily, give or take a bit depending on your preference. I've done it every
hour as well, but that's really just a matter of how loaded your system is.

The rebuild will also force any journaling to sync, so if you're using SA's
bayes_learn_to_journal option you'll probably want to do it more frequently
so that the autolearn data gets folded back into the live bayes DB more
frequently. I'd say at least twice a day here.

I'd also advise disabling bayes autoexpire in your local.cf (can't do it in
spam.asssassin.prefs.conf).
         bayes_auto_expire 0

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ssilva at SGVWATER.COM  Wed Oct  6 18:37:04 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:09 2006
Subject: Disabling virus scanning but not spam checking?
Message-ID: <mailman.3160.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Scott Silva wrote:
| Eric Sauvageau wrote:
| | Hi,
| |
| | I have a few customers who only require the spam filtering but not the
| | virus checking.
| |
| | I was hoping to be able to use a ruleset on the Virus Scanning option,
| | unfortunately this option disables ALL mail processing, and not just
| | virus scanning.
| |
| | Any suggestion/code patch I could apply?
| |
| | Having separate options to disable Virus Scanning and Disable All
| | Processing would probably be a good idea IMHO.
| "Virus Scanning = yes" and leave "Virus Scanners =" blank
Sorry! Should be Virus Scanners = none
Where is the "Unsend" button!!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBZC1ARADw9lziUqQRAg+RAJ97/DRSTu9MKwuOkKEcs35D1AvWnACfYCMc
xAP6MyJTaDdKjR40zccWUGQ=
=RUgo
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 18:37:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3161.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At long last. I will update the downloads page. There's no need for anyone
already running -1 without any problems to upgrade to -4, so I won't
announce it.

At 18:26 06/10/2004, you wrote:
>Julian
>     I went ahead and did the ./install.sh on MailScanner-4.34.8-4
>
>         Before I seen your post on rpm -e --nodeps ...
>         As for the installation it went fine!
>
>         up2date -u is also fixed!  Way to go!!
>
>
>         Brian
>
>
>
>|-----Original Message-----
>|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
>|Behalf Of Julian Field
>|Sent: Wednesday, October 06, 2004 12:55 PM
>|To: MAILSCANNER@JISCMAIL.AC.UK
>|Subject: Re: Please try this: Re: Installation problems with MS
>|4.34.8-1/MIME::QuotedPrint
>|
>|
>|Okay, that was -3. Now I've created -4 which I have tested on a RHEL system
>|and it seems to be rather cleaner. Would you believe that when rpmbuild
>|constructs the dependency list, it actually looks at the "use" statements
>|in the Perl scripts and scrapes version numbers out of them! Yuch!
>|up2date -u on the RHEL box no longer complains about these modules.
>|MailScanner thanks transtec Computers for their support.
>
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.
>MailScanner thanks transtec Computers for their support.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Wed Oct  6 18:47:13 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:09 2006
Subject: Auto-Whitelist growing
Message-ID: <mailman.3162.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:58 AM 10/6/2004, Julian Field wrote:
>You need to turn off the auto_whitelist setting in
>spam.assassin.prefs.conf. For some reason, turning it off from the API
>doesn't appear to work any more. I might remove the MailScanner.conf option
>that does this.

Julian, does that work?

use_auto_whitelist  is an administrator setting, SA should refuse to honor
it in spam.assassin.prefs.conf if it is working correctly. It should only
honor it in local.cf.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 18:57:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: ANNOUNCE: MailScanner Stable 4.34.8 released
Message-ID: <mailman.3163.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Has anyone else seen this?

At 18:36 06/10/2004, you wrote:
>Julian (looks like the previous message didn't go to the list),
>
>I upgraded one of my servers to 4.34.8 and my filename.rules.conf got
>replaced by the one in the installation RPM.  No rpmnew or rpmsave...
>
>Since I customized it with French comments, I was surprised to see English
>comments in emails sent to users...
>
>Could you make sure this doesn't happen again?  I always look for rpmnew
>files after an upgrade, but I didn't I needed also to look at other files also.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 19:12:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:09 2006
Subject: The Party Line on Bayes settings?
Message-ID: <mailman.3164.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I don't know about al, but personally I haven't tried this yet. I'm just
letting SA do its expiry runs when it wants to. Doesn't seem to be
generating bayes_toks.expire files, so I'm going to leave it well alone.
No pearls of wisdom on this occasion, sorry :-)

At 17:59 06/10/2004, you wrote:
>Julian et. al,
>
>Could you say a few words about the recommended settings for using
>Bayes with SA 3.0 and the latest MailScanner?  I had the common
>problem of bayes_toks.expire files piling up after upgrading to
>SA 3.0.  I read thru the FAQ on Bayes lock files
>(http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/303.html)
>and followed this advice.  I used to have (with MS 4.33 and SA 2.64)
>Rebuild Bayes Every = 86400, but I now use the factory default of
>zero.  I have a cron job that runs the attached shell script once
>a day, to learn spam/ham and do the force-expire/sync, which came
>out of list posting months ago.
>
>I'm getting to the point where I'm really wondering if I'm doing
>Bayes correctly any more.  I'm sure I'm not the only one.  Maybe
>Julian's wisdom on this could make it to the MAQ?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct  6 19:23:14 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:09 2006
Subject: ANNOUNCE: MailScanner Stable 4.34.8 released
Message-ID: <mailman.3165.1137101229.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Denis Beauchemin wrote:

> I upgraded one of my servers to 4.34.8 and my filename.rules.conf got 
> replaced by the one in the installation RPM.  No rpmnew or rpmsave...
>
> Could you make sure this doesn't happen again?  I always look for 
> rpmnew files after an upgrade, but I didn't I needed also to look at 
> other files also.

Looks like it may have been my fault... I just installed on a new system 
and I now have a filename.rules.conf.rpmnew... :-/

>
> I also had problems with perl-ExtUtils-MakeMaker-6.05-1:
> le fichier /usr/share/man/man3/ExtUtils::testlib.3pm.gz de 
> l'installation de perl-ExtUtils-MakeMaker-6.05-1 entre en conflit avec 
> le fichier du paquetage perl-5.8.0-88.7
>
> Sorry for the French error message.  It says that it is conflicting 
> with my Perl 5.8 RPM...  I had to force install it. 


This one is still there.  I had to:
cd /usr/src/redhat/RPMS/noarch
rpm -Uvh --force perl-ExtUtils-MakeMaker-6.05-1.noarch.rpm

to install it...

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From xterm1 at TATORZ.COM  Wed Oct  6 19:38:06 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:09 2006
Subject: ANNOUNCE: MailScanner Stable 4.34.8 released
Message-ID: <mailman.3166.1137101229.24926.mailscanner@lists.mailscanner.info>

Julian
        On the version we had just used to fix up2date it did exactly that! Left my
Mailscanner.conf alone!

mailscanner-4.34.8-4


|-----Original Message-----
|From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
|Behalf Of Julian Field
|Sent: Wednesday, October 06, 2004 1:57 PM
|To: MAILSCANNER@JISCMAIL.AC.UK
|Subject: Re: ANNOUNCE: MailScanner Stable 4.34.8 released
|
|
|Has anyone else seen this?
|
|At 18:36 06/10/2004, you wrote:
|>Julian (looks like the previous message didn't go to the list),
|>
|>I upgraded one of my servers to 4.34.8 and my filename.rules.conf got
|>replaced by the one in the installation RPM.  No rpmnew or rpmsave...
|>
|>Since I customized it with French comments, I was surprised to see English
|>comments in emails sent to users...
|>
|>Could you make sure this doesn't happen again?  I always look for rpmnew
|>files after an upgrade, but I didn't I needed also to look at
|other files also.
|
|--
|Julian Field
|www.MailScanner.info
|Professional Support Services at www.MailScanner.biz
|MailScanner thanks transtec Computers for their support
|Buy the MailScanner book at www.MailScanner.info/store
|
|PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
|
|------------------------ MailScanner list ------------------------
|To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
|'leave mailscanner' in the body of the email.
|Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
|the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
|
|--
|This message has been scanned for viruses and
|dangerous content by MailScanner, and is
|believed to be clean.
|MailScanner thanks transtec Computers for their support.


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From eric.sauvageau at gmail.com  Wed Oct  6 19:40:10 2004
From: eric.sauvageau at gmail.com (Eric Sauvageau)
Date: Thu Jan 12 21:27:10 2006
Subject: Disabling virus scanning but not spam checking?
Message-ID: <mailman.3167.1137101229.24926.mailscanner@lists.mailscanner.info>

On Wed, 6 Oct 2004 10:37:04 -0700, Scott Silva <ssilva@sgvwater.com> wrote:
> | | I have a few customers who only require the spam filtering but not the
> | | virus checking.
> | |
> | | I was hoping to be able to use a ruleset on the Virus Scanning option,
> | | unfortunately this option disables ALL mail processing, and not just
> | | virus scanning.
> | |
> | | Any suggestion/code patch I could apply?
> | |
> | | Having separate options to disable Virus Scanning and Disable All
> | | Processing would probably be a good idea IMHO.
> | "Virus Scanning = yes" and leave "Virus Scanners =" blank
> Sorry! Should be Virus Scanners = none
> Where is the "Unsend" button!!

Wouldn't have worked.  I needed per-domain settings, and Virus
Scanners doesn't accept rulesets.

Virus Scanning = path/to/ruleset is working as expected, it was just
the .conf documentation that was leading to confusion - Julian
mentions in his reply that it's fixed now.


---
Eric

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From danslists at CONPOINT.COM  Wed Oct  6 19:44:31 2004
From: danslists at CONPOINT.COM (Dan Spray)
Date: Thu Jan 12 21:27:10 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3168.1137101230.24926.mailscanner@lists.mailscanner.info>

Okay, here is what I currently have in mailscanner.conf...

Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules

And here is what I have in my spam.whitelist.rules file...

FromOrTo:       default                                         no

#To
To:             dalder@conpoint.com                             no
To:             tdickie@conpoint.com                            yes
To:             randjnelson@conpoint.com                        yes

What else do I need?  I believe that I have this setup correctly but please
correct me if I am wrong.  With the above config I am seeing what I
described below.

Thanks for all your help with this,

Dan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, October 06, 2004 10:09 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

In which case put a Custom Function on "Is Definitely Not Spam" (i.e. the
spam whitelist) and use that to mess with the list of recipients of the
message. That might work.

At 15:53 06/10/2004, you wrote:
>That is the problem though.  I have a customer who has asked to be
>whitelisted so I add them to the spam.whitelist.rules file.  Then a spam
>message comes in and is addressed to 10 people, ONE of which is the
customer
>that wanted to be whitelisted.  The message however is declared whitelisted
>and is delivered to all 10 people even though it is actually scored as
spam.
>
>Dan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Wednesday, October 06, 2004 9:32 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Need clarification on whitelist rules
>
>Only if you are deleting it and not delivering it to the people who didn't
>whitelist it.
>For each recipient, you can either
>1) whitelist and deliver it
>2) delete it
>Then it's easy, and I've done it before.
>
>At 14:34 06/10/2004, you wrote:
> >Okay, so now that I am back in the office, is there anyway to avoid
having
> >all of the recipients whitelisted when just one of the recipients has
> >requested to be whitelisted?
> >
> >Dan
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Friday, October 01, 2004 10:04 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Need clarification on whitelist rules
> >
> >At 15:26 01/10/2004, you wrote:
> > > > -----Original Message-----
> > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > Behalf Of Julian Field
> > > > Sent: Friday, October 01, 2004 9:10 AM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: Need clarification on whitelist rules
> > > >
> > > >
> > > > At 14:56 01/10/2004, you wrote:
> > > > > > -----Original Message-----
> > > > > > From: MailScanner mailing list
>[mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > > Behalf Of Julian Field
> > > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > > Subject: Re: Need clarification on whitelist rules
> > > > > >
> > > > > >
> > > > ><snip>
> > > > > >
> > > > > > What you need is a Custom Function that edits the recipients
> > > > list in each
> > > > > > message, according to whether they want to be filtered or
> > > > not. I've done
> > > > > > something like this already, just haven't yet published it.
> > > > > >
> > > > > > What form would people like it in? Added to the per-user
> > > > white and black
> > > > > > list code?
> > > > > > It would have to be a simple "remove them from the message if
> > > > > > it's in their
> > > > > > blacklist or not in their whitelist".
> > > > > >
> > > > > > Can people see any problems with this? Something is nagging
> > > > me that this
> > > > > > isn't the correct functionality, but I can't see what the
> > > > right answer is
> > > > > > for definite.
> > > > > > --
> > > > >
> > > > >I guess my first question is how it's tagged as spam when there is
a
> >rule
> > > > >file for the spam scoring settings? If user A tagges as spam
> > > > with a score of
> > > > >5.0 and user B tagges it with a score of 7.5 how does the message
get
> > > > >tagged, since a score of 6.5 would flag as spam for user A and
> > > > ham for user
> > > > >B?
> > > >
> > > > We use it only for automatic spam deletion. In your example, user A
> >would
> > > > be removed from the list of recipients, and it would be normally
> >delivered
> > > > to user B. To use it for anything other than spam deletion is pretty
> >much
> > > > impossible.
> > > >
> > > > --
> > >
> > >Isn't this what you are proposing above?
> > >
> > > > > > It would have to be a simple "remove them from the message if
> > > > > > it's in their
> > > > > > blacklist or not in their whitelist".
> > >
> > >so if you handle the white/black listing here if it's spam and
>whitelisted
> > >don't remove them and if it's ham but blacklisted do remove them, or am
I
> > >missing something?
> >
> >
> > >  I would think where every the per user scoring is checked
> > >if the whitelist/blacklist was checked as well it would simply adjust
the
> > >actual tagging as spam or ham the same as the scoring based tagging
>would,
> > >the difference being if it scores as 6.5 and the user threshold is 7.5
>but
> > >it's blacklisted it would be tagged as spam and not ham?
> >
> >I don't understand that sentence at all, sorry.
> >
> > >  I'm sorry if I am
> > >coming across dense just looking for a way to simplify the overall code
> > >changes
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >MailScanner thanks transtec Computers for their support
> >Buy the MailScanner book at www.MailScanner.info/store
> >
> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From danslists at CONPOINT.COM  Wed Oct  6 19:51:06 2004
From: danslists at CONPOINT.COM (Dan Spray)
Date: Thu Jan 12 21:27:10 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3169.1137101230.24926.mailscanner@lists.mailscanner.info>

Thank you for the link.  This is exactly what is happening.  However, I am
using postfix not sendmail.  Anyone out there that has done the same thing
in postfix?

Dan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dan
Sent: Wednesday, October 06, 2004 10:27 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

I had this problem as well.
I assume you are using Sendmail.

Following this guide in the FAQ solved the problem for me.

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html

regards,
-dan


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dan Spray
Sent: October 6, 2004 9:53 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

That is the problem though.  I have a customer who has asked to be
whitelisted so I add them to the spam.whitelist.rules file.  Then a spam
message comes in and is addressed to 10 people, ONE of which is the customer
that wanted to be whitelisted.  The message however is declared whitelisted
and is delivered to all 10 people even though it is actually scored as spam.

Dan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Wednesday, October 06, 2004 9:32 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Need clarification on whitelist rules

Only if you are deleting it and not delivering it to the people who didn't
whitelist it.
For each recipient, you can either
1) whitelist and deliver it
2) delete it
Then it's easy, and I've done it before.

At 14:34 06/10/2004, you wrote:
>Okay, so now that I am back in the office, is there anyway to avoid
>having all of the recipients whitelisted when just one of the
>recipients has requested to be whitelisted?
>
>Dan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Friday, October 01, 2004 10:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Need clarification on whitelist rules
>
>At 15:26 01/10/2004, you wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list
> > > [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > Behalf Of Julian Field
> > > Sent: Friday, October 01, 2004 9:10 AM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: Need clarification on whitelist rules
> > >
> > >
> > > At 14:56 01/10/2004, you wrote:
> > > > > -----Original Message-----
> > > > > From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > Behalf Of Julian Field
> > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > Subject: Re: Need clarification on whitelist rules
> > > > >
> > > > >
> > > ><snip>
> > > > >
> > > > > What you need is a Custom Function that edits the recipients
> > > list in each
> > > > > message, according to whether they want to be filtered or
> > > not. I've done
> > > > > something like this already, just haven't yet published it.
> > > > >
> > > > > What form would people like it in? Added to the per-user
> > > white and black
> > > > > list code?
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their blacklist or not in their whitelist".
> > > > >
> > > > > Can people see any problems with this? Something is nagging
> > > me that this
> > > > > isn't the correct functionality, but I can't see what the
> > > right answer is
> > > > > for definite.
> > > > > --
> > > >
> > > >I guess my first question is how it's tagged as spam when there
> > > >is a
>rule
> > > >file for the spam scoring settings? If user A tagges as spam
> > > with a score of
> > > >5.0 and user B tagges it with a score of 7.5 how does the message
> > > >get tagged, since a score of 6.5 would flag as spam for user A
> > > >and
> > > ham for user
> > > >B?
> > >
> > > We use it only for automatic spam deletion. In your example, user
> > > A
>would
> > > be removed from the list of recipients, and it would be normally
>delivered
> > > to user B. To use it for anything other than spam deletion is
> > > pretty
>much
> > > impossible.
> > >
> > > --
> >
> >Isn't this what you are proposing above?
> >
> > > > > It would have to be a simple "remove them from the message if
> > > > > it's in their blacklist or not in their whitelist".
> >
> >so if you handle the white/black listing here if it's spam and
whitelisted
> >don't remove them and if it's ham but blacklisted do remove them, or
> >am I missing something?
>
>
> >  I would think where every the per user scoring is checked if the
> >whitelist/blacklist was checked as well it would simply adjust the
> >actual tagging as spam or ham the same as the scoring based tagging
would,
> >the difference being if it scores as 6.5 and the user threshold is
> >7.5
but
> >it's blacklisted it would be tagged as spam and not ham?
>
>I don't understand that sentence at all, sorry.
>
> >  I'm sorry if I am
> >coming across dense just looking for a way to simplify the overall
> >code changes
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support Buy the
>MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support Buy the MailScanner
book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ssilva at SGVWATER.COM  Wed Oct  6 19:51:26 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:10 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3170.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dan Spray wrote:
| Okay, here is what I currently have in mailscanner.conf...
|
| Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
|
| And here is what I have in my spam.whitelist.rules file...
|
| FromOrTo:       default                                         no
|
| #To
| To:             dalder@conpoint.com                             no
| To:             tdickie@conpoint.com                            yes
| To:             randjnelson@conpoint.com                        yes
|
| What else do I need?  I believe that I have this setup correctly but
please
| correct me if I am wrong.  With the above config I am seeing what I
| described below.
FromorTo:       default         no
should be last rule.
Default rules always go at the end.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBZD6uRADw9lziUqQRAlGwAJ9uFz2KgJICdVQc5kMWXO4p/ny3RwCdEQ37
2fmIfvgfqFEUD/IiMMOOGNw=
=x8ZK
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 20:06:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3171.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 19:51 06/10/2004, you wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Dan Spray wrote:
>| Okay, here is what I currently have in mailscanner.conf...
>|
>| Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
>|
>| And here is what I have in my spam.whitelist.rules file...
>|
>| FromOrTo:       default                                         no
>|
>| #To
>| To:             dalder@conpoint.com                             no
>| To:             tdickie@conpoint.com                            yes
>| To:             randjnelson@conpoint.com                        yes
>|
>| What else do I need?  I believe that I have this setup correctly but
>please
>| correct me if I am wrong.  With the above config I am seeing what I
>| described below.
>FromorTo:       default         no
>should be last rule.
>Default rules always go at the end.

It's a good guideline, as it makes the rulesets make more sense. However it
isn't absolutely necessary. Just this can make it a bit easier if you
auto-generate rulesets with scripts.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jase at SENSIS.COM  Wed Oct  6 20:16:47 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:10 2006
Subject: Multiple actions in a ruleset
Message-ID: <mailman.3172.1137101230.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> At 21:25 05/10/2004, you wrote:
>> I just want to clarify the syntax if I want to have a ruleset rule
>> that has multiple actions.  For example, a domain that wants their
>> spam quarantined, but still receive a notification.
>>
>> The ruleset I think to do this would be:
>>
>> To: domain.com          store notify
>>
>> I just want to confirm the syntax for multiple actions like this...
>> Do I separate them w/a space as I have here, or do I use a comma,
>> like this:
>>
>> To: domain.com          store,notify
>
> You need to have a space in between them. Extra spaces and commas are
> fine too, but there must be at least one space. So
>          store, notify
> and
>          store notify
> are okay, but
>          store,notify
> is not.

Will this work for actions with 2 conditions?  I am having problems with
rules with 2 conditions and multiple actions.  MailScanner complains about
there being a syntax error in the file.  But I don't get a syntax error if I
just have one action.

Directly from the EXAMPLES file (#8):

From: trapme.com and To: abuse@*     deliver

works just fine but:

From: trapme.com and To: abuse@*     store deliver

gives a syntax error.  Is this supposed to work, or am I doing something
wrong?  I was running MailScanner 4.29.7, but upgraded to 4.34.8 and I still
get the same problem.  Thanks.

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Wed Oct  6 20:17:41 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:10 2006
Subject: Need clarification on whitelist rules
Message-ID: <mailman.3173.1137101230.24926.mailscanner@lists.mailscanner.info>

I don't believe it can be done using Postfix. Please correct me if I'm
wrong.

I know it works in sendmail - we use it on many systems;

I believe it can be done in exim. Mike Bacher [mikeb@tulsaconnect.com] sent
me the directions below:
-----------------------------------

FYI, a potential solution to the white/blacklist problem with MailScanner
when using exim as the MTA:

[I wont have time to test this myself for a week or two]

-------- Original Message --------
Return-Path: <ph10@cus.cam.ac.uk>
Date: Fri, 16 Jul 2004 11:09:59 +0100 (BST)
From: Philip Hazel <ph10@cus.cam.ac.uk>
Reply-To: exim-users@exim.org
To: Mike Bacher <isp-list@tulsaconnect.com>

On Fri, 16 Jul 2004, Mike Bacher wrote:

> Well, I only care that a message with multiple recipients gets broken
> up into 1 message per recipient and placed into the queue for outbound
> delivery,

You can do this with an "incestuous" call to exim. Make this your first
router:

split:
   driver = accept
   domains = the.domains.you.want.to.do.this.for
   condition = ${if eq {$received_protocol}{split}{no}{yes}}
   transport = send_to_self
   no_verify

Add this transport:

send_to_self:
   driver = pipe
   batch_max = 1
   use_bsmtp
   command = /usr/sbin/exim -oMr split -bS
   user = exim

Untested. YMMV. You logs will get bigger, of course...

--
Philip Hazel            University of Cambridge Computing Service,
ph10@cus.cam.ac.uk      Cambridge, England. Phone: +44 1223 334714.
Get the Exim 4 book:    http://www.uit.co.uk/exim-book
-------------------------------------------------------------

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Dan Spray
> Sent: Wednesday, October 06, 2004 2:51 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
> Thank you for the link.  This is exactly what is happening.  However, I am
> using postfix not sendmail.  Anyone out there that has done the same thing
> in postfix?
>
> Dan
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
> Of Dan
> Sent: Wednesday, October 06, 2004 10:27 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
> I had this problem as well.
> I assume you are using Sendmail.
>
> Following this guide in the FAQ solved the problem for me.
>
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/169.html
>
> regards,
> -dan
>
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
> Of Dan Spray
> Sent: October 6, 2004 9:53 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
> That is the problem though.  I have a customer who has asked to be
> whitelisted so I add them to the spam.whitelist.rules file.  Then a spam
> message comes in and is addressed to 10 people, ONE of which is the
> customer
> that wanted to be whitelisted.  The message however is declared
> whitelisted
> and is delivered to all 10 people even though it is actually scored as
> spam.
>
> Dan
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
> Of Julian Field
> Sent: Wednesday, October 06, 2004 9:32 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Need clarification on whitelist rules
>
> Only if you are deleting it and not delivering it to the people who didn't
> whitelist it.
> For each recipient, you can either
> 1) whitelist and deliver it
> 2) delete it
> Then it's easy, and I've done it before.
>
> At 14:34 06/10/2004, you wrote:
> >Okay, so now that I am back in the office, is there anyway to avoid
> >having all of the recipients whitelisted when just one of the
> >recipients has requested to be whitelisted?
> >
> >Dan
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
> >Of Julian Field
> >Sent: Friday, October 01, 2004 10:04 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Need clarification on whitelist rules
> >
> >At 15:26 01/10/2004, you wrote:
> > > > -----Original Message-----
> > > > From: MailScanner mailing list
> > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > Behalf Of Julian Field
> > > > Sent: Friday, October 01, 2004 9:10 AM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: Need clarification on whitelist rules
> > > >
> > > >
> > > > At 14:56 01/10/2004, you wrote:
> > > > > > -----Original Message-----
> > > > > > From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > > > > > Behalf Of Julian Field
> > > > > > Sent: Friday, October 01, 2004 7:57 AM
> > > > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > > > Subject: Re: Need clarification on whitelist rules
> > > > > >
> > > > > >
> > > > ><snip>
> > > > > >
> > > > > > What you need is a Custom Function that edits the recipients
> > > > list in each
> > > > > > message, according to whether they want to be filtered or
> > > > not. I've done
> > > > > > something like this already, just haven't yet published it.
> > > > > >
> > > > > > What form would people like it in? Added to the per-user
> > > > white and black
> > > > > > list code?
> > > > > > It would have to be a simple "remove them from the message if
> > > > > > it's in their blacklist or not in their whitelist".
> > > > > >
> > > > > > Can people see any problems with this? Something is nagging
> > > > me that this
> > > > > > isn't the correct functionality, but I can't see what the
> > > > right answer is
> > > > > > for definite.
> > > > > > --
> > > > >
> > > > >I guess my first question is how it's tagged as spam when there
> > > > >is a
> >rule
> > > > >file for the spam scoring settings? If user A tagges as spam
> > > > with a score of
> > > > >5.0 and user B tagges it with a score of 7.5 how does the message
> > > > >get tagged, since a score of 6.5 would flag as spam for user A
> > > > >and
> > > > ham for user
> > > > >B?
> > > >
> > > > We use it only for automatic spam deletion. In your example, user
> > > > A
> >would
> > > > be removed from the list of recipients, and it would be normally
> >delivered
> > > > to user B. To use it for anything other than spam deletion is
> > > > pretty
> >much
> > > > impossible.
> > > >
> > > > --
> > >
> > >Isn't this what you are proposing above?
> > >
> > > > > > It would have to be a simple "remove them from the message if
> > > > > > it's in their blacklist or not in their whitelist".
> > >
> > >so if you handle the white/black listing here if it's spam and
> whitelisted
> > >don't remove them and if it's ham but blacklisted do remove them, or
> > >am I missing something?
> >
> >
> > >  I would think where every the per user scoring is checked if the
> > >whitelist/blacklist was checked as well it would simply adjust the
> > >actual tagging as spam or ham the same as the scoring based tagging
> would,
> > >the difference being if it scores as 6.5 and the user threshold is
> > >7.5
> but
> > >it's blacklisted it would be tagged as spam and not ham?
> >
> >I don't understand that sentence at all, sorry.
> >
> > >  I'm sorry if I am
> > >coming across dense just looking for a way to simplify the overall
> > >code changes
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >MailScanner thanks transtec Computers for their support Buy the
> >MailScanner book at www.MailScanner.info/store
> >
> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> >------------------------ MailScanner list ------------------------ To
> >unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >------------------------ MailScanner list ------------------------ To
> >unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support Buy the
> MailScanner
> book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct  6 20:22:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: Multiple actions in a ruleset
Message-ID: <mailman.3174.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:16 06/10/2004, you wrote:
>Julian Field wrote:
> > At 21:25 05/10/2004, you wrote:
> >> I just want to clarify the syntax if I want to have a ruleset rule
> >> that has multiple actions.  For example, a domain that wants their
> >> spam quarantined, but still receive a notification.
> >>
> >> The ruleset I think to do this would be:
> >>
> >> To: domain.com          store notify
> >>
> >> I just want to confirm the syntax for multiple actions like this...
> >> Do I separate them w/a space as I have here, or do I use a comma,
> >> like this:
> >>
> >> To: domain.com          store,notify
> >
> > You need to have a space in between them. Extra spaces and commas are
> > fine too, but there must be at least one space. So
> >          store, notify
> > and
> >          store notify
> > are okay, but
> >          store,notify
> > is not.
>
>Will this work for actions with 2 conditions?  I am having problems with
>rules with 2 conditions and multiple actions.  MailScanner complains about
>there being a syntax error in the file.  But I don't get a syntax error if I
>just have one action.
>
>Directly from the EXAMPLES file (#8):
>
>From: trapme.com and To: abuse@*     deliver
>
>works just fine but:
>
>From: trapme.com and To: abuse@*     store deliver
>
>gives a syntax error.  Is this supposed to work, or am I doing something
>wrong?  I was running MailScanner 4.29.7, but upgraded to 4.34.8 and I still
>get the same problem.  Thanks.

Try using store,deliver instead. Sounds like a bugette in the ruleset
compiler. Trying to spot those "and" conditions is not as easy as it looks
when you can't predict what might be the results of the rule.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From JHuber at MICROSOURCE.COM  Wed Oct  6 20:27:02 2004
From: JHuber at MICROSOURCE.COM (Jeremy Huber)
Date: Thu Jan 12 21:27:10 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3175.1137101230.24926.mailscanner@lists.mailscanner.info>

1) The debug output didn't seem to indicate a certain spot where it's
slow.. I can attach it if it'd help.
2) Turning the RBL lookups didn't speed it up much at all (just did
skip_rbl_lookups 1 in spam.assassin.prefs.conf)
3) I next pulled out all the extra rules_du_jour scripts out
(70_sare_adult.cf, 70_sare_random.cf, 99_sare_fraud_post25x.cf,
antidrug.cf, blacklist.cf, bogus-virus-warnings.cf, evilnumbers.cf,
local.cf, random.cf, tripwire.cf) of the /etc/mail/spamassassin
directory, and now the spam checks are up around 4500 bytes per second,
and screaming through the queue.
4) Turned back on RBL, and added all the .cf files EXCEPT the blacklist
in, and tried again, still screaming through them.
5) Added in the blacklist - slower than snot.

Ok, so the next question is: Is there a better way to do the
blacklisting?  I'm doing the spam.bydomain extra stuff, too, or I'd just
add it into the MS blacklist..

(Thanks!)
Jeremy


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Jeff A. Earickson
Sent: Wednesday, October 06, 2004 11:02 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: How to find a slowdown?


Quick advice, run MailScanner in debug mode and see what happens.
I'll bet that it gets slow on DNS lookups.  It always helps to run
a caching DNS (stealth secondary) on your mail server.

Jeff Earickson
Colby College

On Wed, 6 Oct 2004, Jeremy Huber wrote:

> Date: Wed, 6 Oct 2004 10:32:54 -0600
> From: Jeremy Huber <JHuber@MICROSOURCE.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: How to find a slowdown?
>
> I've got a case where our brand new server that I put MailScanner on
is
> just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2,
MS
> 4.33.3, and SA 2.63 (I've turned off the virus scanning temporarily).
> We only push somewhere around 50k messages a day through it, so I'm
not
> sure why it's so slow.  It almost always has hundreds of messages in
the
> inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
> speed is usually around 600 bytes per second.  That seems insanely
slow,
> but I didn't what's "good."  I've got SA using DCC and Pyzor as well
as
> maybe 6 of the rulesets out of the rdj (one of which being the
> blacklist).  Am I just making SA do too much, and that's why it's so
> slow?
>
> Thanks for any help you guys can give!
>
> Jeremy
>
> --
> Jeremy Huber, SCSA, LCP
> jhuber@microsource.com
> Datacenter Engineer
> Microsource, Inc
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at ZANKER.ORG  Wed Oct  6 20:30:34 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:10 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3176.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 06 October 2004 17:54 +0100 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> Okay, that was -3. Now I've created -4 which I have tested on a RHEL
> system and it seems to be rather cleaner.

Unfortunately this breaks my up2date:

up2date -u now gives:

Fetching Obsoletes list for channel: rhel-i386-as-3...
########################################

Fetching rpm headers...
########################################

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7
i386


Testing package set / solving RPM inter-dependencies...
########################################
RPM package conflict error.  The message was:
Test install failed because of package conflicts:
package perl-5.8.0-88.7 is already installed

If I do "up2date -l" I get:

Fetching Obsoletes list for channel: rhel-i386-as-3...

Fetching rpm headers...
########################################

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7
i386

The following Packages are obsoleted by newer packages:

Name-Version-Release        obsoleted by      Name-Version-Release
-------------------------------------------------------------------------------
perl-MIME-Base64-3.03-1                 perl-5.8.0-88.7


Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From greg at BLASTZONE.COM  Wed Oct  6 20:44:32 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:10 2006
Subject: Version History
Message-ID: <mailman.3177.1137101230.24926.mailscanner@lists.mailscanner.info>

Is there a version history document for MailScanner someplace?  I've
checked the archives and faq/maq with no luck.  I'm running version
4.33.3 and am curious what has changed in the latest release.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jase at SENSIS.COM  Wed Oct  6 20:46:34 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:10 2006
Subject: Multiple actions in a ruleset
Message-ID: <mailman.3178.1137101230.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> At 20:16 06/10/2004, you wrote:
>> Julian Field wrote:
>>> At 21:25 05/10/2004, you wrote:
>>>> I just want to clarify the syntax if I want to have a ruleset rule
>>>> that has multiple actions.  For example, a domain that wants their
>>>> spam quarantined, but still receive a notification.
>>>>
>>>> The ruleset I think to do this would be:
>>>>
>>>> To: domain.com          store notify
>>>>
>>>> I just want to confirm the syntax for multiple actions like this...
>>>> Do I separate them w/a space as I have here, or do I use a comma,
>>>> like this:
>>>>
>>>> To: domain.com          store,notify
>>>
>>> You need to have a space in between them. Extra spaces and commas
>>> are fine too, but there must be at least one space. So
>>>          store, notify
>>> and
>>>          store notify
>>> are okay, but
>>>          store,notify
>>> is not.
>>
>> Will this work for actions with 2 conditions?  I am having problems
>> with rules with 2 conditions and multiple actions.  MailScanner
>> complains about there being a syntax error in the file.  But I don't
>> get a syntax error if I just have one action.
>>
>> Directly from the EXAMPLES file (#8):
>>
>> From: trapme.com and To: abuse@*     deliver
>>
>> works just fine but:
>>
>> From: trapme.com and To: abuse@*     store deliver
>>
>> gives a syntax error.  Is this supposed to work, or am I doing
>> something wrong?  I was running MailScanner 4.29.7, but upgraded to
>> 4.34.8 and I still get the same problem.  Thanks.
>
> Try using store,deliver instead. Sounds like a bugette in the ruleset
> compiler. Trying to spot those "and" conditions is not as easy as it
> looks when you can't predict what might be the results of the rule.

Both "store,deliver" and "store, deliver" give syntax errors.

I know it's not easy.  I was going to report the bug and submit a patch, but
I took a quick look at the code and decided to just report the bug.  :-)

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From peter at UCGBOOK.COM  Wed Oct  6 21:01:18 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:10 2006
Subject: The Party Line on Bayes settings?
Message-ID: <mailman.3179.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Jeff A. Earickson wrote:
> Julian et. al,
>
> Could you say a few words about the recommended settings for using
> Bayes with SA 3.0 and the latest MailScanner?  I had the common
> problem of bayes_toks.expire files piling up after upgrading to
> SA 3.0.  I read thru the FAQ on Bayes lock files
> (http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/303.html)
> and followed this advice.  I used to have (with MS 4.33 and SA 2.64)
> Rebuild Bayes Every = 86400, but I now use the factory default of
> zero.  I have a cron job that runs the attached shell script once
> a day, to learn spam/ham and do the force-expire/sync, which came
> out of list posting months ago.

Do you have the original local.cf in /etc/mail/spamassassin or do you
have it symlinked to spam.assassin.prefs.conf? Supposedly the
bayes_auto_expire setting is only honored in local.cf so if you have
that one symlinked to spam.assassin.prefs.conf, like I do, you're ok.

I did that so I wouldn't have to bother with the -C and -p options all
the time so that's a bonus.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Wed Oct  6 21:02:37 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:10 2006
Subject: Version History
Message-ID: <mailman.3180.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Greg Deputy wrote:
> Is there a version history document for MailScanner someplace?  I've
> checked the archives and faq/maq with no luck.  I'm running version
> 4.33.3 and am curious what has changed in the latest release.

The change log on the web site describes all changes.

http://www.sng.ecs.soton.ac.uk/mailscanner/ChangeLog

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Wed Oct  6 21:08:51 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:10 2006
Subject: Version History
Message-ID: <mailman.3181.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 03:44 PM 10/6/2004, Greg Deputy wrote:
>Is there a version history document for MailScanner someplace?  I've
>checked the archives and faq/maq with no luck.  I'm running version
>4.33.3 and am curious what has changed in the latest release.

Right on the main page, but burried in text, is a link to the changelog:

http://www.sng.ecs.soton.ac.uk/mailscanner/ChangeLog

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Wed Oct  6 21:08:58 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:10 2006
Subject: The Party Line on Bayes settings?
Message-ID: <mailman.3182.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On Wed, 6 Oct 2004, Peter Bonivart wrote:

> Date: Wed, 6 Oct 2004 22:01:18 +0200
> From: Peter Bonivart <peter@UCGBOOK.COM>
> Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: The Party Line on Bayes settings?
>
> Jeff A. Earickson wrote:
>> Julian et. al,
>>
>> Could you say a few words about the recommended settings for using
>> Bayes with SA 3.0 and the latest MailScanner?  I had the common
>> problem of bayes_toks.expire files piling up after upgrading to
>> SA 3.0.  I read thru the FAQ on Bayes lock files
>> (http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/303.html)
>> and followed this advice.  I used to have (with MS 4.33 and SA 2.64)
>> Rebuild Bayes Every = 86400, but I now use the factory default of
>> zero.  I have a cron job that runs the attached shell script once
>> a day, to learn spam/ham and do the force-expire/sync, which came
>> out of list posting months ago.
>
> Do you have the original local.cf in /etc/mail/spamassassin or do you
> have it symlinked to spam.assassin.prefs.conf? Supposedly the
> bayes_auto_expire setting is only honored in local.cf so if you have
> that one symlinked to spam.assassin.prefs.conf, like I do, you're ok.

I have /etc/mail/spamassassin/local.cf symlinked to MailScanner's
spam.assassin.prefs.conf.  In there I have bayes_auto_expire set to zero.
The Bayes database has always benn a semi-mystery to me.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dustin.baer at IHS.COM  Wed Oct  6 21:14:22 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:10 2006
Subject: CustomConfig.pm per user/domain lists
Message-ID: <mailman.3183.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I've decided to try the per domain whitelisting/blacklisting in
CustomConfig.pm.  In
http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0305&L=mailscanner&P=R43253&I=-1
it is asked if wildcards are allowed.  Julian mentions that he "might
expand this later to allow IP prefixes and possibly domain suffixes."

In a normal rules file, one is allowed to use wildcards.  I've tried to
use wildcards in the spam.bydomain/whitelist/... files with no success.

Does the ability to do this exist?  I've compared sub
InitByDomainSpamWhitelist in the version I am currently using (4.31.6)
and current version (4.34.8), but don't see any difference that might
point to wildcard acceptance.

Thanks,

Dustin
--
Dustin Baer
Transport Extranet Network Services
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From greg at BLASTZONE.COM  Wed Oct  6 21:17:33 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:10 2006
Subject: Version History
Message-ID: <mailman.3184.1137101230.24926.mailscanner@lists.mailscanner.info>

Perfect, thanks.  Might be a good thing to have in the main list of
links at the top.

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matt Kettler
> Sent: Wednesday, October 06, 2004 1:09 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Version History
>
>
> At 03:44 PM 10/6/2004, Greg Deputy wrote:
> >Is there a version history document for MailScanner someplace?  I've
> >checked the archives and faq/maq with no luck.  I'm running version
> >4.33.3 and am curious what has changed in the latest release.
>
> Right on the main page, but burried in text, is a link to the
> changelog:
>
http://www.sng.ecs.soton.ac.uk/mailscanner/ChangeLog

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
mailscanner' in the body of the email. Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vboulytchev at COINFOTECH.COM  Wed Oct  6 22:10:01 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:10 2006
Subject: MailScanner-4.34.8-1 Installation Problems
Message-ID: <mailman.3185.1137101230.24926.mailscanner@lists.mailscanner.info>

That's the fix.  If you guys see another one of these, tell the below to the
client.


Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Marcin Rozek
Sent: Wednesday, October 06, 2004 3:27 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner-4.34.8-1 Installation Problems


Boulytchev, Vasiliy wrote:
> Is it just some systems having issues?  This is on Mandrake 10.0
I had the same issue on Mandrake. Workaround is to remove -n from
brp-compress (as already mentioned), install from cpan all perl modules that
doesn't want to --rebuild and then install with --nodeps --force the rest
that builds but complain about rpm's dependences.
After that MS works fine (with sophossavi, clamavmodule and spamassasin 3)

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From hden at KCBBS.GEN.NZ  Wed Oct  6 22:25:13 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:10 2006
Subject: Spam Assassin Prefs Conf
Message-ID: <mailman.3186.1137101230.24926.mailscanner@lists.mailscanner.info>

I may be blind to the obvious, but I've been reluctant
to change my spam.assassin.prefs.conf file due to the
fear of losing my 'tweaks', but, the following is
part of a debug output..

SpamAssassin failed to parse line, skipping: auto_learn 1

Is this command depreciated? or a mistake of mine?

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct  6 22:25:45 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:10 2006
Subject: Spam Assassin Prefs Conf
Message-ID: <mailman.3187.1137101230.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-10-07 at 10:25 +1300, Hendrik den Hartog wrote:
> I may be blind to the obvious, but I've been reluctant
> to change my spam.assassin.prefs.conf file due to the
> fear of losing my 'tweaks', but, the following is
> part of a debug output..
>
> SpamAssassin failed to parse line, skipping: auto_learn 1
>
> Is this command depreciated? or a mistake of mine?

It's deprecated in SA 3

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From moacyrs at AKADNYX.COM.BR  Wed Oct  6 22:30:14 2004
From: moacyrs at AKADNYX.COM.BR (Moacyr Leite da Silva)
Date: Thu Jan 12 21:27:10 2006
Subject: MailScanner and Mail::ClamAV
Message-ID: <mailman.3188.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1458" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>With MailScanner-4.34.8-1 - </FONT><FONT 
size=2>I&nbsp;installed the MailScanner and Install-ClamAV-SA - and did the 
install of clamavmodule correctly&nbsp;(Mail::ClamAV - build 
Mail-ClamAV-0.11)</FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>With <FONT size=2>MailScanner-4.34.8-4 - I received the 
following error when i try to install Mail::ClamAV</FONT></FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>I already tryed to force install of module via MCPAN but no 
success.</FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>Some tip?</FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>Thanks</FONT></DIV>
<DIV><FONT size=2>Moacyr Leite da Silva</FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>rict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE 
-D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386 
-mcpu=i686&nbsp;&nbsp; -DVERSION=\"0.11\" -DXS_VERSION=\"0.11\" -fPIC 
"-I/usr/lib/perl5/5.8.0/i386-linux-thread-multi/CORE"&nbsp;&nbsp; 
ClamAV.c<BR>ClamAV.xs: In function `clamav_perl__scanbuff':<BR>ClamAV.xs:141: 
warning: passing arg 3 of `cl_scanbuff' from incompatible pointer 
type<BR>ClamAV.xs: In function `clamav_perl__scanfd':<BR>ClamAV.xs:181: warning: 
passing arg 2 of `cl_scandesc' from incompatible pointer type<BR>ClamAV.xs: In 
function `clamav_perl__scanfile':<BR>ClamAV.xs:217: warning: passing arg 2 of 
`cl_scanfile' from incompatible pointer type<BR>ClamAV.xs: In function 
`clamav_perl_constant':<BR>ClamAV.xs:262: `CL_EOLE2' undeclared (first use in 
this function)<BR>ClamAV.xs:262: (Each undeclared identifier is reported only 
once<BR>ClamAV.xs:262: for each function it appears in.)<BR>ClamAV.xs:281: 
`CL_OLE2' undeclared (first use in this function)<BR>ClamAV.xs:282: 
`CL_ENCRYPTED' undeclared (first use in this function)<BR>make[1]: *** 
[ClamAV.o] Error 1<BR>make[1]: Leaving directory 
`/root/.cpan/build/Mail-ClamAV-0.11/_Inline/build/Mail/ClamAV'</FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>A problem was encountered while attempting to compile and 
install your Inline<BR>C code. The command that failed was:<BR>&nbsp; 
make</FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From moacyrs at AKADNYX.COM.BR  Wed Oct  6 23:03:43 2004
From: moacyrs at AKADNYX.COM.BR (Moacyr Leite da Silva)
Date: Thu Jan 12 21:27:10 2006
Subject: MailScanner and Mail::ClamAV
Message-ID: <mailman.3189.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1458" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>I also tryed to remove MailScanner&nbsp;and reinstall the 
MailScanner-4.38-8-1 but no luck. I cant figured out what to do. </FONT></DIV>
<DIV><FONT size=2></FONT>&nbsp;</DIV>
<DIV><FONT size=2>Thanks</FONT></DIV>
<DIV><FONT size=2>Moacyr</FONT></DIV>
<BLOCKQUOTE 
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV 
  style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B> 
  <A title=moacyrs@AKADNYX.COM.BR href="mailto:moacyrs@AKADNYX.COM.BR">Moacyr 
  Leite da Silva</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK 
  href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, October 06, 2004 6:30 
  PM</DIV>
  <DIV style="FONT: 10pt arial"><B>Subject:</B> MailScanner and 
  Mail::ClamAV</DIV>
  <DIV><BR></DIV>
  <DIV><FONT size=2>With MailScanner-4.34.8-1 - </FONT><FONT 
  size=2>I&nbsp;installed the MailScanner and Install-ClamAV-SA - and did the 
  install of clamavmodule correctly&nbsp;(Mail::ClamAV - build 
  Mail-ClamAV-0.11)</FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2>With <FONT size=2>MailScanner-4.34.8-4 - I received the 
  following error when i try to install Mail::ClamAV</FONT></FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2>I already tryed to force install of module via MCPAN but no 
  success.</FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2>Some tip?</FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2>Thanks</FONT></DIV>
  <DIV><FONT size=2>Moacyr Leite da Silva</FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2>rict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE 
  -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386 
  -mcpu=i686&nbsp;&nbsp; -DVERSION=\"0.11\" -DXS_VERSION=\"0.11\" -fPIC 
  "-I/usr/lib/perl5/5.8.0/i386-linux-thread-multi/CORE"&nbsp;&nbsp; 
  ClamAV.c<BR>ClamAV.xs: In function `clamav_perl__scanbuff':<BR>ClamAV.xs:141: 
  warning: passing arg 3 of `cl_scanbuff' from incompatible pointer 
  type<BR>ClamAV.xs: In function `clamav_perl__scanfd':<BR>ClamAV.xs:181: 
  warning: passing arg 2 of `cl_scandesc' from incompatible pointer 
  type<BR>ClamAV.xs: In function `clamav_perl__scanfile':<BR>ClamAV.xs:217: 
  warning: passing arg 2 of `cl_scanfile' from incompatible pointer 
  type<BR>ClamAV.xs: In function `clamav_perl_constant':<BR>ClamAV.xs:262: 
  `CL_EOLE2' undeclared (first use in this function)<BR>ClamAV.xs:262: (Each 
  undeclared identifier is reported only once<BR>ClamAV.xs:262: for each 
  function it appears in.)<BR>ClamAV.xs:281: `CL_OLE2' undeclared (first use in 
  this function)<BR>ClamAV.xs:282: `CL_ENCRYPTED' undeclared (first use in this 
  function)<BR>make[1]: *** [ClamAV.o] Error 1<BR>make[1]: Leaving directory 
  `/root/.cpan/build/Mail-ClamAV-0.11/_Inline/build/Mail/ClamAV'</FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2>A problem was encountered while attempting to compile and 
  install your Inline<BR>C code. The command that failed was:<BR>&nbsp; 
  make</FONT></DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>
  <DIV><FONT size=2></FONT>&nbsp;</DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From Steve.Swaney at FSL.COM  Wed Oct  6 23:09:30 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:10 2006
Subject: Spam Assassin Prefs Conf
Message-ID: <mailman.3190.1137101230.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Michele Neylon : Blacknight Solutions
> Sent: Wednesday, October 06, 2004 5:26 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Spam Assassin Prefs Conf
>
> On Thu, 2004-10-07 at 10:25 +1300, Hendrik den Hartog wrote:
> > I may be blind to the obvious, but I've been reluctant
> > to change my spam.assassin.prefs.conf file due to the
> > fear of losing my 'tweaks', but, the following is
> > part of a debug output..
> >
> > SpamAssassin failed to parse line, skipping: auto_learn 1
> >
> > Is this command depreciated? or a mistake of mine?
>
> It's deprecated in SA 3
>

It's still there - just the syntax has changed. Just add the lines below to
your spam.assassin.prefs.con and delete the auto_learn 1 line.

# The --auto-whitelist and -a options for "spamd" and "spamassassin" to
# turn on the auto-whitelist have been removed and replaced by the
# "use_auto_whitelist" configuration option which is also now turned on by

use_auto_whitelist 0


Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com

> --
> Mr Michele Neylon
> Blacknight Solutions
> http://www.blacknight.ie
> 059 9137101
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Wed Oct  6 23:14:52 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:10 2006
Subject: MailScanner and Mail::ClamAV
Message-ID: <mailman.3191.1137101230.24926.mailscanner@lists.mailscanner.info>

> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On 
> Behalf Of Moacyr Leite da Silva
> Sent: Wednesday, October 06, 2004 6:04 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner and Mail::ClamAV

> I also tryed to remove MailScanner and reinstall the MailScanner-4.38-8-1 
> but no luck. I cant figured out what to do. 
 
> Thanks
> Moacyr

> ----- Original Message ----- 
> From: Moacyr Leite da Silva 
> To: MAILSCANNER@JISCMAIL.AC.UK 
> Sent: Wednesday, October 06, 2004 6:30 PM
> Subject: MailScanner and Mail::ClamAV

> With MailScanner-4.34.8-1 - I installed the MailScanner and 
> Install-ClamAV-SA - and did the install of clamavmodule 
> correctly (Mail::ClamAV - build Mail-ClamAV-0.11)
 
Search the MailScanner list archives for "ClamAV" during the last week and
you'll find your answer. Lots of recent problems with clamavmodule. 

Short Answer:

use clamav to call the virus scanner until its straightened out.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com 
________________________________________


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From test at NEXTMILL.NET  Thu Oct  7 01:21:42 2004
From: test at NEXTMILL.NET (Brian Lewis)
Date: Thu Jan 12 21:27:10 2006
Subject: SpamAssassin 3.0 upgrade from 2.63-8
Message-ID: <mailman.3192.1137101230.24926.mailscanner@lists.mailscanner.info>

I am attempting to use Julian's RPM install for clamav/spamassassin3, at
the very end I get the following errors.  Do I need to uninstall
SpamAsssassin 2.63-8 before this will work?  There was no README to
document the proper procedure. (ie stop mailscanner? uninstall
spamassassin?)


Preparing...                ###########################################
[100%]
        file /usr/bin/sa-learn from install of perl-Mail-SpamAssassin-3.0.0-
1 co
nflicts with file from package spamassassin-2.63-8
        file /usr/bin/spamassassin from install of perl-Mail-SpamAssassin-
3.0.0-
1 conflicts with file from package spamassassin-2.63-8
        file /usr/bin/spamc from install of perl-Mail-SpamAssassin-3.0.0-1
confl
icts with file from package spamassassin-2.63-8
        file /usr/bin/spamd from install of perl-Mail-SpamAssassin-3.0.0-1
confl
icts with file from package spamassassin-2.63-8
        file /usr/share/man/man1/sa-learn.1.gz from install of perl-Mail-
SpamAss
assin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/man/man1/spamassassin.1.gz from install of perl-
Mail-Spa
mAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/man/man1/spamc.1.gz from install of perl-Mail-
SpamAssass
in-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/man/man1/spamd.1.gz from install of perl-Mail-
SpamAssass
in-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/man/man3/Mail::SpamAssassin.3pm.gz from install of
perl-
Mail-SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-
2.63-8
        file /usr/share/man/man3/Mail::SpamAssassin::AutoWhitelist.3pm.gz
from i
nstall of perl-Mail-SpamAssassin-3.0.0-1 conflicts with file from package
spamas
sassin-2.63-8
        file /usr/share/man/man3/Mail::SpamAssassin::Bayes.3pm.gz from
install o
f perl-Mail-SpamAssassin-3.0.0-1 conflicts with file from package
spamassassin-2
.63-8
        file /usr/share/man/man3/Mail::SpamAssassin::Conf.3pm.gz from
install of
 perl-Mail-SpamAssassin-3.0.0-1 conflicts with file from package
spamassassin-2.
63-8
        file /usr/share/man/man3/Mail::SpamAssassin::PerMsgLearner.3pm.gz
from i
nstall of perl-Mail-SpamAssassin-3.0.0-1 conflicts with file from package
spamas
sassin-2.63-8
        file /usr/share/man/man3/Mail::SpamAssassin::PerMsgStatus.3pm.gz
from in
stall of perl-Mail-SpamAssassin-3.0.0-1 conflicts with file from package
spamass
assin-2.63-8

file /usr/share/man/man3/Mail::SpamAssassin::PersistentAddrList.3pm.gz f
rom install of perl-Mail-SpamAssassin-3.0.0-1 conflicts with file from
package s
pamassassin-2.63-8
        file /usr/share/spamassassin/10_misc.cf from install of perl-Mail-
SpamAs
sassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_anti_ratware.cf from install of
perl-Mai
l-SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_body_tests.cf from install of perl-
Mail-
SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_compensate.cf from install of perl-
Mail-
SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_dnsbl_tests.cf from install of perl-
Mail
-SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_fake_helo_tests.cf from install of
perl-
Mail-SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-
2.63-8
        file /usr/share/spamassassin/20_head_tests.cf from install of perl-
Mail-
SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_html_tests.cf from install of perl-
Mail-
SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_meta_tests.cf from install of perl-
Mail-
SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_phrases.cf from install of perl-
Mail-Spa
mAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_porn.cf from install of perl-Mail-
SpamAs
sassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_ratware.cf from install of perl-
Mail-Spa
mAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/20_uri_tests.cf from install of perl-
Mail-S
pamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/23_bayes.cf from install of perl-Mail-
SpamA
ssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/25_body_tests_es.cf from install of
perl-Ma
il-SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/30_text_de.cf from install of perl-
Mail-Spa
mAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/30_text_fr.cf from install of perl-
Mail-Spa
mAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/30_text_pl.cf from install of perl-
Mail-Spa
mAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/50_scores.cf from install of perl-Mail-
Spam
Assassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/60_whitelist.cf from install of perl-
Mail-S
pamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8
        file /usr/share/spamassassin/user_prefs.template from install of
perl-Ma
il-SpamAssassin-3.0.0-1 conflicts with file from package spamassassin-2.63-8

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Thu Oct  7 02:35:02 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:10 2006
Subject: FreeBSD Installation Issue
Message-ID: <mailman.3193.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Derek Buttineau | Compu-SOLVE wrote:
> Okay, I'm having a rather strange problem here attempted to install
> MailScanner from the latest FreeBSD port.. and I'm wonder if it's
> perhaps just something I've missed in my dazed stupor!
>
> It appears to me that the variables within my MailScanner.conf file
> aren't being used by the program (though I have confirmed that the
> config file is being parsed as it'll yell at me good if I duplicate any
> of the entries, etc)  But the config values themselves are defaulting.
> IE Incoming Mail Queue is defaulting to /var/spool/mqueue.in even though
> I've changed it in the configuration file...

Are you sure you've put the correct mta in mta.sh?

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From patpng7 at YAHOO.COM  Thu Oct  7 03:39:47 2004
From: patpng7 at YAHOO.COM (Patpng)
Date: Thu Jan 12 21:27:10 2006
Subject: MCP configuration
Message-ID: <mailman.3194.1137101230.24926.mailscanner@lists.mailscanner.info>

Please advise,

I quite new to Mailscanner. I had recently installed and use it.
Very good product. And I saw something like MCP subject and content filter.

How do I configure that inorder for it to work?

rgds
Patrick

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From bg.mahesh at INDIAINFO.COM  Thu Oct  7 04:16:06 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:10 2006
Subject: MS 4.34.8-4/MIME::QuotedPrint works fine
Message-ID: <mailman.3195.1137101230.24926.mailscanner@lists.mailscanner.info>

hi

Thanks for all the effort. 4.34.8-4 works fine on Redhat now.

however, I still feel the MS version should be included in /etc/MailScanner/MailScanner.conf.rpmnew

--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From niklas at ADNECOM.SE  Thu Oct  7 09:06:14 2004
From: niklas at ADNECOM.SE (Niklas Olofsson)
Date: Thu Jan 12 21:27:10 2006
Subject: some SURBL hits that I don't understand
Message-ID: <mailman.3196.1137101230.24926.mailscanner@lists.mailscanner.info>

Every days since we upgraded to SA 3 we get some email's that contain's
no URL:s but still get scores from 3 different SURBL list's. I have some
problems troubleshooting this because if I send these messeages thru the
system again I get no SURBL hits, very strange....

Any tip how on I can troubleshoot this would be appreciated.

MailScanner 4.33.3
SA 3.0

Niklas Olofsson
adnecom AB

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 08:33:09 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3197.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
You can blacklist at your MTA and stop these addresses' mail coming in at all.
Or else use the per-domain/per-user white and blacklist code provided in
CustomConfig.pm in MailScanner. That's very fast.

At 20:27 06/10/2004, you wrote:
>1) The debug output didn't seem to indicate a certain spot where it's
>slow.. I can attach it if it'd help.
>2) Turning the RBL lookups didn't speed it up much at all (just did
>skip_rbl_lookups 1 in spam.assassin.prefs.conf)
>3) I next pulled out all the extra rules_du_jour scripts out
>(70_sare_adult.cf, 70_sare_random.cf, 99_sare_fraud_post25x.cf,
>antidrug.cf, blacklist.cf, bogus-virus-warnings.cf, evilnumbers.cf,
>local.cf, random.cf, tripwire.cf) of the /etc/mail/spamassassin
>directory, and now the spam checks are up around 4500 bytes per second,
>and screaming through the queue.
>4) Turned back on RBL, and added all the .cf files EXCEPT the blacklist
>in, and tried again, still screaming through them.
>5) Added in the blacklist - slower than snot.
>
>Ok, so the next question is: Is there a better way to do the
>blacklisting?  I'm doing the spam.bydomain extra stuff, too, or I'd just
>add it into the MS blacklist..
>
>(Thanks!)
>Jeremy
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf Of Jeff A. Earickson
>Sent: Wednesday, October 06, 2004 11:02 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: How to find a slowdown?
>
>
>Quick advice, run MailScanner in debug mode and see what happens.
>I'll bet that it gets slow on DNS lookups.  It always helps to run
>a caching DNS (stealth secondary) on your mail server.
>
>Jeff Earickson
>Colby College
>
>On Wed, 6 Oct 2004, Jeremy Huber wrote:
>
> > Date: Wed, 6 Oct 2004 10:32:54 -0600
> > From: Jeremy Huber <JHuber@MICROSOURCE.COM>
> > Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: How to find a slowdown?
> >
> > I've got a case where our brand new server that I put MailScanner on
>is
> > just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2,
>MS
> > 4.33.3, and SA 2.63 (I've turned off the virus scanning temporarily).
> > We only push somewhere around 50k messages a day through it, so I'm
>not
> > sure why it's so slow.  It almost always has hundreds of messages in
>the
> > inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
> > speed is usually around 600 bytes per second.  That seems insanely
>slow,
> > but I didn't what's "good."  I've got SA using DCC and Pyzor as well
>as
> > maybe 6 of the rulesets out of the rdj (one of which being the
> > blacklist).  Am I just making SA do too much, and that's why it's so
> > slow?
> >
> > Thanks for any help you guys can give!
> >
> > Jeremy

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 09:02:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: MS 4.34.8-4/MIME::QuotedPrint works fine
Message-ID: <mailman.3198.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:16 07/10/2004, you wrote:
>hi
>
>Thanks for all the effort. 4.34.8-4 works fine on Redhat now.
>
>however, I still feel the MS version should be included in
>/etc/MailScanner/MailScanner.conf.rpmnew

It is.

# This is the version number of the MailScanner distribution that created
# this configuration file. Please do not change this value.
MailScanner Version Number = 4.34.8

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mvinayakam at gmail.com  Thu Oct  7 09:01:20 2004
From: mvinayakam at gmail.com (Vinayakam Murugan)
Date: Thu Jan 12 21:27:10 2006
Subject: Delayed delivery of local mail
Message-ID: <mailman.3199.1137101230.24926.mailscanner@lists.mailscanner.info>

Hello guys

We are running a RH 9 system with MailScanner 4.29.3 along with
sendmail & clamscan 0.67. We have not enabled SpamAssassin.

Of late we have been intermittenly facing problems of delayed delivery
of local mail. There have been instances of mails getting delayed by
around 10- 16 hours.

We checked the maillog and found many entries like

Command stream end of file while reading line user=???

Commercial scanner clamav timed out

Virus Scanning: Denial of service attack is in message


Does this tell me something i am not getting?



--
Warm Regards
~~~~~~~~~~~~
Vinayak

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct  7 09:14:36 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:10 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3200.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Jeremy

are you talking about William Stearn's sa-blacklist file????

If so it's *huge* (go on, do a ls -l I dare you), and hence the large
amount of time it takes to parse email when you use this file.

Anyway you can replace this with a surbl.org URI rbl. Install the
spamcop URI plugin and you'll get the ws.surbl.org as a replacement URI
rbl for the blacklist.cf.

There are also other useful URI RBL's that surbl.org host as well...


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> You can blacklist at your MTA and stop these addresses' mail coming in
> at all.
> Or else use the per-domain/per-user white and blacklist code provided in
> CustomConfig.pm in MailScanner. That's very fast.
>
> At 20:27 06/10/2004, you wrote:
>
>> 1) The debug output didn't seem to indicate a certain spot where it's
>> slow.. I can attach it if it'd help.
>> 2) Turning the RBL lookups didn't speed it up much at all (just did
>> skip_rbl_lookups 1 in spam.assassin.prefs.conf)
>> 3) I next pulled out all the extra rules_du_jour scripts out
>> (70_sare_adult.cf, 70_sare_random.cf, 99_sare_fraud_post25x.cf,
>> antidrug.cf, blacklist.cf, bogus-virus-warnings.cf, evilnumbers.cf,
>> local.cf, random.cf, tripwire.cf) of the /etc/mail/spamassassin
>> directory, and now the spam checks are up around 4500 bytes per second,
>> and screaming through the queue.
>> 4) Turned back on RBL, and added all the .cf files EXCEPT the blacklist
>> in, and tried again, still screaming through them.
>> 5) Added in the blacklist - slower than snot.
>>
>> Ok, so the next question is: Is there a better way to do the
>> blacklisting?  I'm doing the spam.bydomain extra stuff, too, or I'd just
>> add it into the MS blacklist..
>>
>> (Thanks!)
>> Jeremy
>>
>>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> Behalf Of Jeff A. Earickson
>> Sent: Wednesday, October 06, 2004 11:02 AM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: How to find a slowdown?
>>
>>
>> Quick advice, run MailScanner in debug mode and see what happens.
>> I'll bet that it gets slow on DNS lookups.  It always helps to run
>> a caching DNS (stealth secondary) on your mail server.
>>
>> Jeff Earickson
>> Colby College
>>
>> On Wed, 6 Oct 2004, Jeremy Huber wrote:
>>
>> > Date: Wed, 6 Oct 2004 10:32:54 -0600
>> > From: Jeremy Huber <JHuber@MICROSOURCE.COM>
>> > Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
>> > To: MAILSCANNER@JISCMAIL.AC.UK
>> > Subject: How to find a slowdown?
>> >
>> > I've got a case where our brand new server that I put MailScanner on
>> is
>> > just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2,
>> MS
>> > 4.33.3, and SA 2.63 (I've turned off the virus scanning temporarily).
>> > We only push somewhere around 50k messages a day through it, so I'm
>> not
>> > sure why it's so slow.  It almost always has hundreds of messages in
>> the
>> > inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
>> > speed is usually around 600 bytes per second.  That seems insanely
>> slow,
>> > but I didn't what's "good."  I've got SA using DCC and Pyzor as well
>> as
>> > maybe 6 of the rulesets out of the rdj (one of which being the
>> > blacklist).  Am I just making SA do too much, and that's why it's so
>> > slow?
>> >
>> > Thanks for any help you guys can give!
>> >
>> > Jeremy
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct  7 09:20:14 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:10 2006
Subject: Delayed delivery of local mail
Message-ID: <mailman.3201.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi

you might want to try upgrading ClamAV to the latest stable release. I
know that 0.60 is not supported  anymore as the DB format has changed
and I'm not when the new format was introduced.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Vinayakam Murugan wrote:
> Hello guys
>
> We are running a RH 9 system with MailScanner 4.29.3 along with
> sendmail & clamscan 0.67. We have not enabled SpamAssassin.
>
> Of late we have been intermittenly facing problems of delayed delivery
> of local mail. There have been instances of mails getting delayed by
> around 10- 16 hours.
>
> We checked the maillog and found many entries like
>
> Command stream end of file while reading line user=???
>
> Commercial scanner clamav timed out
>
> Virus Scanning: Denial of service attack is in message
>
>
> Does this tell me something i am not getting?
>
>
>
> --
> Warm Regards
> ~~~~~~~~~~~~
> Vinayak
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Thu Oct  7 09:34:22 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:10 2006
Subject: Please try this: Re: Installation problems with MS
    4.34.8-1/MIME::QuotedPrint
Message-ID: <mailman.3202.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 06 October 2004 20:30 +0100 Mike Zanker <mike@ZANKER.ORG> wrote:

> On 06 October 2004 17:54 +0100 Julian Field
> <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>> Okay, that was -3. Now I've created -4 which I have tested on a RHEL
>> system and it seems to be rather cleaner.
>
> Unfortunately this breaks my up2date:

rpm -e Perl-MIME-Base64 fixes up2date but breaks MS, obviously. Trying
to install that RPM manually fails unless you force it - it clashes
with files from the main perl RPM. Forcing the installation of
MIME-Base64 fixes MS, but up2date breaks again.

My workaround has been to install MIME-BASE64 from the CPAN tar.gz
after removing the RPM - that seems to satisfy MS and up2date.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mvinayakam at gmail.com  Thu Oct  7 10:08:13 2004
From: mvinayakam at gmail.com (Vinayakam Murugan)
Date: Thu Jan 12 21:27:10 2006
Subject: Delayed delivery of local mail
Message-ID: <mailman.3203.1137101230.24926.mailscanner@lists.mailscanner.info>

Thanks for the response, Martin.

This same configuration is running fine at many of my clients places.
I would like to get to the root of the problem and then decide to
upgrade or not.


On Thu, 7 Oct 2004 09:20:14 +0100, Martin Hepworth
<martinh@solid-state-logic.com> wrote:
> Hi
>
> you might want to try upgrading ClamAV to the latest stable release. I
> know that 0.60 is not supported  anymore as the DB format has changed
> and I'm not when the new format was introduced.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
>
>
> Vinayakam Murugan wrote:
> > Hello guys
> >
> > We are running a RH 9 system with MailScanner 4.29.3 along with
> > sendmail & clamscan 0.67. We have not enabled SpamAssassin.
> >
> > Of late we have been intermittenly facing problems of delayed delivery
> > of local mail. There have been instances of mails getting delayed by
> > around 10- 16 hours.
> >
> > We checked the maillog and found many entries like
> >
> > Command stream end of file while reading line user=???
> >
> > Commercial scanner clamav timed out
> >
> > Virus Scanning: Denial of service attack is in message
> >
> >
> > Does this tell me something i am not getting?
> >
> >
> >
> > --
> > Warm Regards
> > ~~~~~~~~~~~~
> > Vinayak
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>


--
Warm Regards
~~~~~~~~~~~~
Vinayak

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From bg.mahesh at INDIAINFO.COM  Thu Oct  7 10:19:28 2004
From: bg.mahesh at INDIAINFO.COM (BG Mahesh)
Date: Thu Jan 12 21:27:10 2006
Subject: MailScanner Version Number  is blank
Message-ID: <mailman.3204.1137101230.24926.mailscanner@lists.mailscanner.info>

In my case it reads,


# This is the version number of the MailScanner distribution that created
# this configuration file. Please do not change this value.
MailScanner Version Number =

It is blank :-(

----- Original Message -----
From: Julian Field <mailscanner@ECS.SOTON.AC.UK>
Date:         Thu, 7 Oct 2004 09:02:03 +0100
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MS 4.34.8-4/MIME::QuotedPrint works fine

> At 04:16 07/10/2004, you wrote:
> >hi
> >
> >Thanks for all the effort. 4.34.8-4 works fine on Redhat now.
> >
> >however, I still feel the MS version should be included in
> >/etc/MailScanner/MailScanner.conf.rpmnew
>
> It is.
>
> # This is the version number of the MailScanner distribution that created
> # this configuration file. Please do not change this value.
> MailScanner Version Number = 4.34.8
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



--
B.G. Mahesh
bg.mahesh@indiainfo.com
http://www.indiainfo.com/

--
______________________________________________
IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com
Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes!

Powered by Outblaze

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 10:07:37 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: SpamAssassin 3.0 upgrade from 2.63-8
Message-ID: <mailman.3205.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
You should have done
rpm -e spamassassin spamassassin-tools
first.

At 01:21 07/10/2004, you wrote:
>I am attempting to use Julian's RPM install for clamav/spamassassin3, at
>the very end I get the following errors.  Do I need to uninstall
>SpamAsssassin 2.63-8 before this will work?  There was no README to
>document the proper procedure. (ie stop mailscanner? uninstall
>spamassassin?)
>
>
>Preparing...                ###########################################
>[100%]
>         file /usr/bin/sa-learn from install of perl-Mail-SpamAssassin-3.0.0-
>1 co
>nflicts with file from package spamassassin-2.63-8
>         file /usr/bin/spamassassin from install of perl-Mail-SpamAssassin-
>3.0.0-
>1 conflicts with file from package spamassassin-2.63-8
>         file /usr/bin/spamc from install of perl-Mail-SpamAssassin-3.0.0-1
>confl
>icts with file from package spamassassin-2.63-8
>         file /usr/bin/spamd from install of perl-Mail-SpamAssassin-3.0.0-1
>confl

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 09:07:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: CustomConfig.pm per user/domain lists
Message-ID: <mailman.3206.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 21:14 06/10/2004, you wrote:
>I've decided to try the per domain whitelisting/blacklisting in
>CustomConfig.pm.  In
>http://www.jiscmail.ac.uk/cgi-bin/webadmin?A2=ind0305&L=mailscanner&P=R43253&I=-1
>it is asked if wildcards are allowed.  Julian mentions that he "might
>expand this later to allow IP prefixes and possibly domain suffixes."
>
>In a normal rules file, one is allowed to use wildcards.  I've tried to
>use wildcards in the spam.bydomain/whitelist/... files with no success.
>
>Does the ability to do this exist?  I've compared sub
>InitByDomainSpamWhitelist in the version I am currently using (4.31.6)
>and current version (4.34.8), but don't see any difference that might
>point to wildcard acceptance.

You can't use wildcards in this context. For speed, all it needs to do
currently is about 4 hash array lookups. If you allow wildcards you might
as well go back to having a huge conventional ruleset, you will lose all
the speed advantage.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 10:08:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: MCP configuration
Message-ID: <mailman.3207.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 03:39 07/10/2004, you wrote:
>Please advise,
>
>I quite new to Mailscanner. I had recently installed and use it.
>Very good product. And I saw something like MCP subject and content filter.
>
>How do I configure that inorder for it to work?

Please read
www.sng.ecs.soton.ac.uk/mailscanner/install/mcp/
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From a.polli at MIR.IT  Thu Oct  7 10:37:36 2004
From: a.polli at MIR.IT (Aldo Polli)
Date: Thu Jan 12 21:27:10 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3208.1137101230.24926.mailscanner@lists.mailscanner.info>

Hi,
I'm a new user.

I would like to know if it's possibile
to notify the sender but don't deliver the email to the recipients when the
scanning find a virus.

Thank you in advance,
Aldo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dh at UPTIME.AT  Thu Oct  7 11:42:20 2004
From: dh at UPTIME.AT (David HXXhn)
Date: Thu Jan 12 21:27:10 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3209.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Aldo Polli wrote:
| Hi,
| I'm a new user.
|
| I would like to know if it's possibile
| to notify the sender but don't deliver the email to the recipients
when the
| scanning find a virus.
|
Please do NOT do that. 99% of all Virii spoof their From:

If you absolutely have to it makes more sense to inform the intended
recipient.

- -d


- --
nee anata wo mitsukete soshite nidoto wasurezu
~      donna ni munega itakutemo soba ni iru no
~                         zutto...zutto...zutto
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBZR2MPMoaMn4kKR4RA9HmAJ43P14Dk9JXknFe6iBHkDEtKiD25wCfUXxO
R9hSE2BJycfJ4N19JQ/tTbs=
=LIrp
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From a.polli at MIR.IT  Thu Oct  7 11:59:12 2004
From: a.polli at MIR.IT (Aldo Polli)
Date: Thu Jan 12 21:27:10 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3210.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12.42 07/10/2004, David Höhn wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: RIPEMD160
>
>Aldo Polli wrote:
>| Hi,
>| I'm a new user.
>|
>| I would like to know if it's possibile
>| to notify the sender but don't deliver the email to the recipients
>when the
>| scanning find a virus.
>|
>Please do NOT do that. 99% of all Virii spoof their From:
>
>If you absolutely have to it makes more sense to inform the intended
>recipient.


I agree with you.
I'm investigating about it
because someone ask me for that.

Now,  I found the answer (I think)

Deliver Cleaned Messages = no
Notify Senders = yes
Notify Senders Of Viruses = yes

Thanks,
Aldo 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Thu Oct  7 12:03:32 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:10 2006
Subject: Oct  7 10:32:45 marcel dccproc[892]: missing message body; fatal
    error
Message-ID: <mailman.3211.1137101230.24926.mailscanner@lists.mailscanner.info>

Hi there,

i upgraded to the latest MailScanner-Version and to SpamAssassin 3.0.

Suddenly i receive the error in the logfile with every mail i receive and
no content scanning is done.

Are there some people experiencing the same problem?

Any Ideas?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct  7 12:08:39 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:10 2006
Subject: Oct  7 10:32:45 marcel dccproc[892]: missing message body;
    fatal error
Message-ID: <mailman.3212.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Marcel

 From what I remember SA 3.0 and dcc don't work together.

SA people are working on a 3.01 release that should fix this. No idea
when though..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Marcel Blenkers wrote:
> Hi there,
>
> i upgraded to the latest MailScanner-Version and to SpamAssassin 3.0.
>
> Suddenly i receive the error in the logfile with every mail i receive and
> no content scanning is done.
>
> Are there some people experiencing the same problem?
>
> Any Ideas?
>
> Greetings
>
> Marcel
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Thu Oct  7 12:15:34 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:10 2006
Subject: Oct  7 10:32:45 marcel dccproc[892]: missing message body;
    fatal error
Message-ID: <mailman.3213.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 07 October 2004 12:08 +0100 Martin Hepworth
<martinh@SOLID-STATE-LOGIC.COM> wrote:

>  From what I remember SA 3.0 and dcc don't work together.
>
> SA people are working on a 3.01 release that should fix this. No idea
> when though..

Maybe I'm misunderstanding what you're saying here but DCC is working
fine with SA 3.0 for me:

(score=46.713, required 5, autolearn=spam, BAYES_99 1.89, DCC_CHECK
2.17, etc...

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Thu Oct  7 12:33:10 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:10 2006
Subject: Starting of MailScanner and still Running
Message-ID: <mailman.3214.1137101230.24926.mailscanner@lists.mailscanner.info>

Hi there,

as stated before, i updated to the latest version of MailScanner

But after i started the MailScanner-Task again, i saw the following in the
Mail-Log:

Oct  7 13:27:26 marcel sendmail-client[8050]: starting daemon (8.12.6):
queueing
@00:30:00
Oct  7 13:27:26 marcel sendmail-out[8054]: starting daemon (8.12.6):
queueing@00
:30:00
Oct  7 13:27:29 marcel MailScanner[8074]: MailScanner E-Mail Virus Scanner
versi
on 4.34.8 starting...
Oct  7 13:27:33 marcel MailScanner[8076]: Using locktype = flock
Oct  7 13:27:33 marcel MailScanner[8076]: New Batch: Found 5 messages
waiting
Oct  7 13:27:33 marcel MailScanner[8076]: New Batch: Scanning 1 messages,
1647 b
ytes
Oct  7 13:27:37 marcel MailScanner[8076]: Virus and Content Scanning:
Starting
Oct  7 13:27:39 marcel MailScanner[8092]: MailScanner E-Mail Virus Scanner
versi
on 4.34.8 starting...
Oct  7 13:27:42 marcel MailScanner[8076]: Uninfected: Delivered 1 messages
Oct  7 13:27:44 marcel MailScanner[8109]: Using locktype = flock
Oct  7 13:27:51 marcel MailScanner[8108]: Using locktype = flock
Oct  7 13:27:53 marcel MailScanner[8074]: Using locktype = flock
Oct  7 13:28:02 marcel MailScanner[8114]: Using locktype = flock
Oct  7 13:28:04 marcel sendmail[8104]: i9778pTS031606:
to=<marcel@sms-addicts.de
>, delay=04:19:13, xdelay=00:00:22, mailer=local, pri=120385, dsn=2.0.0,
stat=Se
nt
Oct  7 13:28:04 marcel MailScanner[8092]: Using locktype = flock



As it only starts 2 instances of MailScanner, i am wondering where all
these

Using locktype = flock

came from

after i checked the Tasks via ps i saw upto 6 MailScanner tasks and 2 of
them are running for about 1 or 2 days by now..

so i killed them.,,

because..they were running even i stopped MailScanner with

/etc/inet.d/MailScanner stop

and waited for about an hour or so.

The output of MailScanner -v is down here:

Maybe anyone got a idea??



Linux marcel 2.4.21-251-athlon #1 Thu Sep 23 18:48:43 UTC 2004 i686
unknown
This is SuSE Linux 8.1 (i386)
This is Perl version 5.008004 (5.8.4)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.02    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.05    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.06    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
missing Inline
missing Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
missing Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.40    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.32    URI
marcel:~ #





Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct  7 12:34:44 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:10 2006
Subject: Oct  7 10:32:45 marcel dccproc[892]: missing message body;
    fatal error
Message-ID: <mailman.3215.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Mike

maybe I'm imaging it, but I seem to remember problems mentioned on the
SA-users list a couple of weeks ago. I've been flying about alot
recently (Uk->LA->UK->France) so my brain is more scrambled than usual.

I'll see if I can dig out something more concrete.

There's quite alot of issues people are having upgrading to 3.0 so it
might be worth the original poster emailing that list directly..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mike Zanker wrote:
> On 07 October 2004 12:08 +0100 Martin Hepworth
> <martinh@SOLID-STATE-LOGIC.COM> wrote:
>
>>  From what I remember SA 3.0 and dcc don't work together.
>>
>> SA people are working on a 3.01 release that should fix this. No idea
>> when though..
>
>
> Maybe I'm misunderstanding what you're saying here but DCC is working
> fine with SA 3.0 for me:
>
> (score=46.713, required 5, autolearn=spam, BAYES_99 1.89, DCC_CHECK
> 2.17, etc...
>
> Mike.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Thu Oct  7 12:51:40 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:10 2006
Subject: More tasks started then wanted.. (fwd)
Message-ID: <mailman.3216.1137101230.24926.mailscanner@lists.mailscanner.info>

I am sorry..

but those MailScanner-Tasks do not even send Mails out anymore..

so i had to stop those tasks and just use sendmail on its own.

Marcel

---------- Forwarded message ----------
Date: Thu, 7 Oct 2004 13:50:00 +0200 (CEST)
From: Marcel Blenkers <marcel-ml@irc-addicts.de>
To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
Subject: More tasks started then wanted..

Hi there,

ok..i guess i found out some Problem.

In my MailScanner.conf i told MailScanner just to start 2 Children

Max Children = 2


but..after i started MailScanner, i see the following in the Mail-Log:

Oct  7 13:45:19 marcel MailScanner[955]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct  7 13:45:23 marcel MailScanner[957]: Using locktype = posix
Oct  7 13:45:23 marcel MailScanner[957]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:29 marcel MailScanner[959]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct  7 13:45:34 marcel MailScanner[961]: Using locktype = posix
Oct  7 13:45:34 marcel MailScanner[961]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:40 marcel MailScanner[960]: Using locktype = posix
Oct  7 13:45:40 marcel MailScanner[960]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:43 marcel MailScanner[955]: Using locktype = posix
Oct  7 13:45:43 marcel MailScanner[955]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:50 marcel MailScanner[963]: Using locktype = posix
Oct  7 13:45:50 marcel MailScanner[963]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:54 marcel MailScanner[959]: Using locktype = posix
Oct  7 13:45:54 marcel MailScanner[959]: Creating hardcoded struct_flock
subroutine for linux (Linux-type

As you noticed i tried to change the lock-type into posix and no longer
flock, as i used it before..

then i tried the following:

marcel:/etc/init.d # ps -aef | grep MailS
root       954     1  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       955   954  1 13:45 ?        00:00:01 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       957   955  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       959   954  1 13:45 ?        00:00:01 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       960   955  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       961   959  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       963   959  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf


as you can see, there are more tasks then those 2 i wanted and i stated in
the config-file..

any ideas for that problem?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 12:20:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3217.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:59 07/10/2004, you wrote:
>At 12.42 07/10/2004, David Höhn wrote:
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: RIPEMD160
>>
>>Aldo Polli wrote:
>>| Hi,
>>| I'm a new user.
>>|
>>| I would like to know if it's possibile
>>| to notify the sender but don't deliver the email to the recipients
>>when the
>>| scanning find a virus.
>>|
>>Please do NOT do that. 99% of all Virii spoof their From:
>>
>>If you absolutely have to it makes more sense to inform the intended
>>recipient.
>
>
>I agree with you.
>I'm investigating about it
>because someone ask me for that.
>
>Now,  I found the answer (I think)
>
>Deliver Cleaned Messages = no
>Notify Senders = yes
>Notify Senders Of Viruses = yes

Please tell them that this is a terrible idea and will not achieve what 
they think they want. Doing this brings MailScanner into disrepute and 
gives it a very bad name, as you are sending bogus warnings to totally 
innocent people who never sent anything. They then contact me, and I have 
to waste hours of my valuable time telling them that I'm very sorry but 
some very badly maintained copy of MailScanner is sending out this rubbish.

If people persist in doing this, I will simply remove the feature completely.
-- 
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From derek at CSOLVE.NET  Thu Oct  7 13:22:26 2004
From: derek at CSOLVE.NET (Derek Buttineau | Compu-SOLVE)
Date: Thu Jan 12 21:27:10 2006
Subject: FreeBSD Installation Issue
Message-ID: <mailman.3218.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
We're actually using custom startup for exim on this box, not the
mta.sh.. though not sure how that would affect how MailScanner is
reading the configuration file?

We had this exact configuration working on a FreeBSD 4.10, the only
thing that's really changed is the OS version is now FreeBSD
5.2.1-RELEASE-p11.  But again, not sure how that would impact the
parsing of the config file.   I guess I'll have to take a look through
the config parsing process, and see if I can determine why inqueuedir is
coming across blank on startup.. even though it's defined within
MailScanner.conf.

Regards,

Derek Buttineau
Internet Systems Developer
Compu-SOLVE Internet Services
Compu-SOLVE Technologies Inc.

705.725.1212 x255



Ugo Bellavance wrote:

> Derek Buttineau | Compu-SOLVE wrote:
>
>> Okay, I'm having a rather strange problem here attempted to install
>> MailScanner from the latest FreeBSD port.. and I'm wonder if it's
>> perhaps just something I've missed in my dazed stupor!
>>
>> It appears to me that the variables within my MailScanner.conf file
>> aren't being used by the program (though I have confirmed that the
>> config file is being parsed as it'll yell at me good if I duplicate any
>> of the entries, etc)  But the config values themselves are defaulting.
>> IE Incoming Mail Queue is defaulting to /var/spool/mqueue.in even though
>> I've changed it in the configuration file...
>
>
> Are you sure you've put the correct mta in mta.sh?
>
> Ugo
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Thu Oct  7 12:50:00 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:10 2006
Subject: More tasks started then wanted..
Message-ID: <mailman.3219.1137101230.24926.mailscanner@lists.mailscanner.info>

Hi there,

ok..i guess i found out some Problem.

In my MailScanner.conf i told MailScanner just to start 2 Children

Max Children = 2


but..after i started MailScanner, i see the following in the Mail-Log:

Oct  7 13:45:19 marcel MailScanner[955]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct  7 13:45:23 marcel MailScanner[957]: Using locktype = posix
Oct  7 13:45:23 marcel MailScanner[957]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:29 marcel MailScanner[959]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct  7 13:45:34 marcel MailScanner[961]: Using locktype = posix
Oct  7 13:45:34 marcel MailScanner[961]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:40 marcel MailScanner[960]: Using locktype = posix
Oct  7 13:45:40 marcel MailScanner[960]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:43 marcel MailScanner[955]: Using locktype = posix
Oct  7 13:45:43 marcel MailScanner[955]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:50 marcel MailScanner[963]: Using locktype = posix
Oct  7 13:45:50 marcel MailScanner[963]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:54 marcel MailScanner[959]: Using locktype = posix
Oct  7 13:45:54 marcel MailScanner[959]: Creating hardcoded struct_flock
subroutine for linux (Linux-type

As you noticed i tried to change the lock-type into posix and no longer
flock, as i used it before..

then i tried the following:

marcel:/etc/init.d # ps -aef | grep MailS
root       954     1  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       955   954  1 13:45 ?        00:00:01 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       957   955  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       959   954  1 13:45 ?        00:00:01 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       960   955  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       961   959  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       963   959  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf


as you can see, there are more tasks then those 2 i wanted and i stated in
the config-file..

any ideas for that problem?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at CAMAROSS.NET  Thu Oct  7 13:45:25 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:10 2006
Subject: Starting of MailScanner and still Running
Message-ID: <mailman.3220.1137101230.24926.mailscanner@lists.mailscanner.info>

Marcel Blenkers wrote:
> Hi there,
>
> as stated before, i updated to the latest version of MailScanner
>
> But after i started the MailScanner-Task again, i saw the following
> in the
> Mail-Log:
>
> Oct  7 13:27:26 marcel sendmail-client[8050]: starting daemon
> (8.12.6):
> queueing
> @00:30:00
> Oct  7 13:27:26 marcel sendmail-out[8054]: starting daemon (8.12.6):
> queueing@00
>> 30:00
> Oct  7 13:27:29 marcel MailScanner[8074]: MailScanner E-Mail Virus
> Scanner versi on 4.34.8 starting...
> Oct  7 13:27:33 marcel MailScanner[8076]: Using locktype = flock Oct
> 7 13:27:33 marcel MailScanner[8076]: New Batch: Found 5 messages
> waiting Oct  7 13:27:33 marcel MailScanner[8076]: New Batch: Scanning
> 1 messages, 1647 b
> ytes
> Oct  7 13:27:37 marcel MailScanner[8076]: Virus and Content Scanning:
> Starting
> Oct  7 13:27:39 marcel MailScanner[8092]: MailScanner E-Mail Virus
> Scanner versi on 4.34.8 starting...
> Oct  7 13:27:42 marcel MailScanner[8076]: Uninfected: Delivered 1
> messages Oct  7 13:27:44 marcel MailScanner[8109]: Using locktype =
> flock Oct  7 13:27:51 marcel MailScanner[8108]: Using locktype =
> flock Oct  7 13:27:53 marcel MailScanner[8074]: Using locktype =
> flock Oct  7 13:28:02 marcel MailScanner[8114]: Using locktype =
> flock Oct  7 13:28:04 marcel sendmail[8104]: i9778pTS031606:
> to=<marcel@sms-addicts.de
>> , delay=04:19:13, xdelay=00:00:22, mailer=local, pri=120385,
>> dsn=2.0.0,
> stat=Se
> nt
> Oct  7 13:28:04 marcel MailScanner[8092]: Using locktype = flock
>
>
>
> As it only starts 2 instances of MailScanner, i am wondering where
> all these
>
> Using locktype = flock
>
> came from
>
> after i checked the Tasks via ps i saw upto 6 MailScanner tasks and 2
> of them are running for about 1 or 2 days by now..
>
> so i killed them.,,
>
> because..they were running even i stopped MailScanner with
>


What is your Max Children set to in /etc/MailScanner/MailScanner.conf?  6
processes sounds about right if you have the default of 5 max children.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 13:45:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:10 2006
Subject: More tasks started then wanted..
Message-ID: <mailman.3221.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Make sure that MailScanner is actually using your config file and isn't
just working from its own defaults. The default values are "sensible" so
you may not notice. You should always start up MailScanner with the
check_MailScanner script.

At 12:50 07/10/2004, you wrote:
>Hi there,
>
>ok..i guess i found out some Problem.
>
>In my MailScanner.conf i told MailScanner just to start 2 Children
>
>Max Children = 2
>
>
>but..after i started MailScanner, i see the following in the Mail-Log:
>
>Oct  7 13:45:19 marcel MailScanner[955]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  7 13:45:23 marcel MailScanner[957]: Using locktype = posix
>Oct  7 13:45:23 marcel MailScanner[957]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:29 marcel MailScanner[959]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  7 13:45:34 marcel MailScanner[961]: Using locktype = posix
>Oct  7 13:45:34 marcel MailScanner[961]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:40 marcel MailScanner[960]: Using locktype = posix
>Oct  7 13:45:40 marcel MailScanner[960]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:43 marcel MailScanner[955]: Using locktype = posix
>Oct  7 13:45:43 marcel MailScanner[955]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:50 marcel MailScanner[963]: Using locktype = posix
>Oct  7 13:45:50 marcel MailScanner[963]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:54 marcel MailScanner[959]: Using locktype = posix
>Oct  7 13:45:54 marcel MailScanner[959]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type
>
>As you noticed i tried to change the lock-type into posix and no longer
>flock, as i used it before..
>
>then i tried the following:
>
>marcel:/etc/init.d # ps -aef | grep MailS
>root       954     1  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       955   954  1 13:45 ?        00:00:01 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       957   955  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       959   954  1 13:45 ?        00:00:01 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       960   955  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       961   959  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       963   959  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>
>
>as you can see, there are more tasks then those 2 i wanted and i stated in
>the config-file..
>
>any ideas for that problem?
>
>Greetings
>
>Marcel
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Thu Oct  7 13:48:28 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:11 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3222.1137101230.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
IMHO, removal of this feature is overdue.  It should be zapped in the next
release.  It causes you nothing but pain and grief.

Jeff Earickson
Colby College

On Thu, 7 Oct 2004, Julian Field wrote:

>> Notify Senders Of Viruses = yes
>
> Please tell them that this is a terrible idea and will not achieve what they
> think they want. Doing this brings MailScanner into disrepute and gives it a
> very bad name, as you are sending bogus warnings to totally innocent people
> who never sent anything. They then contact me, and I have to waste hours of
> my valuable time telling them that I'm very sorry but some very badly
> maintained copy of MailScanner is sending out this rubbish.
>
> If people persist in doing this, I will simply remove the feature completely.
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 14:03:06 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:11 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3223.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
There is 1 problem. Some people legitimately want to warn the senders of
macro-viruses, which by their very nature do not spoof the From address.
This is what has stopped me removing it in the past.

Any votes either way people?

At 13:48 07/10/2004, you wrote:
>IMHO, removal of this feature is overdue.  It should be zapped in the next
>release.  It causes you nothing but pain and grief.
>
>Jeff Earickson
>Colby College
>
>On Thu, 7 Oct 2004, Julian Field wrote:
>
>>>Notify Senders Of Viruses = yes
>>
>>Please tell them that this is a terrible idea and will not achieve what they
>>think they want. Doing this brings MailScanner into disrepute and gives it a
>>very bad name, as you are sending bogus warnings to totally innocent people
>>who never sent anything. They then contact me, and I have to waste hours of
>>my valuable time telling them that I'm very sorry but some very badly
>>maintained copy of MailScanner is sending out this rubbish.
>>
>>If people persist in doing this, I will simply remove the feature completely.
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From david.hooton at gmail.com  Thu Oct  7 14:09:47 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:11 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3224.1137101231.24926.mailscanner@lists.mailscanner.info>

On Thu, 7 Oct 2004 14:03:06 +0100, Julian Field
<mailscanner@ecs.soton.ac.uk> wrote:
> There is 1 problem. Some people legitimately want to warn the senders of
> macro-viruses, which by their very nature do not spoof the From address.
> This is what has stopped me removing it in the past.

How many macro viruses have you blocked in the last 12 months as a
percentage of all viruses blocked?

I am almost confident in saying that I haven't seen one.

Virus warning emails are now at a point where we have our own
SpamAssassin rulesets to block them.  They are almost as bad at
Barracuda Spam Firewall spam bounces!
--
Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From david.hooton at gmail.com  Thu Oct  7 13:59:08 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:11 2006
Subject: Notify sender not working
Message-ID: <mailman.3225.1137101231.24926.mailscanner@lists.mailscanner.info>

Hi Guys,

I'm running Version 4.34.8 and am trying to get MailScanner to notify
senders of blocked file names via a ruleset so only our internal
customers are notified.

I have got the ruleset in place, but it would appear that filename
notify isn't actually sending an email to the sender.  I have tried
doing the same with the notify senders of viruses and sent a test
through, which did return a message.

Relevant config below:

Notify Senders = yes
Notify Senders Of Blocked Filenames Or Filetypes = yes
Notify Senders Of Other Blocked Content = yes

I have used yes above to eliminate the possibility of ruleset errors causing it.

Have I missed anything?

On a side not it would be really cool if we could have a "Notify
Recipient" option for blocked files - if this is already available,
can someone cluebat me on it?

Any and all help greatly appreciated!
--
Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Thu Oct  7 14:02:43 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:11 2006
Subject: Mail-Scanner starting problems..and what is the cause
Message-ID: <mailman.3226.1137101231.24926.mailscanner@lists.mailscanner.info>

Hi there,

as stated before i did have some problems starting mailscanner etc.

Now i found the error..

I guess it is SpamAssassin 3.0 doing the problem.

Because, if i set the use of SpamAssassin to "no" everything works fine.

Now i downgrade to spamassassin 2.64 and try this one instead..

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Thu Oct  7 14:44:20 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:11 2006
Subject: Mail-Scanner starting problems..and what is the cause
Message-ID: <mailman.3227.1137101231.24926.mailscanner@lists.mailscanner.info>

Hi again..

ok..

>
> I guess it is SpamAssassin 3.0 doing the problem.
>
> Because, if i set the use of SpamAssassin to "no" everything works fine.
>
> Now i downgrade to spamassassin 2.64 and try this one instead..
>
somehow it is really the new SpamAssassin doing the bugs..

but.
if i just do not use spamassassin via mailscanner, but after running
through the mailscanner-process starting spamassassin via procmail
everything works fine..

i have no ideas why this happenes, as on another maschine everything works
just fine..

greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Q.G.Campbell at NEWCASTLE.AC.UK  Thu Oct  7 14:51:26 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:11 2006
Subject: Using "EnvelopeFrom" with MCP and SpamAssassin 3.0.0
Message-ID: <mailman.3228.1137101231.24926.mailscanner@lists.mailscanner.info>

Have installed MailScanner 4.34.8-1 and SpamAssassin 3.0.0.

Have applied the "EnvelopeFrom" patch to SA.pm in MailScanner.

Have in /etc/MailScanner/mcp/local.cf the following rule:

  header    TEST1     EnvelopeFrom =~/carr7\.ncl\.ac\.uk/i
  describe  TEST1     Testing new EnvelopeFrom header
  score     TEST1     10

However this rules is failing to recognise the envelope-from address
which is "root@carr7.ncl.ac.uk.

MCP is working OK otherwise because I can get a Subject-line text rule
to work as expected. That is:

   header   TEST2      Subject =~ /TESTING MCP/
   describe TEST2      Is MCP working OK?
   score    TEST2      10

Causes my MCP configuration to do what I expected the TEST1 rule to do.


Am I missing something?

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From alex at ERUS.CO.UK  Thu Oct  7 15:16:00 2004
From: alex at ERUS.CO.UK (Alex Pimperton)
Date: Thu Jan 12 21:27:11 2006
Subject: More tasks started then wanted..
Message-ID: <mailman.3229.1137101231.24926.mailscanner@lists.mailscanner.info>

Hi

I'm having the same problems, with mailscanner just starting processes until
the RAM and Swap gets used up and the box falls over.

What OS are you running mailscanner on?

I'm fairly sure mailscanner is using the conf file in my case because mails
getting through have the correct headers that are configured in
MailScanner.conf.

Regards

Alex

Hi there,

ok..i guess i found out some Problem.

In my MailScanner.conf i told MailScanner just to start 2 Children

Max Children = 2


but..after i started MailScanner, i see the following in the Mail-Log:

Oct  7 13:45:19 marcel MailScanner[955]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct  7 13:45:23 marcel MailScanner[957]: Using locktype = posix
Oct  7 13:45:23 marcel MailScanner[957]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:29 marcel MailScanner[959]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct  7 13:45:34 marcel MailScanner[961]: Using locktype = posix
Oct  7 13:45:34 marcel MailScanner[961]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:40 marcel MailScanner[960]: Using locktype = posix
Oct  7 13:45:40 marcel MailScanner[960]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:43 marcel MailScanner[955]: Using locktype = posix
Oct  7 13:45:43 marcel MailScanner[955]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:50 marcel MailScanner[963]: Using locktype = posix
Oct  7 13:45:50 marcel MailScanner[963]: Creating hardcoded struct_flock
subroutine for linux (Linux-type)
Oct  7 13:45:54 marcel MailScanner[959]: Using locktype = posix
Oct  7 13:45:54 marcel MailScanner[959]: Creating hardcoded struct_flock
subroutine for linux (Linux-type

As you noticed i tried to change the lock-type into posix and no longer
flock, as i used it before..

then i tried the following:

marcel:/etc/init.d # ps -aef | grep MailS
root       954     1  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       955   954  1 13:45 ?        00:00:01 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       957   955  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       959   954  1 13:45 ?        00:00:01 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       960   955  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       961   959  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf
root       963   959  0 13:45 ?        00:00:00 /usr/bin/perl
-I/usr/lib/MailScanner /usr/sbin/MailScanner
/etc/MailScanner/MailScanner.conf


as you can see, there are more tasks then those 2 i wanted and i stated in
the config-file..

any ideas for that problem?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jaearick at COLBY.EDU  Thu Oct  7 15:15:29 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:11 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3230.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

I occasionally see macro viruses (mostly Marker), but they get flagged in
my daily reports as postmaster, so I can hunt these people down myself.
As long as the "Notices to System Administrators" stuff continues to
work so I see what is going on, then I'm happy.  The users don't need
the clutter.

BTW, I got my MailScanner book yesterday.  Good reading, but too bad it
is out-of-date already! :)  Julian, you need a better picture of yourself
on the back cover.  The one that is there looks like it was taken in a
subway tunnel.  Doesn't Southhampton have a communications and photo
department that could take a better picture of you for publicity purposes?

Jeff Earickson
Colby College

On Thu, 7 Oct 2004, David Hooton wrote:

> Date: Thu, 7 Oct 2004 23:09:47 +1000
> From: David Hooton <david.hooton@gmail.com>
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Notify the sender, but don't deliver
>
> On Thu, 7 Oct 2004 14:03:06 +0100, Julian Field
> <mailscanner@ecs.soton.ac.uk> wrote:
>> There is 1 problem. Some people legitimately want to warn the senders of
>> macro-viruses, which by their very nature do not spoof the From address.
>> This is what has stopped me removing it in the past.
>
> How many macro viruses have you blocked in the last 12 months as a
> percentage of all viruses blocked?
>
> I am almost confident in saying that I haven't seen one.
>
> Virus warning emails are now at a point where we have our own
> SpamAssassin rulesets to block them.  They are almost as bad at
> Barracuda Spam Firewall spam bounces!
> --
> Regards,
>
> David Hooton
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From JHuber at MICROSOURCE.COM  Thu Oct  7 15:32:58 2004
From: JHuber at MICROSOURCE.COM (Jeremy Huber)
Date: Thu Jan 12 21:27:11 2006
Subject: How to find a slowdown?
Message-ID: <mailman.3231.1137101231.24926.mailscanner@lists.mailscanner.info>

Actually, that's exactly what I did (the MTA suggestion).  I realized
that the sa-blacklist also had a version for the sendmail access file,
so I tried that one, and that's MUCH better on the CPU.

Thanks for all the help!

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Thursday, October 07, 2004 1:33 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: How to find a slowdown?


You can blacklist at your MTA and stop these addresses' mail coming in
at all.
Or else use the per-domain/per-user white and blacklist code provided in
CustomConfig.pm in MailScanner. That's very fast.

At 20:27 06/10/2004, you wrote:
>1) The debug output didn't seem to indicate a certain spot where it's
>slow.. I can attach it if it'd help.
>2) Turning the RBL lookups didn't speed it up much at all (just did
>skip_rbl_lookups 1 in spam.assassin.prefs.conf)
>3) I next pulled out all the extra rules_du_jour scripts out
>(70_sare_adult.cf, 70_sare_random.cf, 99_sare_fraud_post25x.cf,
>antidrug.cf, blacklist.cf, bogus-virus-warnings.cf, evilnumbers.cf,
>local.cf, random.cf, tripwire.cf) of the /etc/mail/spamassassin
>directory, and now the spam checks are up around 4500 bytes per second,
>and screaming through the queue.
>4) Turned back on RBL, and added all the .cf files EXCEPT the blacklist
>in, and tried again, still screaming through them.
>5) Added in the blacklist - slower than snot.
>
>Ok, so the next question is: Is there a better way to do the
>blacklisting?  I'm doing the spam.bydomain extra stuff, too, or I'd
just
>add it into the MS blacklist..
>
>(Thanks!)
>Jeremy
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf Of Jeff A. Earickson
>Sent: Wednesday, October 06, 2004 11:02 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: How to find a slowdown?
>
>
>Quick advice, run MailScanner in debug mode and see what happens.
>I'll bet that it gets slow on DNS lookups.  It always helps to run
>a caching DNS (stealth secondary) on your mail server.
>
>Jeff Earickson
>Colby College
>
>On Wed, 6 Oct 2004, Jeremy Huber wrote:
>
> > Date: Wed, 6 Oct 2004 10:32:54 -0600
> > From: Jeremy Huber <JHuber@MICROSOURCE.COM>
> > Reply-To: MailScanner mailing list <MAILSCANNER@JISCMAIL.AC.UK>
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: How to find a slowdown?
> >
> > I've got a case where our brand new server that I put MailScanner on
>is
> > just CRAWLING.  Dual 2.4Ghz Xeon with 4GB RAM running Fedora Core 2,
>MS
> > 4.33.3, and SA 2.63 (I've turned off the virus scanning
temporarily).
> > We only push somewhere around 50k messages a day through it, so I'm
>not
> > sure why it's so slow.  It almost always has hundreds of messages in
>the
> > inbound queue.  I tried turning on LOG_SPEED, and the spam scanning
> > speed is usually around 600 bytes per second.  That seems insanely
>slow,
> > but I didn't what's "good."  I've got SA using DCC and Pyzor as well
>as
> > maybe 6 of the rulesets out of the rdj (one of which being the
> > blacklist).  Am I just making SA do too much, and that's why it's so
> > slow?
> >
> > Thanks for any help you guys can give!
> >
> > Jeremy

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From JHuber at MICROSOURCE.COM  Thu Oct  7 16:05:53 2004
From: JHuber at MICROSOURCE.COM (Jeremy Huber)
Date: Thu Jan 12 21:27:11 2006
Subject: Strange repeating "Spam not delivered"
Message-ID: <mailman.3232.1137101231.24926.mailscanner@lists.mailscanner.info>

Newest issue...

I was just told by a customer of ours that they weren't getting copies
of their 'spam'.  I had them set to attachment, which evidentally wasn't
doing anything.  No biggie, I just changed it from attachment to notify.
Unfortunately now, when the 'notify' message goes out to the fake
addresses, it looks like this: 

{Spam not delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not
delivered} {Spam not delivered} {Spam not delivered} {Spam not deli!

Any ideas why it's not just doing it once?

--
Jeremy Huber, SCSA, LCP
jhuber@microsource.com
Datacenter Engineer
Microsource, Inc

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rgreen at TRAYERPRODUCTS.COM  Thu Oct  7 16:01:57 2004
From: rgreen at TRAYERPRODUCTS.COM (Rodney Green)
Date: Thu Jan 12 21:27:11 2006
Subject: Spamassassin/mailscanner
Message-ID: <mailman.3233.1137101231.24926.mailscanner@lists.mailscanner.info>

Any known issues with updating spamassassin to version 3? If I install the
updated version of spamassasin will it work with MailScanner automatically?
I have MailScanner configured to use SA and have been using it for a while
now.

Thanks,
Rod

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Thu Oct  7 16:25:38 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:11 2006
Subject: Spamassassin/mailscanner
Message-ID: <mailman.3234.1137101231.24926.mailscanner@lists.mailscanner.info>

> Any known issues with updating spamassassin to version 3? If
> I install the updated version of spamassasin will it work
> with MailScanner automatically?
> I have MailScanner configured to use SA and have been using it for a
> while now.
>
Please read over the archives. This has been a very "hot" topic since the
release of SA 3.0

Michele



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From brent.bolin at gmail.com  Thu Oct  7 16:28:16 2004
From: brent.bolin at gmail.com (BB)
Date: Thu Jan 12 21:27:11 2006
Subject: How can a flag mail from specific mail relays as spam
Message-ID: <mailman.3235.1137101231.24926.mailscanner@lists.mailscanner.info>

Recently had discussions about secondary mail server giving us the
most spam.  Some of it still gets through sa filters.

Would actually like to create our own secondary and setup as tarpit as
no valid mail should be sent to them if primary is up.

Before doing the above, is there a way to flag mail coming from the
secondary as spam ?

Doesn't blacklisting from only apply to the sender domain  and not the
relays between ?

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From brent.bolin at gmail.com  Thu Oct  7 16:33:57 2004
From: brent.bolin at gmail.com (BB)
Date: Thu Jan 12 21:27:11 2006
Subject: Out of Office AutoReply: How can a flag mail from specific
    mail r elays as spam
Message-ID: <mailman.3236.1137101231.24926.mailscanner@lists.mailscanner.info>

Guess you won't have the answer


On Thu, 7 Oct 2004 08:34:23 -0700, Michael St. Laurent
<mikes@hartwellcorp.com> wrote:
> I am currently out of the office. Please contact Cinda if you have any
> questions.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Thu Oct  7 16:35:10 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:11 2006
Subject: How can a flag mail from specific mail relays as spam
Message-ID: <mailman.3237.1137101231.24926.mailscanner@lists.mailscanner.info>

> Recently had discussions about secondary mail server giving
> us the most spam.  Some of it still gets through sa filters.
>
> Would actually like to create our own secondary and setup as
> tarpit as no valid mail should be sent to them if primary is up.
>
> Before doing the above, is there a way to flag mail coming
> from the secondary as spam ?
>
> Doesn't blacklisting from only apply to the sender domain
> and not the relays between ?
>
> Thanks
>


You could blacklist the IP of the other mail server, but how you would
implement that in a "sane" fashion whilst dealing with multiple MX records
is another matter

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From kodak at FRONTIERHOMEMORTGAGE.COM  Thu Oct  7 16:35:53 2004
From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki)
Date: Thu Jan 12 21:27:11 2006
Subject: Out of Office AutoReply: How can a flag mail from specific
    mail r elays as spam
Message-ID: <mailman.3238.1137101231.24926.mailscanner@lists.mailscanner.info>

Turn off your vacation auto-reply, or configure it to not send mail
to mailing lists.

It is a HUGE security risk to you, and annoying to people who
actually PARTICIPATE in mailing lists as opposed to just lurking.

Do you know how annoying it is to have hundreds of list users tell
me that they're on vacation when I DON'T KNOW THEM AND I DON'T CARE?

Also, now anyone who sends a message to this mailing list
is going to know that you're on vacation and not watching
your stuff.  Consider the following scenario:

Bad guy: "Hi, I know <this guy's> out today, but he had
mentioned that I could do some maintenance for him, problem
is I forgot <some piece of information that can be wheedled
from your cow-orker and used to gain unauthorized access>
could you tell me what that was again?"

Your cow-orker:  "Yeah, sure, if you know <this guy>, here's
the <password | PIN | dress size>."

Since you've probably given your phone number, alternate
contact, etc, it makes it that much easier for an attacker
to socially engineer information out of your cow-orkers.

This has been a form letter.  Be aware that I'm equally annoyed
by each and every "Out of Office" message I receive.

--J(K)

PS:  yes, I mean "cow-orker".

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Mark.Pottage at SELECTION.CO.UK  Thu Oct  7 16:50:15 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:11 2006
Subject: Signature Rules Files..
Message-ID: <mailman.3239.1137101231.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I have a "inline.sig.html.rules" file which decides who has what type of
sinature...
 
Does the line in bold stop a signature being used?  If not what is the
best / correct way to setup a domain not to have a signature added to
e-mails FromOrTo them.
 
 
# This will sign incoming and outgoing messages to xyz.com
# with the contents of the file xyz.com.sig.html
FromOrTo: xyz.com /etc/MailScanner/reports/en/xyz.com.sig.html
 
# This will sign only outgoing messages to abc.com
# with the contents of the file abc.com.sig.html
# From:  abc.com    /etc/MailScanner/reports/en/abc.com.sig.html

# FromOrTo:  domain.co.uk   no

# This will sign everything else incoming or outgoing with the standard
signature
FromOrTo:  default    /etc/MailScanner/reports/en/inline.sig.html
 
many thanks
 
Mark Pottage
Systems Administrator
0870 411 7914
07740 578 647
mark.pottage@selection.co.uk

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  18 lines. ]
    [ Unable to print this part. ]


From brent.bolin at gmail.com  Thu Oct  7 16:53:25 2004
From: brent.bolin at gmail.com (BB)
Date: Thu Jan 12 21:27:11 2006
Subject: How can a flag mail from specific mail relays as spam
Message-ID: <mailman.3240.1137101231.24926.mailscanner@lists.mailscanner.info>

Not terrible concerned about the primary, we are the primary and
haven't been down for any length of time in years.  As was posted some
time ago, the rational of a secondary is questionable.

We have a full T1 and don't appear to really ever have bottlenecks.

If I blacklist the IP of our secondary will that flag spam as From: ?

btb


On Thu, 7 Oct 2004 07:39:09 -0800, Kevin Miller
<kevin_miller@ci.juneau.ak.us> wrote:
> BB wrote:
> > Recently had discussions about secondary mail server giving us the
> > most spam.  Some of it still gets through sa filters.
> >
> > Would actually like to create our own secondary and setup as tarpit
> > as no valid mail should be sent to them if primary is up.
> >
> > Before doing the above, is there a way to flag mail coming from the
> > secondary as spam ?
>
> Sure, couple of things you could do - set MS to change the subject to
> reflect the source, i.e., prepend "Tarpit" to the front of the subject line,
> set your spam score to -25 or something like that; all mail would then be
> spam.
>
> But if your primary fails, you'll have legitimate mail going to the
> secondary.  FWIW, I do get a fair amount of ham going to my secondary
> servers, probably because the primary is on a congested line.  You'll
> probably need to watch pretty closely the first week or so.
>
> > Doesn't blacklisting from only apply to the sender domain  and not
> > the relays between ?
>
> I think so, but may well be wrong...
>
> ...Kevin
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Thu Oct  7 17:05:31 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:11 2006
Subject: some SURBL hits that I don't understand
Message-ID: <mailman.3241.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:06 AM 10/7/2004, Niklas Olofsson wrote:
>Every days since we upgraded to SA 3 we get some email's that contain's
>no URL:s but still get scores from 3 different SURBL list's. I have some
>problems troubleshooting this because if I send these messeages thru the
>system again I get no SURBL hits, very strange....
>
>Any tip how on I can troubleshoot this would be appreciated.

Are you positive the message is in it's true original form with all
original mime sections? or are you using a forwarded copy that your
mailclient has had a chance to manhandle?

Many mailclients strip out mime sections they don't understand. Groupwise
(your MUA) and Eudora (mine) both tend to do this.

I suspect that you're not getting the full, original message with all it's
original mime sections when you run it through SA the second time, because
it's been "normalized" (aka stripped down) by Groupwise.

You *might* be able to get a complete message using groupwise's partially
hidden "mime.822" attachment. Right click the message, pick "view" instead
of "open". mime.822 should be in the list of attachments near the top. I'm
not sure if mime.822 has been mime-section-stripped or not, I don't use GW
that much, but I know it at least has full headers.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Thu Oct  7 17:14:21 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:11 2006
Subject: How can a flag mail from specific mail relays as spam
Message-ID: <mailman.3242.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:28 AM 10/7/2004, BB wrote:
>Recently had discussions about secondary mail server giving us the
>most spam.  Some of it still gets through sa filters.
>
>Would actually like to create our own secondary and setup as tarpit as
>no valid mail should be sent to them if primary is up.

That statement is a common misconception, but it is completely incorrect.
Legitimate mail does sometimes go to your secondary, even if the primary is up.

No legitimate mailler will try the secondary, unless it fails to connect to
the primary. This is true. However, failures can happen at any point in the
internet, not just your end.

Mind you that a sending network might have an outage. Their network might
be down when they try the primary, but may be back up when it tries the
secondary. This is perfectly ordinary, legitimate situation in which valid
email will go to your secondary, even if your primary is up.

It is true that more spam goes to the secondary, but it's simply not true
that no legitimate mail will go to the secondary if the primary stays up.


>Before doing the above, is there a way to flag mail coming from the
>secondary as spam ?

Yes, there's a way.. you can add a custom header rule for it that matches
on the Received: header generated by your secondary.

http://wiki.apache.org/spamassassin/WritingRules?action=highlight&value=rules

However, you might first wish to consider adding your secondary to your
trusted_networks on your SA primary if you use DNSBLs in SA. This will help
the DUL RBL's properly match mail sent to your secondary from a dialup,
which helps immensely.

>Doesn't blacklisting from only apply to the sender domain  and not the
>relays between ?

SA's blacklist_from, etc only applies to email addresses, not mailservers.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 18:08:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:11 2006
Subject: Strange repeating "Spam not delivered"
Message-ID: <mailman.3243.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
You probably wanted "attachment deliver" instead of just "attachment".

At 16:05 07/10/2004, you wrote:
>Newest issue...
>
>I was just told by a customer of ours that they weren't getting copies
>of their 'spam'.  I had them set to attachment, which evidentally wasn't
>doing anything.  No biggie, I just changed it from attachment to notify.
>Unfortunately now, when the 'notify' message goes out to the fake
>addresses, it looks like this:
>
>{Spam not delivered} {Spam not delivered} {Spam not delivered} {Spam not
>delivered} {Spam not delivered} {Spam not delivered} {Spam not
>delivered} {Spam not delivered} {Spam not delivered} {Spam not
>delivered} {Spam not delivered} {Spam not delivered} {Spam not

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 18:12:49 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:11 2006
Subject: Signature Rules Files..
Message-ID: <mailman.3244.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html>
<body>
At 16:50 07/10/2004, you wrote:<br>
<blockquote type=cite class=cite cite="">I have a
&quot;inline.sig.html.rules&quot; file which decides who has what type of
sinature...<br>
&nbsp;<br>
Does the line in bold stop a signature being used?&nbsp; If not what is
the best / correct way to setup a domain not to have a signature added to
e-mails FromOrTo them.<br>
&nbsp;<br>
&nbsp;<br>
# This will sign incoming and outgoing messages to xyz.com<br>
# with the contents of the file xyz.com.sig.html<br>
FromOrTo: xyz.com /etc/MailScanner/reports/en/xyz.com.sig.html<br>
&nbsp;<br>
# This will sign only outgoing messages to abc.com<br>
# with the contents of the file abc.com.sig.html<br>
# From:&nbsp; abc.com&nbsp;&nbsp;&nbsp;
/etc/MailScanner/reports/en/abc.com.sig.html<br><br>
<b># FromOrTo:&nbsp; domain.co.uk&nbsp;&nbsp; no</b></blockquote><br>
&quot;no&quot; is not a valid response for this configuration parameter,
as it expecting a filename. A filename that provides no text is /dev/null
so I suggest you use that.</body>
<br>
<div>-- </div>
<div>Julian Field</div>
<div><a href="http://www.mailscanner.info/" EUDORA=AUTOURL>www.MailScanner.info</a></div>
<div>Professional Support Services at
<a href="http://www.mailscanner.biz/" EUDORA=AUTOURL>www.MailScanner.biz</a></div>
<div>MailScanner thanks transtec Computers for their support</div>
<div>Buy the MailScanner book at
<a href="http://www.mailscanner.info/store" EUDORA=AUTOURL>www.MailScanner.info/store</a></div>
<br>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 18:06:27 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:11 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3245.1137101231.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 15:15 07/10/2004, you wrote:
>BTW, I got my MailScanner book yesterday.  Good reading, but too bad it
>is out-of-date already! :)  Julian, you need a better picture of yourself
>on the back cover.  The one that is there looks like it was taken in a
>subway tunnel.  Doesn't Southhampton have a communications and photo
>department that could take a better picture of you for publicity purposes?

The photo was taken in a white-walled corridor and then Photoshopped. Yes,
a better one would be a good idea. Most good photos of me are identifiable
by not having me in them.

I'll try to update it every few months to keep it up to date, it's
definitely not going to get too out of date. If I do that, then I can keep
you buying new versions :-)

>On Thu, 7 Oct 2004, David Hooton wrote:
>>Date: Thu, 7 Oct 2004 23:09:47 +1000
>>From: David Hooton <david.hooton@gmail.com>
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Notify the sender, but don't deliver
>>
>>On Thu, 7 Oct 2004 14:03:06 +0100, Julian Field
>><mailscanner@ecs.soton.ac.uk> wrote:
>>>There is 1 problem. Some people legitimately want to warn the senders of
>>>macro-viruses, which by their very nature do not spoof the From address.
>>>This is what has stopped me removing it in the past.
>>
>>How many macro viruses have you blocked in the last 12 months as a
>>percentage of all viruses blocked?
>>
>>I am almost confident in saying that I haven't seen one.
>>
>>Virus warning emails are now at a point where we have our own
>>SpamAssassin rulesets to block them.  They are almost as bad at
>>Barracuda Spam Firewall spam bounces!

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct  7 18:04:01 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: More tasks started then wanted..
Message-ID: <mailman.3246.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Have you tried starting it with "Debug = yes"?
Does that print anything unexpected?

At 15:16 07/10/2004, you wrote:
>Hi
>
>I'm having the same problems, with mailscanner just starting processes until
>the RAM and Swap gets used up and the box falls over.
>
>What OS are you running mailscanner on?
>
>I'm fairly sure mailscanner is using the conf file in my case because mails
>getting through have the correct headers that are configured in
>MailScanner.conf.
>
>Regards
>
>Alex
>
>Hi there,
>
>ok..i guess i found out some Problem.
>
>In my MailScanner.conf i told MailScanner just to start 2 Children
>
>Max Children = 2
>
>
>but..after i started MailScanner, i see the following in the Mail-Log:
>
>Oct  7 13:45:19 marcel MailScanner[955]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  7 13:45:23 marcel MailScanner[957]: Using locktype = posix
>Oct  7 13:45:23 marcel MailScanner[957]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:29 marcel MailScanner[959]: MailScanner E-Mail Virus Scanner
>version 4.34.8 starting...
>Oct  7 13:45:34 marcel MailScanner[961]: Using locktype = posix
>Oct  7 13:45:34 marcel MailScanner[961]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:40 marcel MailScanner[960]: Using locktype = posix
>Oct  7 13:45:40 marcel MailScanner[960]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:43 marcel MailScanner[955]: Using locktype = posix
>Oct  7 13:45:43 marcel MailScanner[955]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:50 marcel MailScanner[963]: Using locktype = posix
>Oct  7 13:45:50 marcel MailScanner[963]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type)
>Oct  7 13:45:54 marcel MailScanner[959]: Using locktype = posix
>Oct  7 13:45:54 marcel MailScanner[959]: Creating hardcoded struct_flock
>subroutine for linux (Linux-type
>
>As you noticed i tried to change the lock-type into posix and no longer
>flock, as i used it before..
>
>then i tried the following:
>
>marcel:/etc/init.d # ps -aef | grep MailS
>root       954     1  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       955   954  1 13:45 ?        00:00:01 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       957   955  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       959   954  1 13:45 ?        00:00:01 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       960   955  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       961   959  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>root       963   959  0 13:45 ?        00:00:00 /usr/bin/perl
>-I/usr/lib/MailScanner /usr/sbin/MailScanner
>/etc/MailScanner/MailScanner.conf
>
>
>as you can see, there are more tasks then those 2 i wanted and i stated in
>the config-file..
>
>any ideas for that problem?
>
>Greetings
>
>Marcel
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ianb at OPTEQINT.NET  Thu Oct  7 18:56:43 2004
From: ianb at OPTEQINT.NET (Ian Barnes)
Date: Thu Jan 12 21:27:12 2006
Subject: Attaching a Signature to Clean Outbound mail
Message-ID: <mailman.3247.1137101232.24926.mailscanner@lists.mailscanner.info>

Hi,

I am doing bi-directional scanning and was wondering if its possible to add
a signature to clean outbound mail. I was going through MailScanner.conf and
saw that their is the option "Sign Clean Messages " but its not clear if
this is outbound or incoming. Is there a way to set them both seperately ?

Thanks alot,
Ian Barnes

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscan at PRIS.CA  Thu Oct  7 18:16:12 2004
From: mailscan at PRIS.CA (MailScanner Mailbox)
Date: Thu Jan 12 21:27:12 2006
Subject: MailScanner and Mail::ClamAV
Message-ID: <mailman.3248.1137101232.24926.mailscanner@lists.mailscanner.info>

Hello

What version of clamav are you using?
It it is one of the release candidates  then the perl module will not
work.

>From the author:

> The README mentions which version of libclamav Mail::ClamAV has been
> tested with, 0.75. I'm not planning on releasing versions of
> Mail::ClamAV for the libclamav release candidates. You can ether wait
> for 0.80 to come out or use 0.75*.

Hope this helps

Rick

On Wed, 6 Oct 2004, Moacyr Leite da Silva wrote:

> With MailScanner-4.34.8-1 - I installed the MailScanner and Install-ClamAV-SA - and did the install of clamavmodule correctly (Mail::ClamAV - build Mail-ClamAV-0.11)
>
> With MailScanner-4.34.8-4 - I received the following error when i try to install Mail::ClamAV
>
> I already tryed to force install of module via MCPAN but no success.
>
> Some tip?
>
> Thanks
> Moacyr Leite da Silva
>
> rict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386 -mcpu=i686   -DVERSION=\"0.11\" -DXS_VERSION=\"0.11\" -fPIC "-I/usr/lib/perl5/5.8.0/i386-linux-thread-multi/CORE"   ClamAV.c
> ClamAV.xs: In function `clamav_perl__scanbuff':
> ClamAV.xs:141: warning: passing arg 3 of `cl_scanbuff' from incompatible pointer type
> ClamAV.xs: In function `clamav_perl__scanfd':
> ClamAV.xs:181: warning: passing arg 2 of `cl_scandesc' from incompatible pointer type
> ClamAV.xs: In function `clamav_perl__scanfile':
> ClamAV.xs:217: warning: passing arg 2 of `cl_scanfile' from incompatible pointer type
> ClamAV.xs: In function `clamav_perl_constant':
> ClamAV.xs:262: `CL_EOLE2' undeclared (first use in this function)
> ClamAV.xs:262: (Each undeclared identifier is reported only once
> ClamAV.xs:262: for each function it appears in.)
> ClamAV.xs:281: `CL_OLE2' undeclared (first use in this function)
> ClamAV.xs:282: `CL_ENCRYPTED' undeclared (first use in this function)
> make[1]: *** [ClamAV.o] Error 1
> make[1]: Leaving directory `/root/.cpan/build/Mail-ClamAV-0.11/_Inline/build/Mail/ClamAV'
>
> A problem was encountered while attempting to compile and install your Inline
> C code. The command that failed was:
>   make
>
>
>
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ianb at OPTEQINT.NET  Thu Oct  7 19:27:46 2004
From: ianb at OPTEQINT.NET (Ian Barnes)
Date: Thu Jan 12 21:27:12 2006
Subject: Attaching a Signature to Clean Outbound mail
Message-ID: <mailman.3249.1137101232.24926.mailscanner@lists.mailscanner.info>

Hi,

Thanks alot for the info. Would the following work for only adding a
signature to outbound:

   From:        default                yes
   To:              default                no

I dont want to specify an ip range or a domain that the mail will be coming
from, rather just a global yes or global no.

Thanks alot,
Ian

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
Behalf Of Peter Bonivart
Sent: 07 October 2004 20:18
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Attaching a Signature to Clean Outbound mail


Ian Barnes wrote:
> I am doing bi-directional scanning and was wondering if its possible to
add
> a signature to clean outbound mail. I was going through MailScanner.conf
and
> saw that their is the option "Sign Clean Messages " but its not clear if
> this is outbound or incoming. Is there a way to set them both seperately ?

You need to look at rule sets. Point "Sign Clean Messages" to a rule set
and in that you have no as the default and yes for local mail. Look at
the EXAMPLE file in the rules directory.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From lars+lister.mailscanner at ADVENTURAS.NO  Thu Oct  7 19:58:39 2004
From: lars+lister.mailscanner at ADVENTURAS.NO (Lars Kristiansen)
Date: Thu Jan 12 21:27:12 2006
Subject: perl trouble
Message-ID: <mailman.3250.1137101232.24926.mailscanner@lists.mailscanner.info>

> You ever get a solution to this?

Sorry, no.
Been doing other work. But will get back to it later.
I am clueless at this point. But i am kind of a beginner in freebsd (and
perl in ports) so it it could really be a number of things.

--
Lars





----------------------------------------------------------------
Tjenesten mail.adventuras.no ble levert av Adventuras Web Agency
http://www.adventuras.no/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 05:38:44 2004
From: mailscanner at ecs.soton.ac.uk (mailscanner@ecs.soton.ac.uk)
Date: Thu Jan 12 21:27:12 2006
Subject: {Dangerous Filename?} Virus Alert: Re: Document
Message-ID: <mailman.3251.1137101232.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "Windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Warning: This message has had one or more attachments removed
Warning: (your_document.pif.htm).
Warning: Please read the "ECS-Attachment-Warning.txt" attachment(s) for more information.

Your file is attached.

    [ Part 2, Text/PLAIN (Name: "ECS-Attachment-Warning.txt")  20 lines. ]
    [ Unable to print this part. ]


From peter at UCGBOOK.COM  Thu Oct  7 19:17:32 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:12 2006
Subject: Attaching a Signature to Clean Outbound mail
Message-ID: <mailman.3252.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ian Barnes wrote:
> I am doing bi-directional scanning and was wondering if its possible to add
> a signature to clean outbound mail. I was going through MailScanner.conf and
> saw that their is the option "Sign Clean Messages " but its not clear if
> this is outbound or incoming. Is there a way to set them both seperately ?

You need to look at rule sets. Point "Sign Clean Messages" to a rule set
and in that you have no as the default and yes for local mail. Look at
the EXAMPLE file in the rules directory.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Thu Oct  7 19:46:44 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:12 2006
Subject: Attaching a Signature to Clean Outbound mail
Message-ID: <mailman.3253.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ian Barnes wrote:
> Thanks alot for the info. Would the following work for only adding a
> signature to outbound:
>
>    From:        default                yes
>    To:              default                no
>
> I dont want to specify an ip range or a domain that the mail will be coming
> from, rather just a global yes or global no.

No, you can never have multiple defaults in a rule set. I would
recommend using an IP range, why don't you want to use that? It's really
easy:

From:           192.168.        yes
FromOrTo:       default         no

Of course, replace 192.168 with your numbers.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From kevinold at gmail.com  Thu Oct  7 20:28:09 2004
From: kevinold at gmail.com (Kevin Old)
Date: Thu Jan 12 21:27:12 2006
Subject: Ruleset to archive mail
Message-ID: <mailman.3254.1137101232.24926.mailscanner@lists.mailscanner.info>

Hello everyone,

I've been trying to create a ruleset that would copy mail, from or to
kevin@kevin.com to the directory /root/marchive with little success.

First, I must state that I can archive *all* mail by setting "Archive
Mail = /root/marchive" in MailScanner.conf.

I've tried the following ( taken from
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/177.html):

In /etc/MailScanner/MailScanner.conf:

Archive Mail = %rules-dir%/archive.rules

In %rules-dir%/archive.rules:

FromOrTo:      kevin@kevin.com      yes
FromOrTo:      default       /root/marchive


I've tried so many variations of this that I can't even begin to start
listing them.

Can someone tell me what I'm doing wrong?

Thanks,
Kevin
--
Kevin Old
kevinold@gmail.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greyhair at GREYHAIR.NET  Thu Oct  7 20:39:27 2004
From: greyhair at GREYHAIR.NET (greyhair)
Date: Thu Jan 12 21:27:12 2006
Subject: Ruleset to archive mail
Message-ID: <mailman.3255.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Kevin:

   try this:

  FromOrTo:      kevin@kevin.com      /root/marchive


greyhair


Kevin Old wrote:
> Hello everyone,
>
> I've been trying to create a ruleset that would copy mail, from or to
> kevin@kevin.com to the directory /root/marchive with little success.
>
> First, I must state that I can archive *all* mail by setting "Archive
> Mail = /root/marchive" in MailScanner.conf.
>
> I've tried the following ( taken from
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/177.html):
>
> In /etc/MailScanner/MailScanner.conf:
>
> Archive Mail = %rules-dir%/archive.rules
>
> In %rules-dir%/archive.rules:
>
> FromOrTo:      kevin@kevin.com      yes
> FromOrTo:      default       /root/marchive
>
>
> I've tried so many variations of this that I can't even begin to start
> listing them.
>
> Can someone tell me what I'm doing wrong?
>
> Thanks,
> Kevin
> --
> Kevin Old
> kevinold@gmail.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From kevinold at gmail.com  Thu Oct  7 21:04:21 2004
From: kevinold at gmail.com (Kevin Old)
Date: Thu Jan 12 21:27:12 2006
Subject: Ruleset to archive mail
Message-ID: <mailman.3256.1137101232.24926.mailscanner@lists.mailscanner.info>

On Thu, 7 Oct 2004 14:39:27 -0500, greyhair <greyhair@greyhair.net> wrote:
> Kevin:
>
>    try this:
>
>   FromOrTo:      kevin@kevin.com      /root/marchive

Thanks for these suggestions, but neither of them work.  I'm using MS
4.26.  Would upgrading  make a difference?

Thanks,
Kevin
--
Kevin Old
kevinold@gmail.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From kevinold at gmail.com  Thu Oct  7 21:48:50 2004
From: kevinold at gmail.com (Kevin Old)
Date: Thu Jan 12 21:27:12 2006
Subject: Ruleset to archive mail
Message-ID: <mailman.3257.1137101232.24926.mailscanner@lists.mailscanner.info>

On Thu, 7 Oct 2004 16:04:21 -0400, Kevin Old <kevinold@gmail.com> wrote:
> On Thu, 7 Oct 2004 14:39:27 -0500, greyhair <greyhair@greyhair.net> wrote:
> > Kevin:
> >
> >    try this:
> >
> >   FromOrTo:      kevin@kevin.com      /root/marchive
>
> Thanks for these suggestions, but neither of them work.  I'm using MS
> 4.26.  Would upgrading  make a difference?
>

Well, I've sovled it.  Turns out  I didn't have the extra % after the
"dir" in %rules-dir% and my rule was never being executed.

Thanks for all the suggestions,
Kevin

--
Kevin Old
kevinold@gmail.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From cstone at AXINT.NET  Thu Oct  7 22:09:56 2004
From: cstone at AXINT.NET (Chris Stone)
Date: Thu Jan 12 21:27:12 2006
Subject: MailScanner 4.33.3
Message-ID: <mailman.3258.1137101232.24926.mailscanner@lists.mailscanner.info>

I have MailScanner installed and running nicely on a number of Intel based
Linux boxes - no problems. However I just installed it recently on a Mac OSx
(10.3) and it runs nicely for awhile and then just stops. Tailing the
mail.log file shows the processing running along and then suddenly the
entries stop and if I run check_mailscanner it shows usually just a single
process (shows 8 to 10 normally), or sometimes 2, but nothing is happening.

Tried running in debug mode a bit, but since there's apparently no problems
processing messages, that's not really  helping.

Anyone else install on a Mac and seeing any issues? Or have an idea as to
what might be causing this or how to further track down and resolve the
issue??


Chris Stone, MCSE
AxisInternet, Inc.


--------------------------------------------------------------------
Chris Stone, MCSE
Vice President, CTO
AxisInternet, Inc.
910 16th St., Suite 1110, Denver, CO 80202
--------------------------------------------------------------------
PH  303.592.AXIS  -  866.317.AXIS  |  FAX  303.893.AXIS
--------------------------------------------------------------------
cstone@axint.net   |   www.axint.net
--------------------------------------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From chardlist at CHARD.NET  Thu Oct  7 23:23:57 2004
From: chardlist at CHARD.NET (Brendan Chard)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues
Message-ID: <mailman.3259.1137101232.24926.mailscanner@lists.mailscanner.info>

I'm attempting a fresh install of mailscanner from FreeBSD Port to a FreeBSD
4.7 machine.

(Perl 5.6.1, SA 2.64, MS 4.33.3)

I've done this install without issue on other similar FreeBSD machines but
when I attempt to start mailscanner using the script in ../rc.d/ I get the
following errors.  Any help is greatly appreciated.

Can't locate object method "SWASHNEW" via package "utf8" (perhaps you forgot
to load "utf8"?) at
/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
Compilation failed in require at
/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
BEGIN failed--compilation aborted at
/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
Compilation failed in require at
/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
BEGIN failed--compilation aborted at
/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
Compilation failed in require at /usr/local/libexec/MailScanner/MailScanner
line 51.
BEGIN failed--compilation aborted at
/usr/local/libexec/MailScanner/MailScanner line 51.

-Brendan

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mbrijun at hotmail.com  Fri Oct  8 00:38:48 2004
From: mbrijun at hotmail.com (Martynas Brijunas)
Date: Thu Jan 12 21:27:12 2006
Subject: mailscanner 4.34 seems to affect apt-get
Message-ID: <mailman.3260.1137101232.24926.mailscanner@lists.mailscanner.info>

Hello,

after installing mailscanner 4.34 with the help of install.sh I tried
running my weekly apt-get upgrade. Apt-get gave me an error regarding perl-
MIME-Base64 saying that this module is obsolete. The only way forward was
using "apt-get -f install" which in turn suggested.... uninstalling
mailscanner and perl-MIME-Base64. That was clearly not an option.

The system in question is Fedora Core 2. Please advise if any of you have
faced the same problems.

Martin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james_gray at ocs.com  Thu Oct  7 23:18:39 2004
From: james_gray at ocs.com (James Gray)
Date: Thu Jan 12 21:27:12 2006
Subject: Spamassassin/mailscanner
Message-ID: <mailman.3261.1137101232.24926.mailscanner@lists.mailscanner.info>

On Fri, 8 Oct 2004 01:01 am, Rodney Green wrote:
> Any known issues with updating spamassassin to version 3? If I install the
> updated version of spamassasin will it work with MailScanner automatically?
> I have MailScanner configured to use SA and have been using it for a while
> now.
>
> Thanks,
> Rod

As Michele Neylon suggests - there is a lot in the last 3 months of archives
for this list, but having done exactly what you are considering  just a few
days ago, here's the "gotcha's" that caught us:

1. Remove the Spamcop URI plug-in rules (if you're using them) - this is
   included by default in SA3.  No need to remove the actual plug-in, just the
   rules.

2. SA3 seems a lot more strict about rule name and description lengths (names
   <= 22chars, descriptions <= 50chars).  We had almost 300 rules or
   descriptions that were "too long".  This shows up when you "--lint" the
   rules (see #4).

3. UPGRADE THE BAYES DATABASE *BEFORE* starting SA3:
   sa-learn --sync -p /opt/MailScanner/etc/spam.assassin.prefs.conf [-D]
   (See note in #4 about running as mail user)

4. Lint all your rules before restarting MailScanner and FIX ANY PROBLEMS:
   spamassassin -p /opt/MailScanner/etc/spam.assassin.prefs.conf --lint [-D]
   If you run your MTA as a specific user (ie, non-root), encapsulate the
   above in an "su" as root:
   su - <mail-user> -c "spamassassin -p....." statement

Other than those four little hic-ups, the upgrade "Just Worked" (tm).  Kudos
to Julian and the SA team!

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james_gray at ocs.com  Thu Oct  7 23:24:50 2004
From: james_gray at ocs.com (James Gray)
Date: Thu Jan 12 21:27:12 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3262.1137101232.24926.mailscanner@lists.mailscanner.info>

On Thu, 7 Oct 2004 11:03 pm, Julian Field wrote:
> There is 1 problem. Some people legitimately want to warn the senders of
> macro-viruses, which by their very nature do not spoof the From address.
> This is what has stopped me removing it in the past.
>
> Any votes either way people?

What about notifying the postmaster/admin with different message (to normal
virus alerts etc) saying a non-spoofing virus was detected and dump the
headers etc in the same message.  Then it's up to the mail admin what they do
about it.

This way a procmail recipe with a neat script could automate a response, or if
you're like me, you'd just bin it :P  Virused users deserve everything they
get....unless they're internal ;)

My $0.02

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hden at KCBBS.GEN.NZ  Fri Oct  8 05:08:58 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:12 2006
Subject: BAYES Scoring
Message-ID: <mailman.3263.1137101232.24926.mailscanner@lists.mailscanner.info>

Apologies, 3 posting in recent days, but I'm getting there.

In the following snippert..

X-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.304, required 5,
        BAYES_50 0.00, DRUGS_DIET 0.00, DRUGS_PAIN 0.13,
        DRUGS_PAIN_OBFU 3.18)

Does this snippert say that Bayes found something indicating SPAM,
but didn't give it any score? (0.00)

If so, where/what do I tweak to assign values to these?

Any advice, help, or pointers to docs appreciated. (SA v 3.0)

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Fri Oct  8 05:04:21 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:12 2006
Subject: MailScanner 4.34.8-4 install problem
Message-ID: <mailman.3264.1137101232.24926.mailscanner@lists.mailscanner.info>

I am trying to install on Mandrake 10. This is the error I get
Missing file /usr/src/RPM/RPMS/noarch/perl-Archive-Zip-1.13-1.noarch.rpm.
Maybe it did not build correctly?


Installing tnef decoder

Preparing...                ###########################################
[100%]
        package tnef-1.2.3.1-1 is already installed

Now to install MailScanner itself.

error: Failed dependencies:
        perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4


SKP


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct  8 08:48:49 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:12 2006
Subject: BAYES Scoring
Message-ID: <mailman.3265.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hendrick

the bayes_50 rule mean bayes is only 50% sure it's spam, so it's been
given a zero score as a result.

If you really want to tweak the scores then edit the
spam.assassin.prefs.conf file and adjust the score values as needed.

Personally I'd leave these scores alone and train the bayes DB, or add
more rules so it catches more spam

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Hendrik den Hartog wrote:
> Apologies, 3 posting in recent days, but I'm getting there.
>
> In the following snippert..
>
> X-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.304, required 5,
>         BAYES_50 0.00, DRUGS_DIET 0.00, DRUGS_PAIN 0.13,
>         DRUGS_PAIN_OBFU 3.18)
>
> Does this snippert say that Bayes found something indicating SPAM,
> but didn't give it any score? (0.00)
>
> If so, where/what do I tweak to assign values to these?
>
> Any advice, help, or pointers to docs appreciated. (SA v 3.0)
>
> Cheers!
> Hendrik
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Oct  8 09:03:24 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:12 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3266.1137101232.24926.mailscanner@lists.mailscanner.info>

Julian

You provided a patch to SA.pm that adds a new header "EnvelopeFrom: ..."
to the copy of the message passed to SA. 

There is a problem with this patch (see below for details). When it is
fixed the patch also needs to be added to MCP.pm so that the
envelope-from address can be tested by MCP rules as well.

The problem with your patch is that "EnvelopeFrom" is a pseudo-header
provided by SA to allow the address received in the "MAIL FROM" stage of
SMTP transactions to be tested in a rule. SA _does not_ expect to see
that header in the message.

SA attempts to discover the "envelope-from" address if it is made
available by the SMTP server. It does this by looking for a number of
common "envelope-from" header line forms in the message. All of this is
described in SA's (3.0.0) user config options manual pages. 

If SA finds any likely looking envelope-from header lines it uses a
heuristic to determine whether they are safe to use and sets
"EnvelopeFrom" accordingly.

To avoid this heuritic failing and chosing the wrong header value to
assign to "EnvelopeFrom", SA provides an option to set this value
explicitly in your SA prefs.conf file(s) in either or both MailScanner
and MailScanner-MCP.

The option is:

   envelope_sender_header  Name-Of-Header

Note that if you use your original patch and set 

   envelope_sender_header EnvelopeFrom

in MCP's mcp.spam.assassin.prefs.conf then in my case SA looped and ran
out of memory! 

I have changed the patch (in both SA.pm and MCP.pm) to use "X-NCL-From"
rather than "EnvelopeFrom" and it works fine if the prefs.conf has 

   envelope_sender_header X-NCL-From

specified. 

It seems there might be a problem with choice of header to add in SA.pm
and MCP.pm. If you use, say, "X-MailScanner-From" then there may already
be similar headers in the message added by upstream MTAs. In this case
the "envelope_sender_header" option does not appear to be of much help
since there will be more than one header of the same name to chose from.


I suspect that to be entirely safe each site needs a unique header to be
added but the site needs to know what that is so that it can set
"envelope_sender_header" accordingly.  
  
Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 09:03:37 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues
Message-ID: <mailman.3267.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It's a goodie this one.

In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line 362,
there is a statement given in the regular expression which your version of
Perl does not support.
If you post that line here, I will mail you the fixed version of it. I
can't find an example of this at the moment.

At 23:23 07/10/2004, you wrote:
>I'm attempting a fresh install of mailscanner from FreeBSD Port to a FreeBSD
>4.7 machine.
>
>(Perl 5.6.1, SA 2.64, MS 4.33.3)
>
>I've done this install without issue on other similar FreeBSD machines but
>when I attempt to start mailscanner using the script in ../rc.d/ I get the
>following errors.  Any help is greatly appreciated.
>
>Can't locate object method "SWASHNEW" via package "utf8" (perhaps you forgot
>to load "utf8"?) at
>/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
>Compilation failed in require at
>/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
>BEGIN failed--compilation aborted at
>/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
>Compilation failed in require at
>/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
>BEGIN failed--compilation aborted at
>/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
>Compilation failed in require at /usr/local/libexec/MailScanner/MailScanner
>line 51.
>BEGIN failed--compilation aborted at
>/usr/local/libexec/MailScanner/MailScanner line 51.
>
>-Brendan
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 09:04:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: mailscanner 4.34 seems to affect apt-get
Message-ID: <mailman.3268.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Make sure you are using the 4.34.8-4 release, as this has a dependency
problem fixed.

At 00:38 08/10/2004, you wrote:
>Hello,
>
>after installing mailscanner 4.34 with the help of install.sh I tried
>running my weekly apt-get upgrade. Apt-get gave me an error regarding perl-
>MIME-Base64 saying that this module is obsolete. The only way forward was
>using "apt-get -f install" which in turn suggested.... uninstalling
>mailscanner and perl-MIME-Base64. That was clearly not an option.
>
>The system in question is Fedora Core 2. Please advise if any of you have
>faced the same problems.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 08:56:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: MailScanner 4.34.8-4 install problem
Message-ID: <mailman.3269.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Try installing Archive::Zip using CPAN, and then re-run ./install.sh.

At 05:04 08/10/2004, you wrote:
>I am trying to install on Mandrake 10. This is the error I get
>Missing file /usr/src/RPM/RPMS/noarch/perl-Archive-Zip-1.13-1.noarch.rpm.
>Maybe it did not build correctly?
>
>
>Installing tnef decoder
>
>Preparing...                ###########################################
>[100%]
>         package tnef-1.2.3.1-1 is already installed
>
>Now to install MailScanner itself.
>
>error: Failed dependencies:
>         perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 09:08:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3270.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 09:03 08/10/2004, you wrote:
>Julian
>
>You provided a patch to SA.pm that adds a new header "EnvelopeFrom: ..."
>to the copy of the message passed to SA.
>
>There is a problem with this patch (see below for details). When it is
>fixed the patch also needs to be added to MCP.pm so that the
>envelope-from address can be tested by MCP rules as well.
>
>The problem with your patch is that "EnvelopeFrom" is a pseudo-header
>provided by SA to allow the address received in the "MAIL FROM" stage of
>SMTP transactions to be tested in a rule. SA _does not_ expect to see
>that header in the message.
>
>SA attempts to discover the "envelope-from" address if it is made
>available by the SMTP server. It does this by looking for a number of
>common "envelope-from" header line forms in the message. All of this is
>described in SA's (3.0.0) user config options manual pages.
>
>If SA finds any likely looking envelope-from header lines it uses a
>heuristic to determine whether they are safe to use and sets
>"EnvelopeFrom" accordingly.
>
>To avoid this heuritic failing and chosing the wrong header value to
>assign to "EnvelopeFrom", SA provides an option to set this value
>explicitly in your SA prefs.conf file(s) in either or both MailScanner
>and MailScanner-MCP.
>
>The option is:
>
>    envelope_sender_header  Name-Of-Header
>
>Note that if you use your original patch and set
>
>    envelope_sender_header EnvelopeFrom
>
>in MCP's mcp.spam.assassin.prefs.conf then in my case SA looped and ran
>out of memory!
>
>I have changed the patch (in both SA.pm and MCP.pm) to use "X-NCL-From"
>rather than "EnvelopeFrom" and it works fine if the prefs.conf has
>
>    envelope_sender_header X-NCL-From
>
>specified.
>
>It seems there might be a problem with choice of header to add in SA.pm
>and MCP.pm. If you use, say, "X-MailScanner-From" then there may already
>be similar headers in the message added by upstream MTAs. In this case
>the "envelope_sender_header" option does not appear to be of much help
>since there will be more than one header of the same name to chose from.
>
>
>I suspect that to be entirely safe each site needs a unique header to be
>added but the site needs to know what that is so that it can set
>"envelope_sender_header" accordingly.

Thanks for that. For now, I have removed the patch. SPF works on my systems
perfectly well without it. I'll let people read the SA docs and set it up
appropriately if SPF doesn't work without manual tweaking.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Fri Oct  8 11:48:42 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:12 2006
Subject: mailscanner 4.34 seems to affect apt-get
Message-ID: <mailman.3271.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 08 October 2004 09:04 +0100 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> Make sure you are using the 4.34.8-4 release, as this has a dependency
> problem fixed.

But not in my case, as I posted a couple of days ago...

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Oct  8 11:52:46 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:12 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3272.1137101232.24926.mailscanner@lists.mailscanner.info>

Julian

The "EnvelopeFrom" pseudo-header may be working for you and with SPF.

It is not working here unless SA.pm and MCP.pm are patched as I
described earlier. :-(

I need this feature to work because I want to define rules in MCP that
will allow me to discard messages to certain local addresses if the
envelope-from address is not from our two domains, ncl.ac.uk or
newcastle.ac.uk.

Quentin 
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 08 October 2004 09:08
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
>
>At 09:03 08/10/2004, you wrote:
>>Julian
>>
>>You provided a patch to SA.pm that adds a new header 
>"EnvelopeFrom: ..."
>>to the copy of the message passed to SA.
>>
>>There is a problem with this patch (see below for details). When it is
>>fixed the patch also needs to be added to MCP.pm so that the
>>envelope-from address can be tested by MCP rules as well.
>>
>>The problem with your patch is that "EnvelopeFrom" is a pseudo-header
>>provided by SA to allow the address received in the "MAIL 
>FROM" stage of
>>SMTP transactions to be tested in a rule. SA _does not_ expect to see
>>that header in the message.
>>
>>SA attempts to discover the "envelope-from" address if it is made
>>available by the SMTP server. It does this by looking for a number of
>>common "envelope-from" header line forms in the message. All 
>of this is
>>described in SA's (3.0.0) user config options manual pages.
>>
>>If SA finds any likely looking envelope-from header lines it uses a
>>heuristic to determine whether they are safe to use and sets
>>"EnvelopeFrom" accordingly.
>>
>>To avoid this heuritic failing and chosing the wrong header value to
>>assign to "EnvelopeFrom", SA provides an option to set this value
>>explicitly in your SA prefs.conf file(s) in either or both MailScanner
>>and MailScanner-MCP.
>>
>>The option is:
>>
>>    envelope_sender_header  Name-Of-Header
>>
>>Note that if you use your original patch and set
>>
>>    envelope_sender_header EnvelopeFrom
>>
>>in MCP's mcp.spam.assassin.prefs.conf then in my case SA 
>looped and ran
>>out of memory!
>>
>>I have changed the patch (in both SA.pm and MCP.pm) to use 
>"X-NCL-From"
>>rather than "EnvelopeFrom" and it works fine if the prefs.conf has
>>
>>    envelope_sender_header X-NCL-From
>>
>>specified.
>>
>>It seems there might be a problem with choice of header to 
>add in SA.pm
>>and MCP.pm. If you use, say, "X-MailScanner-From" then there 
>may already
>>be similar headers in the message added by upstream MTAs. In this case
>>the "envelope_sender_header" option does not appear to be of much help
>>since there will be more than one header of the same name to 
>chose from.
>>
>>
>>I suspect that to be entirely safe each site needs a unique 
>header to be
>>added but the site needs to know what that is so that it can set
>>"envelope_sender_header" accordingly.
>
>Thanks for that. For now, I have removed the patch. SPF works 
>on my systems
>perfectly well without it. I'll let people read the SA docs 
>and set it up
>appropriately if SPF doesn't work without manual tweaking.
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 11:57:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3273.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:52 08/10/2004, you wrote:
>Julian
>
>The "EnvelopeFrom" pseudo-header may be working for you and with SPF.
>
>It is not working here unless SA.pm and MCP.pm are patched as I
>described earlier. :-(

How about I add the
"Envelope From Header"
as defined in MailScanner.conf? That would save yet another config option.


>I need this feature to work because I want to define rules in MCP that
>will allow me to discard messages to certain local addresses if the
>envelope-from address is not from our two domains, ncl.ac.uk or
>newcastle.ac.uk.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sylvain.phaneuf at IMSU.OXFORD.AC.UK  Fri Oct  8 12:07:57 2004
From: sylvain.phaneuf at IMSU.OXFORD.AC.UK (Sylvain Phaneuf)
Date: Thu Jan 12 21:27:12 2006
Subject: Bayes rebuild
Message-ID: <mailman.3274.1137101232.24926.mailscanner@lists.mailscanner.info>

Can you confirm your last paragraph please?   bayes_auto_expire 0 cannot
be don in spam.asssassin.prefs.conf anymore?

Sylvain




===========================================================
Sylvain Phaneuf --- Systems Manager   | phone : +44 (0)1865 221323
Clinical School Information Management Services Unit  (IMSU)
Medical Sciences Division
University of Oxford                                  |   email :
sylvain.phaneuf@imsu.ox.ac.uk
Room 3A25B John Radcliffe Hospital      |   fax :  +44 (0) 1865 221322
Oxford   OX3 9DU   England
===========================================================

>>> mkettler@EVI-INC.COM 06/10/2004 18:36:54 >>>
At 12:45 PM 10/6/2004, Dean Jones wrote:
>Should i do the Bayes rebuild from within MailScanner.conf or should
i
>do it seperately from cron?

Either works. I generally do both, and treat the cronjob as a backup
measure. However, at Julian's request I've been running without the
cronjob
to verify it also performs expiry when needed, and it does.

>How often should Bayes be rebuilt?

Daily, give or take a bit depending on your preference. I've done it
every
hour as well, but that's really just a matter of how loaded your system
is.

The rebuild will also force any journaling to sync, so if you're using
SA's
bayes_learn_to_journal option you'll probably want to do it more
frequently
so that the autolearn data gets folded back into the live bayes DB
more
frequently. I'd say at least twice a day here.

I'd also advise disabling bayes autoexpire in your local.cf (can't do
it in
spam.asssassin.prefs.conf).
         bayes_auto_expire 0

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From SJCJonker at SJC.NL  Fri Oct  8 12:12:37 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:12 2006
Subject: Feature request / Implementation question: Add header to
    postmaster notifies.
Message-ID: <mailman.3275.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello all,

Recently I build an other MailScanner system for an (private) relation,
they would like to receive all the postmaster warnings about viruses
found. This works wonderfully well as it does normally with mailscanner.

The "attack" of virus warning mails is becoming to much for them, but
they still want to "read" / verify them.

My first solution/remark was "Oh i'll do some procmail magic for you and
they only show up in this subfolder..." Only to find out that since the
new subject line (which contains the security violation like bad content
etc) it's extremly difficult to detect these messages as they don't have
any common fields.

I was wondering if I wanted to add an specific header to the
administrative emails where and how to do this.

I check the sources and found the function "CreatePostmasterHeaders" is
this the correct spot to add it?

Julian, is this an option you want to include if I provide the patch in
a week or so. (I first have to upgrade to the latest version & SA3 ;-))

Next to this, to add an config option to enable it, and a second one to
modify the header I think I would have to do the following:
1) Create 2 keys in ConfigDefs.pl under translation,translation
        enablepostmheader       = EnablePostMHeader
        postmheader             = PostMHeader
2) Under [Simple,YesNo] do
enablepostmheader 0 no 0 yes 1

3) Under [First,Other]
PostMHeader    X-MailScanner-PostMHeader:

4) The in the sub CreatePostmasterHeaders
a) Check if enablepostmheader = 1 then
b) Verify the settings for PostMHeader when invalid fallback to default.
c) Insert header after to & from and before subject.

Is this correct, according to the MailScanner coding standards/flows?

Stijn

--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Oct  8 12:21:16 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:12 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3276.1137101232.24926.mailscanner@lists.mailscanner.info>

Yes, using the existing "Envelope From Header" value seems the
appropriate thing to do.  

It also meets my requirement (see earlier posting) for a site to be able
to specify a locally unique X-header string to use for the envelope-from
address that MS can stuff into the message.

Without that uniqueness I think SA will get confused when it tries to
decide which of the X-MailScanner-From: lines, all but one added by
upstream relays, it should use as the value of the pseudo-header
"EnvelopeFrom".  

The SA options document makes a comment that MTAs should avoid using a
single, standard, line containing the envelope-from address. 

When the amended patch is ready I will test it for you.

Thanks

Quentin

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 08 October 2004 11:57
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
>
>At 11:52 08/10/2004, you wrote:
>>Julian
>>
>>The "EnvelopeFrom" pseudo-header may be working for you and with SPF.
>>
>>It is not working here unless SA.pm and MCP.pm are patched as I
>>described earlier. :-(
>
>How about I add the
>"Envelope From Header"
>as defined in MailScanner.conf? That would save yet another 
>config option.
>
>
>>I need this feature to work because I want to define rules in MCP that
>>will allow me to discard messages to certain local addresses if the
>>envelope-from address is not from our two domains, ncl.ac.uk or
>>newcastle.ac.uk.
>
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Fri Oct  8 12:23:22 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:12 2006
Subject: MailScanner 4.34.8-4 install problem
Message-ID: <mailman.3277.1137101232.24926.mailscanner@lists.mailscanner.info>

I am trying to install on Mandrake 10. This is the error I get
Missing file /usr/src/RPM/RPMS/noarch/perl-Archive-Zip-1.13-1.noarch.rpm.
Maybe it did not build correctly?


Installing tnef decoder

Preparing...                ###########################################
[100%]
        package tnef-1.2.3.1-1 is already installed

Now to install MailScanner itself.

error: Failed dependencies:
        perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4


SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From chardlist at CHARD.NET  Fri Oct  8 13:01:48 2004
From: chardlist at CHARD.NET (Brendan Chard)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues
Message-ID: <mailman.3278.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
 name="PlaceType"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
 name="PlaceName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
 name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
 name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:"Courier New";}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 77.95pt 1.0in 77.95pt;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>Line 362 is:<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>return 1 if ($name =~
/((?:[\[\]\\\/\&lt;\&gt;\|\?\*\:\&quot;]|\p{IsCntrl}))/); ### path or special
characters<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>This is the whole chunk of the Filer.pm code surrounding line 362<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>sub evil_filename {<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; my ($self, $name) = @_;<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; $self-&gt;debug(&quot;is this evil? '$name'&quot;);<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; return 1 if (!defined($name) or ($name eq
''));&nbsp;&nbsp; ### empty<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; return 1 if ($name =~ m{(^\s)|(\s+\Z)});&nbsp; ###
leading/trailing whitespace<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; return 1 if ($name =~
m{^\.+\Z});&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ### dots<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; return 1 if ($name =~
/((?:[\[\]\\\/\&lt;\&gt;\|\?\*\:\&quot;]|\p{IsCntrl}))/); ### path or special
characters<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; return 1 if ($self-&gt;{MPF_MaxName} and<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
(length($name) &gt; $self-&gt;{MPF_MaxName}));<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; $self-&gt;debug(&quot;it's ok&quot;);<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&nbsp;&nbsp;&nbsp; 0;<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>}<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>Is it possible that I missed grabbing some perl modules?&nbsp; I
thought that the port installation took care of getting what it needed provided
that perl was installed but it&#8217;s been a while since my last install of
MS.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>-Brendan<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>-----Original Message-----<br>
From: <st1:PersonName w:st="on">MailScanner mailing list</st1:PersonName>
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field<br>
Sent: Friday, October 08, 2004 3:04 AM<br>
To: MAILSCANNER@JISCMAIL.AC.UK<br>
Subject: Re: Perl Issues</span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>It's a goodie this one.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line
362,<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>there is a statement given in the regular expression which your version
of<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>Perl does not support.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>If you post that line here, I will mail you the fixed version of it. I<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>can't find an example of this at the moment.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>At 23:23 07/10/2004, you wrote:<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;I'm attempting a fresh install of mailscanner from <st1:place
w:st="on"><st1:PlaceName w:st="on">FreeBSD</st1:PlaceName> <st1:PlaceType
 w:st="on">Port</st1:PlaceType></st1:place> to a FreeBSD<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;4.7 machine.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;<o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;(Perl 5.6.1, SA 2.64, MS 4.33.3)<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;<o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;I've done this install without issue on other similar FreeBSD
machines but<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;when I attempt to start mailscanner using the script in ../rc.d/ I
get the<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;following errors.&nbsp; Any help is greatly appreciated.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;<o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;Can't locate object method &quot;SWASHNEW&quot; via package
&quot;utf8&quot; (perhaps you forgot<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;to load &quot;utf8&quot;?) at<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;Compilation failed in require at<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;BEGIN failed--compilation aborted at<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;Compilation failed in require at<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;BEGIN failed--compilation aborted at<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;Compilation failed in require at
/usr/local/libexec/MailScanner/MailScanner<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;line 51.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;BEGIN failed--compilation aborted at<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;/usr/local/libexec/MailScanner/MailScanner line 51.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;<o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;-Brendan<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;<o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;------------------------ MailScanner list ------------------------<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;'leave mailscanner' in the body of the email.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>&gt;the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>--<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>Julian Field<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>www.MailScanner.info<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>MailScanner thanks transtec Computers for their support<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>Buy the MailScanner book at www.MailScanner.info/store<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>------------------------ MailScanner list ------------------------<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>'leave mailscanner' in the body of the email.<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and<o:p></o:p></span></font></p>

<p class=MsoPlainText><font size=2 face="Courier New"><span style='font-size:
10.0pt'>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).<o:p></o:p></span></font></p>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mailing-oit at tttech.com  Fri Oct  8 13:57:04 2004
From: mailing-oit at tttech.com (Christoph Resch)
Date: Thu Jan 12 21:27:12 2006
Subject: deny filenames even in zip-files
Message-ID: <mailman.3279.1137101232.24926.mailscanner@lists.mailscanner.info>

Hello,

i experienced some Filename-denys while mailscanner checks zip files ..

users use to send exe-binaries encapsulated in zip-files, but since version
4.33.3-2 (debian-sarge) mailscanner also denys them in archives ..

i was forced to disable zip-file scanning at all atm.  is there a solution to
avoid filename-refusing in zipped-archives  ??

thanks 4 reply

regs

-c-

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 14:04:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues
Message-ID: <mailman.3280.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 13:01 08/10/2004, you wrote:
>Line 362 is:
>return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/); ### path

return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"\x00-\x1f]))/); ### path

should do the trick.

>or special characters
>
>
>This is the whole chunk of the Filer.pm code surrounding line 362
>
>sub evil_filename {
>     my ($self, $name) = @_;
>
>     $self->debug("is this evil? '$name'");
>
>     return 1 if (!defined($name) or ($name eq ''));   ### empty
>     return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing whitespace
>     return 1 if ($name =~ m{^\.+\Z});         ### dots
>     return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> ### path or special characters
>     return 1 if ($self->{MPF_MaxName} and
>                  (length($name) > $self->{MPF_MaxName}));
>
>     $self->debug("it's ok");
>     0;
>}
>
>
>Is it possible that I missed grabbing some perl modules?  I thought that
>the port installation took care of getting what it needed provided that
>perl was installed but it's been a while since my last install of MS.
>
>-Brendan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf Of Julian Field
>Sent: Friday, October 08, 2004 3:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Perl Issues
>
>It's a goodie this one.
>
>In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line 362,
>there is a statement given in the regular expression which your version of
>Perl does not support.
>If you post that line here, I will mail you the fixed version of it. I
>can't find an example of this at the moment.
>
>At 23:23 07/10/2004, you wrote:
> >I'm attempting a fresh install of mailscanner from FreeBSD Port to a FreeBSD
> >4.7 machine.
> >
> >(Perl 5.6.1, SA 2.64, MS 4.33.3)
> >
> >I've done this install without issue on other similar FreeBSD machines but
> >when I attempt to start mailscanner using the script in ../rc.d/ I get the
> >following errors.  Any help is greatly appreciated.
> >
> >Can't locate object method "SWASHNEW" via package "utf8" (perhaps you forgot
> >to load "utf8"?) at
> >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
> >Compilation failed in require at
> >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >BEGIN failed--compilation aborted at
> >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >Compilation failed in require at
> >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >BEGIN failed--compilation aborted at
> >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >Compilation failed in require at /usr/local/libexec/MailScanner/MailScanner
> >line 51.
> >BEGIN failed--compilation aborted at
> >/usr/local/libexec/MailScanner/MailScanner line 51.
> >
> >-Brendan

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 14:08:05 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: deny filenames even in zip-files
Message-ID: <mailman.3281.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
 From MailScanner.conf:

# The maximum depth to which zip archives will be unpacked, to allow for
# checking filenames and filetypes within zip archives.
# To disable this feature set this to 0.
# A common useful setting is this option = 0, and Allow Password-Protected
# Archives = no. That block password-protected archives but does not do
# any filename/filetype checks on the files within the archive.
Maximum Archive Depth = 1

Note this has no effect on virus scanning the contents of archives, this is
still done.

At 13:57 08/10/2004, you wrote:
>Hello,
>
>i experienced some Filename-denys while mailscanner checks zip files ..
>
>users use to send exe-binaries encapsulated in zip-files, but since version
>4.33.3-2 (debian-sarge) mailscanner also denys them in archives ..
>
>i was forced to disable zip-file scanning at all atm.  is there a solution to
>avoid filename-refusing in zipped-archives  ??
>
>thanks 4 reply
>
>regs
>
>-c-
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 14:03:16 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3282.1137101232.24926.mailscanner@lists.mailscanner.info>

Try the attached patches for SA.pm and MCP.pm.

At 12:21 08/10/2004, you wrote:
>Yes, using the existing "Envelope From Header" value seems the
>appropriate thing to do.
>
>It also meets my requirement (see earlier posting) for a site to be able
>to specify a locally unique X-header string to use for the envelope-from
>address that MS can stuff into the message.
>
>Without that uniqueness I think SA will get confused when it tries to
>decide which of the X-MailScanner-From: lines, all but one added by
>upstream relays, it should use as the value of the pseudo-header
>"EnvelopeFrom".
>
>The SA options document makes a comment that MTAs should avoid using a
>single, standard, line containing the envelope-from address.
>
>When the amended patch is ready I will test it for you.
>
>Thanks
>
>Quentin
>
> >-----Original Message-----
> >From: MailScanner mailing list
> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
> >Sent: 08 October 2004 11:57
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
> >
> >At 11:52 08/10/2004, you wrote:
> >>Julian
> >>
> >>The "EnvelopeFrom" pseudo-header may be working for you and with SPF.
> >>
> >>It is not working here unless SA.pm and MCP.pm are patched as I
> >>described earlier. :-(
> >
> >How about I add the
> >"Envelope From Header"
> >as defined in MailScanner.conf? That would save yet another
> >config option.
> >
> >
> >>I need this feature to work because I want to define rules in MCP that
> >>will allow me to discard messages to certain local addresses if the
> >>envelope-from address is not from our two domains, ncl.ac.uk or
> >>newcastle.ac.uk.
> >
> >--
> >Julian Field
> >www.MailScanner.info
> >MailScanner thanks transtec Computers for their support
> >Buy the MailScanner book at www.MailScanner.info/store
> >
> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> >
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: "MCP.pm.patch")  898bytes. ]
    [ Unable to print this part. ]


    [ Part 3, Application/OCTET-STREAM (Name: "SA.pm.patch")  862bytes. ]
    [ Unable to print this part. ]


    [ Part 4: "Attached Text" ]

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From chardlist at CHARD.NET  Fri Oct  8 14:18:51 2004
From: chardlist at CHARD.NET (Brendan Chard)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues THANKS
Message-ID: <mailman.3283.1137101232.24926.mailscanner@lists.mailscanner.info>

That did the trick...  Was this a perl issue?  Is there something I should
keep in mind or notes on should I need to make changes to MS or SA in the
future?

-Brendan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Friday, October 08, 2004 8:05 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Perl Issues

At 13:01 08/10/2004, you wrote:
>Line 362 is:
>return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/); ###
path

return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"\x00-\x1f]))/); ### path

should do the trick.

>or special characters
>
>
>This is the whole chunk of the Filer.pm code surrounding line 362
>
>sub evil_filename {
>     my ($self, $name) = @_;
>
>     $self->debug("is this evil? '$name'");
>
>     return 1 if (!defined($name) or ($name eq ''));   ### empty
>     return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing
whitespace
>     return 1 if ($name =~ m{^\.+\Z});         ### dots
>     return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> ### path or special characters
>     return 1 if ($self->{MPF_MaxName} and
>                  (length($name) > $self->{MPF_MaxName}));
>
>     $self->debug("it's ok");
>     0;
>}
>
>
>Is it possible that I missed grabbing some perl modules?  I thought that
>the port installation took care of getting what it needed provided that
>perl was installed but it's been a while since my last install of MS.
>
>-Brendan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf Of Julian Field
>Sent: Friday, October 08, 2004 3:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Perl Issues
>
>It's a goodie this one.
>
>In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line 362,
>there is a statement given in the regular expression which your version of
>Perl does not support.
>If you post that line here, I will mail you the fixed version of it. I
>can't find an example of this at the moment.
>
>At 23:23 07/10/2004, you wrote:
> >I'm attempting a fresh install of mailscanner from FreeBSD Port to a
FreeBSD
> >4.7 machine.
> >
> >(Perl 5.6.1, SA 2.64, MS 4.33.3)
> >
> >I've done this install without issue on other similar FreeBSD machines
but
> >when I attempt to start mailscanner using the script in ../rc.d/ I get
the
> >following errors.  Any help is greatly appreciated.
> >
> >Can't locate object method "SWASHNEW" via package "utf8" (perhaps you
forgot
> >to load "utf8"?) at
> >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
> >Compilation failed in require at
> >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >BEGIN failed--compilation aborted at
> >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >Compilation failed in require at
> >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >BEGIN failed--compilation aborted at
> >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >Compilation failed in require at
/usr/local/libexec/MailScanner/MailScanner
> >line 51.
> >BEGIN failed--compilation aborted at
> >/usr/local/libexec/MailScanner/MailScanner line 51.
> >
> >-Brendan

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 14:31:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues THANKS
Message-ID: <mailman.3284.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It's a Perl issue.

At 14:18 08/10/2004, you wrote:
>That did the trick...  Was this a perl issue?  Is there something I should
>keep in mind or notes on should I need to make changes to MS or SA in the
>future?
>
>-Brendan
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Friday, October 08, 2004 8:05 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Perl Issues
>
>At 13:01 08/10/2004, you wrote:
> >Line 362 is:
> >return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/); ###
>path
>
>return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"\x00-\x1f]))/); ### path
>
>should do the trick.
>
> >or special characters
> >
> >
> >This is the whole chunk of the Filer.pm code surrounding line 362
> >
> >sub evil_filename {
> >     my ($self, $name) = @_;
> >
> >     $self->debug("is this evil? '$name'");
> >
> >     return 1 if (!defined($name) or ($name eq ''));   ### empty
> >     return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing
>whitespace
> >     return 1 if ($name =~ m{^\.+\Z});         ### dots
> >     return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> > ### path or special characters
> >     return 1 if ($self->{MPF_MaxName} and
> >                  (length($name) > $self->{MPF_MaxName}));
> >
> >     $self->debug("it's ok");
> >     0;
> >}
> >
> >
> >Is it possible that I missed grabbing some perl modules?  I thought that
> >the port installation took care of getting what it needed provided that
> >perl was installed but it's been a while since my last install of MS.
> >
> >-Brendan
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >Behalf Of Julian Field
> >Sent: Friday, October 08, 2004 3:04 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: Perl Issues
> >
> >It's a goodie this one.
> >
> >In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line 362,
> >there is a statement given in the regular expression which your version of
> >Perl does not support.
> >If you post that line here, I will mail you the fixed version of it. I
> >can't find an example of this at the moment.
> >
> >At 23:23 07/10/2004, you wrote:
> > >I'm attempting a fresh install of mailscanner from FreeBSD Port to a
>FreeBSD
> > >4.7 machine.
> > >
> > >(Perl 5.6.1, SA 2.64, MS 4.33.3)
> > >
> > >I've done this install without issue on other similar FreeBSD machines
>but
> > >when I attempt to start mailscanner using the script in ../rc.d/ I get
>the
> > >following errors.  Any help is greatly appreciated.
> > >
> > >Can't locate object method "SWASHNEW" via package "utf8" (perhaps you
>forgot
> > >to load "utf8"?) at
> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
> > >Compilation failed in require at
> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> > >BEGIN failed--compilation aborted at
> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> > >Compilation failed in require at
> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> > >BEGIN failed--compilation aborted at
> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> > >Compilation failed in require at
>/usr/local/libexec/MailScanner/MailScanner
> > >line 51.
> > >BEGIN failed--compilation aborted at
> > >/usr/local/libexec/MailScanner/MailScanner line 51.
> > >

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Fri Oct  8 15:13:44 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:12 2006
Subject: More tasks started then wanted..
Message-ID: <mailman.3285.1137101232.24926.mailscanner@lists.mailscanner.info>

Hi there,


> Hi
>
> I'm having the same problems, with mailscanner just starting processes until
> the RAM and Swap gets used up and the box falls over.
>
> What OS are you running mailscanner on?
>
> I'm fairly sure mailscanner is using the conf file in my case because mails
> getting through have the correct headers that are configured in
> MailScanner.conf.
>
the same still here..but only with SpamAssassin3.0

I am using Linux SuSE 8.1, but with updated perl..Perl is Version 5.8.4..

I am wondering why this does not happen on a SuSE9.0 Maschine..also with
updated Perl to 5.8.4..

Everything was updated via cpan..on both maschines..

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Fri Oct  8 15:15:59 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:12 2006
Subject: Spamassassin/mailscanner
Message-ID: <mailman.3286.1137101232.24926.mailscanner@lists.mailscanner.info>

Hi there,


> Any known issues with updating spamassassin to version 3? If I install the
> updated version of spamassasin will it work with MailScanner automatically?
> I have MailScanner configured to use SA and have been using it for a while
> now.
>
i can only report on some strange behaviour on my side..

Updated spamassassin to 3.0 and updated ms to the latest version..

first i updated sa which worked fine..then updated ms .. still everything
working fine..

on another maschine i updated ms and sa.
Also the Modules needed by both applications via cpan..

and onthe other maschine ms starts a lot of tasks..only to fill my ram..

so..on one maschine everything works fine..on another i had to downgrade
to sa2.64..

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Fri Oct  8 16:22:26 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:12 2006
Subject: Bayes rebuild
Message-ID: <mailman.3287.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 07:07 AM 10/8/2004, Sylvain Phaneuf wrote:
>Can you confirm your last paragraph please?   bayes_auto_expire 0 cannot
>be don in spam.asssassin.prefs.conf anymore?

AFAIK you've never been able to do it in spam.assassin.prefs.conf and have
it be honored by SA.


In my testing it does not work in 2.64. Opportunistic expiry will still
happen. I have no reason to believe it will work with any version of SA,
given that the docs have always considered this an administrator setting.

Remember, spam.assassin.prefs.conf is equivalent to user_prefs. Since MS
calls SA at the API layer, user rules do work, but this is because MS acts
more like the command-line "spamassassin" application than spamd.

In theory most "privileged" settings should work in
spam.assassin.prefs.conf, as if allow_user_rules was set, but
"administrator" settings should not.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From lars+lister.mailscanner at ADVENTURAS.NO  Fri Oct  8 19:57:13 2004
From: lars+lister.mailscanner at ADVENTURAS.NO (Lars Kristiansen)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues THANKS
Message-ID: <mailman.3288.1137101232.24926.mailscanner@lists.mailscanner.info>

> It's a Perl issue.
Thanks from me too.

Seems like this issue was introduced by a patch in the freebsd-port
"P5-MIME-Tools".
The original "Filer.pm" is also still there but renamed to "Filer.pm.orig"

Not shure how too behave correctly, but i took the liberty too cc this
message to that ports maintainer.

--
Lars



>
> At 14:18 08/10/2004, you wrote:
>>That did the trick...  Was this a perl issue?  Is there something I
>> should
>>keep in mind or notes on should I need to make changes to MS or SA in the
>>future?
>>
>>-Brendan
>>
>>-----Original Message-----
>>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> Behalf
>>Of Julian Field
>>Sent: Friday, October 08, 2004 8:05 AM
>>To: MAILSCANNER@JISCMAIL.AC.UK
>>Subject: Re: Perl Issues
>>
>>At 13:01 08/10/2004, you wrote:
>> >Line 362 is:
>> >return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
>> ###
>>path
>>
>>return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"\x00-\x1f]))/); ###
>> path
>>
>>should do the trick.
>>
>> >or special characters
>> >
>> >
>> >This is the whole chunk of the Filer.pm code surrounding line 362
>> >
>> >sub evil_filename {
>> >     my ($self, $name) = @_;
>> >
>> >     $self->debug("is this evil? '$name'");
>> >
>> >     return 1 if (!defined($name) or ($name eq ''));   ### empty
>> >     return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing
>>whitespace
>> >     return 1 if ($name =~ m{^\.+\Z});         ### dots
>> >     return 1 if ($name =~
>> /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
>> > ### path or special characters
>> >     return 1 if ($self->{MPF_MaxName} and
>> >                  (length($name) > $self->{MPF_MaxName}));
>> >
>> >     $self->debug("it's ok");
>> >     0;
>> >}
>> >
>> >
>> >Is it possible that I missed grabbing some perl modules?  I thought
>> that
>> >the port installation took care of getting what it needed provided that
>> >perl was installed but it's been a while since my last install of MS.
>> >
>> >-Brendan
>> >
>> >-----Original Message-----
>> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> >Behalf Of Julian Field
>> >Sent: Friday, October 08, 2004 3:04 AM
>> >To: MAILSCANNER@JISCMAIL.AC.UK
>> >Subject: Re: Perl Issues
>> >
>> >It's a goodie this one.
>> >
>> >In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line
>> 362,
>> >there is a statement given in the regular expression which your version
>> of
>> >Perl does not support.
>> >If you post that line here, I will mail you the fixed version of it. I
>> >can't find an example of this at the moment.
>> >
>> >At 23:23 07/10/2004, you wrote:
>> > >I'm attempting a fresh install of mailscanner from FreeBSD Port to a
>>FreeBSD
>> > >4.7 machine.
>> > >
>> > >(Perl 5.6.1, SA 2.64, MS 4.33.3)
>> > >
>> > >I've done this install without issue on other similar FreeBSD
>> machines
>>but
>> > >when I attempt to start mailscanner using the script in ../rc.d/ I
>> get
>>the
>> > >following errors.  Any help is greatly appreciated.
>> > >
>> > >Can't locate object method "SWASHNEW" via package "utf8" (perhaps you
>>forgot
>> > >to load "utf8"?) at
>> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
>> > >Compilation failed in require at
>> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
>> > >BEGIN failed--compilation aborted at
>> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
>> > >Compilation failed in require at
>> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
>> > >BEGIN failed--compilation aborted at
>> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
>> > >Compilation failed in require at
>>/usr/local/libexec/MailScanner/MailScanner
>> > >line 51.
>> > >BEGIN failed--compilation aborted at
>> > >/usr/local/libexec/MailScanner/MailScanner line 51.
>> > >
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>



----------------------------------------------------------------
Tjenesten mail.adventuras.no ble levert av Adventuras Web Agency
http://www.adventuras.no/

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct  8 20:38:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues THANKS
Message-ID: <mailman.3289.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Is this a good time to ask if you have bought your copy of the MailScanner
book yet?
It's very reasonably priced and available at www.mailscanner.info. Cheaper
than Amazon!
Thanks!

At 19:57 08/10/2004, you wrote:
> > It's a Perl issue.
>Thanks from me too.
>
>Seems like this issue was introduced by a patch in the freebsd-port
>"P5-MIME-Tools".
>The original "Filer.pm" is also still there but renamed to "Filer.pm.orig"
>
>Not shure how too behave correctly, but i took the liberty too cc this
>message to that ports maintainer.
>
>--
>Lars
>
>
>
> >
> > At 14:18 08/10/2004, you wrote:
> >>That did the trick...  Was this a perl issue?  Is there something I
> >> should
> >>keep in mind or notes on should I need to make changes to MS or SA in the
> >>future?
> >>
> >>-Brendan
> >>
> >>-----Original Message-----
> >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >> Behalf
> >>Of Julian Field
> >>Sent: Friday, October 08, 2004 8:05 AM
> >>To: MAILSCANNER@JISCMAIL.AC.UK
> >>Subject: Re: Perl Issues
> >>
> >>At 13:01 08/10/2004, you wrote:
> >> >Line 362 is:
> >> >return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> >> ###
> >>path
> >>
> >>return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"\x00-\x1f]))/); ###
> >> path
> >>
> >>should do the trick.
> >>
> >> >or special characters
> >> >
> >> >
> >> >This is the whole chunk of the Filer.pm code surrounding line 362
> >> >
> >> >sub evil_filename {
> >> >     my ($self, $name) = @_;
> >> >
> >> >     $self->debug("is this evil? '$name'");
> >> >
> >> >     return 1 if (!defined($name) or ($name eq ''));   ### empty
> >> >     return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing
> >>whitespace
> >> >     return 1 if ($name =~ m{^\.+\Z});         ### dots
> >> >     return 1 if ($name =~
> >> /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> >> > ### path or special characters
> >> >     return 1 if ($self->{MPF_MaxName} and
> >> >                  (length($name) > $self->{MPF_MaxName}));
> >> >
> >> >     $self->debug("it's ok");
> >> >     0;
> >> >}
> >> >
> >> >
> >> >Is it possible that I missed grabbing some perl modules?  I thought
> >> that
> >> >the port installation took care of getting what it needed provided that
> >> >perl was installed but it's been a while since my last install of MS.
> >> >
> >> >-Brendan
> >> >
> >> >-----Original Message-----
> >> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >> >Behalf Of Julian Field
> >> >Sent: Friday, October 08, 2004 3:04 AM
> >> >To: MAILSCANNER@JISCMAIL.AC.UK
> >> >Subject: Re: Perl Issues
> >> >
> >> >It's a goodie this one.
> >> >
> >> >In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line
> >> 362,
> >> >there is a statement given in the regular expression which your version
> >> of
> >> >Perl does not support.
> >> >If you post that line here, I will mail you the fixed version of it. I
> >> >can't find an example of this at the moment.
> >> >
> >> >At 23:23 07/10/2004, you wrote:
> >> > >I'm attempting a fresh install of mailscanner from FreeBSD Port to a
> >>FreeBSD
> >> > >4.7 machine.
> >> > >
> >> > >(Perl 5.6.1, SA 2.64, MS 4.33.3)
> >> > >
> >> > >I've done this install without issue on other similar FreeBSD
> >> machines
> >>but
> >> > >when I attempt to start mailscanner using the script in ../rc.d/ I
> >> get
> >>the
> >> > >following errors.  Any help is greatly appreciated.
> >> > >
> >> > >Can't locate object method "SWASHNEW" via package "utf8" (perhaps you
> >>forgot
> >> > >to load "utf8"?) at
> >> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
> >> > >Compilation failed in require at
> >> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >> > >BEGIN failed--compilation aborted at
> >> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >> > >Compilation failed in require at
> >> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >> > >BEGIN failed--compilation aborted at
> >> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >> > >Compilation failed in require at
> >>/usr/local/libexec/MailScanner/MailScanner
> >> > >line 51.
> >> > >BEGIN failed--compilation aborted at
> >> > >/usr/local/libexec/MailScanner/MailScanner line 51.
> >> > >
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
>
>
>----------------------------------------------------------------
>Tjenesten mail.adventuras.no ble levert av Adventuras Web Agency
>http://www.adventuras.no/
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Fri Oct  8 20:48:20 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:12 2006
Subject: Bayes rebuild
Message-ID: <mailman.3290.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Sylvain Phaneuf wrote:
> Can you confirm your last paragraph please?   bayes_auto_expire 0 cannot
> be don in spam.asssassin.prefs.conf anymore?

Bayes_auto_expire is an admin setting and should be set in
/etc/mail/spamassassin. If you symlink local.cf there to
spam.assassin.prefs.conf you're ok. It's an easy way not having to
bother with the -p and -C options as well.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hb.maillists at DFS.DK  Fri Oct  8 21:45:18 2004
From: hb.maillists at DFS.DK (Henrik Bro)
Date: Thu Jan 12 21:27:12 2006
Subject: Question about perl-package?
Message-ID: <mailman.3291.1137101232.24926.mailscanner@lists.mailscanner.info>

My Red Hat say this...is it true?


The following Packages are obsoleted by newer packages:

Name-Version-Release        obsoleted by        Name-Version-Release
----------------------------------------------------------------------------
---
perl-MIME-Base64-3.03-1                         perl-5.8.0-88.7

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From chardlist at CHARD.NET  Fri Oct  8 21:46:47 2004
From: chardlist at CHARD.NET (Brendan Chard)
Date: Thu Jan 12 21:27:12 2006
Subject: Perl Issues THANKS
Message-ID: <mailman.3292.1137101232.24926.mailscanner@lists.mailscanner.info>

Perfect timing, I just ordered my copy.  Looks like some fun night-time
reading.

Thanks for all your past and continued help.

-Brendan

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Friday, October 08, 2004 2:39 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Perl Issues THANKS

Is this a good time to ask if you have bought your copy of the MailScanner
book yet?
It's very reasonably priced and available at www.mailscanner.info. Cheaper
than Amazon!
Thanks!

At 19:57 08/10/2004, you wrote:
> > It's a Perl issue.
>Thanks from me too.
>
>Seems like this issue was introduced by a patch in the freebsd-port
>"P5-MIME-Tools".
>The original "Filer.pm" is also still there but renamed to "Filer.pm.orig"
>
>Not shure how too behave correctly, but i took the liberty too cc this
>message to that ports maintainer.
>
>--
>Lars
>
>
>
> >
> > At 14:18 08/10/2004, you wrote:
> >>That did the trick...  Was this a perl issue?  Is there something I
> >> should
> >>keep in mind or notes on should I need to make changes to MS or SA in
the
> >>future?
> >>
> >>-Brendan
> >>
> >>-----Original Message-----
> >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >> Behalf
> >>Of Julian Field
> >>Sent: Friday, October 08, 2004 8:05 AM
> >>To: MAILSCANNER@JISCMAIL.AC.UK
> >>Subject: Re: Perl Issues
> >>
> >>At 13:01 08/10/2004, you wrote:
> >> >Line 362 is:
> >> >return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> >> ###
> >>path
> >>
> >>return 1 if ($name =~ /((?:[\[\]\\\/\<\>\|\?\*\:\"\x00-\x1f]))/); ###
> >> path
> >>
> >>should do the trick.
> >>
> >> >or special characters
> >> >
> >> >
> >> >This is the whole chunk of the Filer.pm code surrounding line 362
> >> >
> >> >sub evil_filename {
> >> >     my ($self, $name) = @_;
> >> >
> >> >     $self->debug("is this evil? '$name'");
> >> >
> >> >     return 1 if (!defined($name) or ($name eq ''));   ### empty
> >> >     return 1 if ($name =~ m{(^\s)|(\s+\Z)});  ### leading/trailing
> >>whitespace
> >> >     return 1 if ($name =~ m{^\.+\Z});         ### dots
> >> >     return 1 if ($name =~
> >> /((?:[\[\]\\\/\<\>\|\?\*\:\"]|\p{IsCntrl}))/);
> >> > ### path or special characters
> >> >     return 1 if ($self->{MPF_MaxName} and
> >> >                  (length($name) > $self->{MPF_MaxName}));
> >> >
> >> >     $self->debug("it's ok");
> >> >     0;
> >> >}
> >> >
> >> >
> >> >Is it possible that I missed grabbing some perl modules?  I thought
> >> that
> >> >the port installation took care of getting what it needed provided
that
> >> >perl was installed but it's been a while since my last install of MS.
> >> >
> >> >-Brendan
> >> >
> >> >-----Original Message-----
> >> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >> >Behalf Of Julian Field
> >> >Sent: Friday, October 08, 2004 3:04 AM
> >> >To: MAILSCANNER@JISCMAIL.AC.UK
> >> >Subject: Re: Perl Issues
> >> >
> >> >It's a goodie this one.
> >> >
> >> >In /usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm, at line
> >> 362,
> >> >there is a statement given in the regular expression which your
version
> >> of
> >> >Perl does not support.
> >> >If you post that line here, I will mail you the fixed version of it. I
> >> >can't find an example of this at the moment.
> >> >
> >> >At 23:23 07/10/2004, you wrote:
> >> > >I'm attempting a fresh install of mailscanner from FreeBSD Port to a
> >>FreeBSD
> >> > >4.7 machine.
> >> > >
> >> > >(Perl 5.6.1, SA 2.64, MS 4.33.3)
> >> > >
> >> > >I've done this install without issue on other similar FreeBSD
> >> machines
> >>but
> >> > >when I attempt to start mailscanner using the script in ../rc.d/ I
> >> get
> >>the
> >> > >following errors.  Any help is greatly appreciated.
> >> > >
> >> > >Can't locate object method "SWASHNEW" via package "utf8" (perhaps
you
> >>forgot
> >> > >to load "utf8"?) at
> >> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser/Filer.pm line 362.
> >> > >Compilation failed in require at
> >> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >> > >BEGIN failed--compilation aborted at
> >> > >/usr/local/lib/perl5/site_perl/5.6.1/MIME/Parser.pm line 152.
> >> > >Compilation failed in require at
> >> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >> > >BEGIN failed--compilation aborted at
> >> > >/usr/local/lib/MailScanner/MailScanner/MCPMessage.pm line 40.
> >> > >Compilation failed in require at
> >>/usr/local/libexec/MailScanner/MailScanner
> >> > >line 51.
> >> > >BEGIN failed--compilation aborted at
> >> > >/usr/local/libexec/MailScanner/MailScanner line 51.
> >> > >
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
>
>
>----------------------------------------------------------------
>Tjenesten mail.adventuras.no ble levert av Adventuras Web Agency
>http://www.adventuras.no/
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From devonharding at gmail.com  Fri Oct  8 21:52:35 2004
From: devonharding at gmail.com (Devon Harding)
Date: Thu Jan 12 21:27:12 2006
Subject: QuarantineReport
Message-ID: <mailman.3293.1137101232.24926.mailscanner@lists.mailscanner.info>

I think this should be incorporated into the next release of
MailScanner.  Very important function that helps with false positives.


On Wed, 6 Oct 2004 11:48:40 -0400, Steve Swaney <steve.swaney@fsl.com> wrote:
>
> I have finished the INSTALL documentation for QuarantineReport. The
> application and the documentation may be downloaded from:
>
>         http://www.fsl.com/support
>
> QuarantineReport is a small application that's intended to:
>
> * Create a daily report for each user who has messages in MailScanner
>     Quarantine
> * Quarantine Create a web link to view the message in Quarantine
> * Provide a link to allow the user to release the message from Quarantine
> * Email the report to the user
>
> The report will contain this information for each message in Quarantine:
>
>         From: address_of_sender
>         Subject: subject_of message
>         Link_to_View
>         Link_to_Release
>
> The application can also verify that recipient is a valid user by checking a
> file or performing an LDAP search.
>
> While these script are supplied as unsupported software. Please email me off
> list if you find errors or have problems.
>
> Steve
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From cstone at AXINT.NET  Fri Oct  8 23:00:13 2004
From: cstone at AXINT.NET (Chris Stone)
Date: Thu Jan 12 21:27:12 2006
Subject: Resource temp unavailable messages
Message-ID: <mailman.3294.1137101232.24926.mailscanner@lists.mailscanner.info>

Getting this on a MailScanner 4.34.8 (SA 2.64) install using Postfix:

Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/5/D5FB33219E9, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/4/D4433320B13, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/6/D65D831C000, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/4/D42523211D6, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/5/D520331DF36, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/5/D56C0318CDD, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/4/D4B4E31E6A7, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/4/D483632161A, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/5/D523B31A6A8, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/5/D5791319427, Resource temporarily unavailable
Oct  8 17:56:04 g5 MailScanner[28539]: Cannot build message from
/var/spool/postfix/hold/D/4/D4F41320B39, Resource temporarily unavailable

And then MailScanner hangs. Suggestions on what might be the cause?


Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mbrijun at HOTMAIL.COM  Fri Oct  8 23:13:35 2004
From: mbrijun at HOTMAIL.COM (Martynas Brijunas)
Date: Thu Jan 12 21:27:12 2006
Subject: mailscanner 4.34 seems to affect apt-get
Message-ID: <mailman.3295.1137101232.24926.mailscanner@lists.mailscanner.info>

Hi Julian,


On Fri, 8 Oct 2004 11:48:42 +0100, Mike Zanker <mike@ZANKER.ORG> wrote:

>On 08 October 2004 09:04 +0100 Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>> Make sure you are using the 4.34.8-4 release, as this has a dependency
>> problem fixed.
>
>But not in my case, as I posted a couple of days ago...
>
>Mike.
>

just like in Mike's case, there still seem to be some problems with
MIME-Base64 on MailScanner4.34.8-4 on Fedora Core 2.

When installing MailScanner there is a message saying "I have to force MIME-
Base64. Sorry.". After the installation finishes the dependency problem is
still there. The report from apt-get looks like that:

****************************************************************
[root@flox MailScanner-4.34.8-4]# apt-get dist-upgrade
Reading Package Lists... Done
Building Dependency Tree... Done
You might want to run `apt-get -f install' to correct these.
The following packages have unmet dependencies:
  perl: Obsoletes: perl-MIME-Base64 but 3.03-1 is installed
E: Unmet dependencies. Try using -f.
****************************************************************


Then, once trying apt-get -f install here is the output.

****************************************************************
[root@flox MailScanner-4.34.8-4]# apt-get -f install
Reading Package Lists... Done
Building Dependency Tree... Done
Correcting dependencies... Done
The following packages will be REMOVED:
   perl-MIME-Base64 (3.03-1)
****************************************************************

Thank you for your help in advance.

Martin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rpotter at RPCS.NET  Fri Oct  8 23:22:46 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:12 2006
Subject: Question about perl-package?
Message-ID: <mailman.3296.1137101232.24926.mailscanner@lists.mailscanner.info>

On Fri, 8 Oct 2004, Henrik Bro wrote:

> My Red Hat say this...is it true?
>
>
> The following Packages are obsoleted by newer packages:
>
> Name-Version-Release        obsoleted by        Name-Version-Release
> ----------------------------------------------------------------------------
> ---
> perl-MIME-Base64-3.03-1                         perl-5.8.0-88.7

It *appears* that I have similar problems on two different RHEL 3 U3 boxes.
up2date has failed overnight complaining about failed dependencies on
perl-MIME-Base64.

I will investigate further on Saturday.

Cheers!
--
Richard Potter RHCE
Re/Max
Kingston, ON  CANADA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From alden at ENGINENO9INC.COM  Sat Oct  9 05:37:20 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3297.1137101232.24926.mailscanner@lists.mailscanner.info>

I am having a little problem:
I would like to block mail from and to two particular email address, so in
my MailScanner.conf, I set:
Is Definitely Spam = %rules-dir%/spam.blacklist.rules
High Scoring Spam Actions = store

and in %rules-dir%/spam.blacklist.rules, I placed the lines:
FromOrTo:       name@isp.com    yes
FromOrTo:       name2@isp2.com  yes
FromOrTo:       default no

However, when I send mail from a blocked address, I receive the mail, but
the subject has {SPAM!} (which is how high scoring spam is indicate) added
and the header has:
X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)

So, I assume that the blacklist is working.  I was under the impression that
because I set High Scoring Spam Actions = store
and NOT deliver, that this email would never reach its intended destination.

HOWEVER, this seems to work if I change:
High Scoring Spam Actions = %rules-dir%/high.spam.rules
and in high.spam.rules, I put:
FromOrTo:       name@isp.com    delete
FromOrTo:       name2@isp2.com  delete
FromOrTo:       default store

Am I missing something? I would be happy to just store all high scoring spam
and let it be deleted on schedule (in a cron job).  It seems that I have to
create the extra file to get this to work as I would like, but it doesn't
quite make sense to me.

Thanks for any help,
Alden

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at ZANKER.ORG  Sat Oct  9 07:28:25 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:12 2006
Subject: mailscanner 4.34 seems to affect apt-get
Message-ID: <mailman.3298.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 08 October 2004 23:13 +0100 Martynas Brijunas <mbrijun@HOTMAIL.COM>
wrote:

> just like in Mike's case, there still seem to be some problems with
> MIME-Base64 on MailScanner4.34.8-4 on Fedora Core 2.
>
> When installing MailScanner there is a message saying "I have to
> force MIME- Base64. Sorry.". After the installation finishes the
> dependency problem is still there.

Yes - exactly what I am seeing on a bog-standard RHEL 3.0 box but with
up2date.

My workaround (which I'm not entirely happy with but it works) was to
remove the MIME-Base64 rpm and install it from CPAN. This avoids
messing up the rpm database and gives MailScanner what it needs.

Presumably only until the next MailScanner upgrade, though, at which
point I'll have to rpmbuild only the changed modules rather than
running install.sh.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Sat Oct  9 09:20:32 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3299.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Alden Levy wrote:
> I am having a little problem:
> I would like to block mail from and to two particular email address, so in
> my MailScanner.conf, I set:
> Is Definitely Spam = %rules-dir%/spam.blacklist.rules
> High Scoring Spam Actions = store
>
> and in %rules-dir%/spam.blacklist.rules, I placed the lines:
> FromOrTo:       name@isp.com    yes
> FromOrTo:       name2@isp2.com  yes
> FromOrTo:       default no
>
> However, when I send mail from a blocked address, I receive the mail, but
> the subject has {SPAM!} (which is how high scoring spam is indicate) added
> and the header has:
> X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)

Do you have "Definite Spam Is High Scoring" set to "yes"?

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From MyBSD at comcast.net  Sat Oct  9 12:13:02 2004
From: MyBSD at comcast.net (My BSD)
Date: Thu Jan 12 21:27:12 2006
Subject: QuarantineReport
Message-ID: <mailman.3300.1137101232.24926.mailscanner@lists.mailscanner.info>

On Fri, October 8, 2004 4:52 pm, Devon Harding said:
> I think this should be incorporated into the next release of
> MailScanner.  Very important function that helps with false positives.
>
>
> On Wed, 6 Oct 2004 11:48:40 -0400, Steve Swaney <steve.swaney@fsl.com>
> wrote:
>>
>> I have finished the INSTALL documentation for QuarantineReport. The
>> application and the documentation may be downloaded from:
>>
>>         http://www.fsl.com/support
>>
>> QuarantineReport is a small application that's intended to:
>>
>> * Create a daily report for each user who has messages in MailScanner
>>     Quarantine
>> * Quarantine Create a web link to view the message in Quarantine
>> * Provide a link to allow the user to release the message from
>> Quarantine
>> * Email the report to the user
>>
>> The report will contain this information for each message in Quarantine:
>>
>>         From: address_of_sender
>>         Subject: subject_of message
>>         Link_to_View
>>         Link_to_Release
>>
>> The application can also verify that recipient is a valid user by
>> checking a
>> file or performing an LDAP search.
>>
>> While these script are supplied as unsupported software. Please email me
>> off
>> list if you find errors or have problems.
>>
>> Steve
>>
>> Steve Swaney
>> President
>> Fortress Systems Ltd.
>> www.fsl.com
>> steve.swaney@fsl.com
>>
>> --
>> This message has been scanned for viruses and
>> dangerous content by MailScanner, and is
>> believed to be clean.
>>
>> Fortress Systems Ltd.
>> www.fsl.com
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

*********** REPLY SEPARATOR  ***********

With all due respect to the authors (unless I am missing something very
basic), these scripts, although they work as advertised (after some
tweaking) and very "cool", can also be very dangerous if improperly used.

There does not seem to be a way to "lock" quarantine messages that are
both spam and virus infected.  An unwitting user could release an infected
message from the quarantine to him/herself with possibly resulting dire
consequences.

So unless this "feature" can be disabled (or a warning message included in
the distribution) they should not be incorporated into SA.

--
My

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  9 12:46:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Question about perl-package?
Message-ID: <mailman.3301.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 23:22 08/10/2004, you wrote:
>On Fri, 8 Oct 2004, Henrik Bro wrote:
>
> > My Red Hat say this...is it true?
> >
> >
> > The following Packages are obsoleted by newer packages:
> >
> > Name-Version-Release        obsoleted by        Name-Version-Release
> >
> ----------------------------------------------------------------------------
> > ---
> > perl-MIME-Base64-3.03-1                         perl-5.8.0-88.7
>
>It *appears* that I have similar problems on two different RHEL 3 U3 boxes.
>up2date has failed overnight complaining about failed dependencies on
>perl-MIME-Base64.
>
>I will investigate further on Saturday.

Installing MIME::Base64 through an RPM or using CPAN installs the same
files in the same places. The RPM installation notices the clash of files
with perl-5.8.0, whereas of course CPAN does not. So I just need a way of
constructing the RPM so that it can install its files without the rpm
database knowing it's happened.

In this case RPM is a victim of its own success. I need to be able to
install these files without telling the rpm database what I've done, that's
the only way I can see out of this problem.

But why does it think perl-5.8.0 is newer than perl-MIME-Base64? Where is
it getting the dates from?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mbrijun at HOTMAIL.COM  Sat Oct  9 13:03:06 2004
From: mbrijun at HOTMAIL.COM (Martynas Brijunas)
Date: Thu Jan 12 21:27:12 2006
Subject: Question about perl-package?
Message-ID: <mailman.3302.1137101232.24926.mailscanner@lists.mailscanner.info>

could it be the case that the newer versions of perl incorporate the
functionality of mime-base64 and a separate package is no longer required?

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Saturday, October 09, 2004 12:46 PM
Subject: Re: Question about perl-package?


> At 23:22 08/10/2004, you wrote:
> >On Fri, 8 Oct 2004, Henrik Bro wrote:
> >
> > > My Red Hat say this...is it true?
> > >
> > >
> > > The following Packages are obsoleted by newer packages:
> > >
> > > Name-Version-Release        obsoleted by        Name-Version-Release
> > >
>
> --------------------------------------------------------------------------
--
> > > ---
> > > perl-MIME-Base64-3.03-1                         perl-5.8.0-88.7
> >
> >It *appears* that I have similar problems on two different RHEL 3 U3
boxes.
> >up2date has failed overnight complaining about failed dependencies on
> >perl-MIME-Base64.
> >
> >I will investigate further on Saturday.
>
> Installing MIME::Base64 through an RPM or using CPAN installs the same
> files in the same places. The RPM installation notices the clash of files
> with perl-5.8.0, whereas of course CPAN does not. So I just need a way of
> constructing the RPM so that it can install its files without the rpm
> database knowing it's happened.
>
> In this case RPM is a victim of its own success. I need to be able to
> install these files without telling the rpm database what I've done,
that's
> the only way I can see out of this problem.
>
> But why does it think perl-5.8.0 is newer than perl-MIME-Base64? Where is
> it getting the dates from?
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  9 13:45:01 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: MIME::Base64 rpm problems
Message-ID: <mailman.3303.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In the construction of the MIME::Base64 module, there is a test to see if
you are running Perl 5.8.0 or newer. If you are, it tries to install over
the top of the Perl-supplied files, instead of installing separately in the
site_perl directory like other people do.

So on any system older than Perl 5.8.0, it works fine. But run it on 5.8.0
or above and the installation overwrites the Perl-supplied files, which
causes all the RPM problems.

I don't want to change this, as the author must have done it for a reason.

I will contact them and try to find out what happened and why he has done this.

Anyone know anything about differences between 5.6.1 and 5.8.0 when it
comes to the order in which the @INC path is searched, particularly for
shared C modules.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct  9 13:17:19 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: Question about perl-package?
Message-ID: <mailman.3304.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
No, as otherwise install.sh would find the module was up to date and
wouldn't attempt to install anything as it wasn't needed.

At 13:03 09/10/2004, you wrote:
>could it be the case that the newer versions of perl incorporate the
>functionality of mime-base64 and a separate package is no longer required?
>
>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Saturday, October 09, 2004 12:46 PM
>Subject: Re: Question about perl-package?
>
>
> > At 23:22 08/10/2004, you wrote:
> > >On Fri, 8 Oct 2004, Henrik Bro wrote:
> > >
> > > > My Red Hat say this...is it true?
> > > >
> > > >
> > > > The following Packages are obsoleted by newer packages:
> > > >
> > > > Name-Version-Release        obsoleted by        Name-Version-Release
> > > >
> >
> > --------------------------------------------------------------------------
>--
> > > > ---
> > > > perl-MIME-Base64-3.03-1                         perl-5.8.0-88.7
> > >
> > >It *appears* that I have similar problems on two different RHEL 3 U3
>boxes.
> > >up2date has failed overnight complaining about failed dependencies on
> > >perl-MIME-Base64.
> > >
> > >I will investigate further on Saturday.
> >
> > Installing MIME::Base64 through an RPM or using CPAN installs the same
> > files in the same places. The RPM installation notices the clash of files
> > with perl-5.8.0, whereas of course CPAN does not. So I just need a way of
> > constructing the RPM so that it can install its files without the rpm
> > database knowing it's happened.
> >
> > In this case RPM is a victim of its own success. I need to be able to
> > install these files without telling the rpm database what I've done,
>that's
> > the only way I can see out of this problem.
> >
> > But why does it think perl-5.8.0 is newer than perl-MIME-Base64? Where is
> > it getting the dates from?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rpotter at RPCS.NET  Sat Oct  9 14:48:37 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:12 2006
Subject: MIME::Base64 rpm problems
Message-ID: <mailman.3305.1137101232.24926.mailscanner@lists.mailscanner.info>

On Sat, 9 Oct 2004, Julian Field wrote:

> In the construction of the MIME::Base64 module, there is a test to see if
> you are running Perl 5.8.0 or newer. If you are, it tries to install over
> the top of the Perl-supplied files, instead of installing separately in the
> site_perl directory like other people do.
>
> So on any system older than Perl 5.8.0, it works fine. But run it on 5.8.0
> or above and the installation overwrites the Perl-supplied files, which
> causes all the RPM problems.

<snip>

That is the problem. I just finished updating a RHEL 3 U3 server.

I shutdown MailScanner, and did a rpm -e perl-MIME-Base64 to fix the
dependency problem and get up2ate to run. After up2date finished, I forced
perl-MIME-Base64 back in.

up2date now complains about a package conflict error on perl-5.8.0-88.7,
saying the package is alrady installed.


Cheers!
--
Richard Potter RHCE
Re/Max
Kingston, ON  CANADA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From alden at ENGINENO9INC.COM  Sat Oct  9 16:17:29 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3306.1137101232.24926.mailscanner@lists.mailscanner.info>

>Alden Levy wrote:
>> I am having a little problem:
>> I would like to block mail from and to two particular email address, so
in
>> my MailScanner.conf, I set:
>> Is Definitely Spam = %rules-dir%/spam.blacklist.rules
>> High Scoring Spam Actions = store
>>
>> and in %rules-dir%/spam.blacklist.rules, I placed the lines:
>> FromOrTo: name@isp.com yes
>> FromOrTo: name2@isp2.com yes
>> FromOrTo: default no
>>
>> However, when I send mail from a blocked address, I receive the mail, but
>> the subject has {SPAM!} (which is how high scoring spam is indicate)
added
>> and the header has:
>> X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)

Peter Bonivart wrote:
>
>Do you have "Definite Spam Is High Scoring" set to "yes"?
>
>--
>/Peter Bonivart
>

Sorry, forgot to include that in my original email.
Yes, I do have:
Definite Spam Is High Scoring = yes

--Alden

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at CAMAROSS.NET  Sat Oct  9 16:22:41 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3307.1137101232.24926.mailscanner@lists.mailscanner.info>

Alden Levy wrote:
>> Alden Levy wrote:
>>> I am having a little problem:
>>> I would like to block mail from and to two particular email address,
>>> so
> in
>>> my MailScanner.conf, I set:
>>> Is Definitely Spam = %rules-dir%/spam.blacklist.rules High Scoring
>>> Spam Actions = store
>>>
>>> and in %rules-dir%/spam.blacklist.rules, I placed the lines:
>>> FromOrTo: name@isp.com yes FromOrTo: name2@isp2.com yes
>>> FromOrTo: default no
>>>
>>> However, when I send mail from a blocked address, I receive the
>>> mail, but the subject has {SPAM!} (which is how high scoring spam is
>>> indicate)
> added
>>> and the header has:
>>> X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)
>
> Peter Bonivart wrote:
>>
>> Do you have "Definite Spam Is High Scoring" set to "yes"?
>>
>> --
>> /Peter Bonivart
>>
>
> Sorry, forgot to include that in my original email.
> Yes, I do have:
> Definite Spam Is High Scoring = yes
>
> --Alden
>
> ------------------------ MailScanner list ------------------------ To

What is your High Scoring Spam Action = set to?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  9 16:22:08 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: MIME::Base64 rpm problems
Message-ID: <mailman.3308.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:48 09/10/2004, you wrote:
>On Sat, 9 Oct 2004, Julian Field wrote:
>
> > In the construction of the MIME::Base64 module, there is a test to see if
> > you are running Perl 5.8.0 or newer. If you are, it tries to install over
> > the top of the Perl-supplied files, instead of installing separately in the
> > site_perl directory like other people do.
> >
> > So on any system older than Perl 5.8.0, it works fine. But run it on 5.8.0
> > or above and the installation overwrites the Perl-supplied files, which
> > causes all the RPM problems.
>
><snip>
>
>That is the problem. I just finished updating a RHEL 3 U3 server.
>
>I shutdown MailScanner, and did a rpm -e perl-MIME-Base64 to fix the
>dependency problem and get up2ate to run. After up2date finished, I forced
>perl-MIME-Base64 back in.
>
>up2date now complains about a package conflict error on perl-5.8.0-88.7,
>saying the package is alrady installed.

There is a way of stopping these errors, but I don't know what the
consequences are. The way to stop it is to edit the Makefile.PL so that the
end of it refers to 'site' and not 'perl' (you'll see the bit I mean). Then
rebuild and reinstall the perl module with the usual steps.
This will make it install in site_perl rather than inside the main
/usr/lib/perl5 directory.

But, as I say, I don't know the consequences of this. I am trying to find
out why this is done. It's in the ChangeLog for this module, but no reason
is given for the change.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alden at ENGINENO9INC.COM  Sat Oct  9 16:39:33 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3309.1137101232.24926.mailscanner@lists.mailscanner.info>

Alden Levy wrote:
>>>> Alden Levy wrote:
>>>>>> I am having a little problem:
>>>>>> I would like to block mail from and to two particular email address,
>>>>>> so
>> in
>>>>>> my MailScanner.conf, I set:
>>>>>> Is Definitely Spam = %rules-dir%/spam.blacklist.rules
>>>>>> High Scoring Spam Actions = store
>>>
>>>>>> and in %rules-dir%/spam.blacklist.rules, I placed the lines:
>>>>>> FromOrTo: name@isp.com yes FromOrTo: name2@isp2.com yes
>>>>>> FromOrTo: default no
>>>
>>>>>> However, when I send mail from a blocked address, I receive the
>>>>>> mail, but the subject has {SPAM!} (which is how high scoring spam is
>>>>>> indicate)
>> added
>>>>>> and the header has:
>>>>>> X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)
>
>> Peter Bonivart wrote:
>>
>>>> Do you have "Definite Spam Is High Scoring" set to "yes"?
>>
>>>> --
>>>> /Peter Bonivart
>>
>
>> Sorry, forgot to include that in my original email.
>> Yes, I do have:
>> Definite Spam Is High Scoring = yes
>
>> --Alden
>

Mike Kercher wrote:
>What is your High Scoring Spam Action = set to?
>
>Mike

I've set it to:
High Scoring Spam Actions = store

and I've also done:
High Scoring Spam Actions = %rules-dir%/high.spam.rules
and in high.spam.rules, I put:
FromOrTo:       name@isp.com    delete
FromOrTo:       name2@isp2.com  delete
FromOrTo:       default store

It works in the second instance, but in the first, I still get the message
delivered (as opposed to just storing it, which is what happens with all of
my other high scoring spam).

Thanks,
Alden

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct  9 16:53:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3310.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:39 09/10/2004, you wrote:
>Alden Levy wrote:
> >>>> Alden Levy wrote:
> >>>>>> I am having a little problem:
> >>>>>> I would like to block mail from and to two particular email address,
> >>>>>> so
> >> in
> >>>>>> my MailScanner.conf, I set:
> >>>>>> Is Definitely Spam = %rules-dir%/spam.blacklist.rules
> >>>>>> High Scoring Spam Actions = store
> >>>
> >>>>>> and in %rules-dir%/spam.blacklist.rules, I placed the lines:
> >>>>>> FromOrTo: name@isp.com yes FromOrTo: name2@isp2.com yes
> >>>>>> FromOrTo: default no
> >>>
> >>>>>> However, when I send mail from a blocked address, I receive the
> >>>>>> mail, but the subject has {SPAM!} (which is how high scoring spam is
> >>>>>> indicate)
> >> added
> >>>>>> and the header has:
> >>>>>> X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)
> >
> >> Peter Bonivart wrote:
> >>
> >>>> Do you have "Definite Spam Is High Scoring" set to "yes"?
> >>
> >>>> --
> >>>> /Peter Bonivart
> >>
> >
> >> Sorry, forgot to include that in my original email.
> >> Yes, I do have:
> >> Definite Spam Is High Scoring = yes
> >
> >> --Alden
> >
>
>Mike Kercher wrote:
> >What is your High Scoring Spam Action = set to?
> >
> >Mike
>
>I've set it to:
>High Scoring Spam Actions = store
>
>and I've also done:
>High Scoring Spam Actions = %rules-dir%/high.spam.rules
>and in high.spam.rules, I put:
>FromOrTo:       name@isp.com    delete
>FromOrTo:       name2@isp2.com  delete
>FromOrTo:       default store
>
>It works in the second instance, but in the first, I still get the message
>delivered (as opposed to just storing it, which is what happens with all of
>my other high scoring spam).

Have you got anything else added, such as an email address in the "Archive
Mail" setting?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct  9 17:03:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:12 2006
Subject: realname
Message-ID: <mailman.3311.1137101232.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:45 09/10/2004, you wrote:
>My my mailscanner blocks email with out realname or a name  before the
>email address.  how can i turn this off?

This is a new one on me. Has anyone else ever experienced this?
MailScanner uses the addresses out of the envelope, not the headers. What
do you get if you enable the Envelope From and To headers in MailScanner.conf?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alden at ENGINENO9INC.COM  Sat Oct  9 17:18:43 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:12 2006
Subject: IS DEFINITELY SPAM being delivered
Message-ID: <mailman.3312.1137101232.24926.mailscanner@lists.mailscanner.info>

At 16:39 09/10/2004, you wrote:
>Alden Levy wrote:
> >>>>> >Alden Levy wrote:
> >>>>>>> >I am having a little problem:
> >>>>>>> >I would like to block mail from and to two particular email
address,
> >>>>>>> >so
> >>> >in
> >>>>>>> >my MailScanner.conf, I set:
> >>>>>>> >Is Definitely Spam = %rules-dir%/spam.blacklist.rules
> >>>>>>> >High Scoring Spam Actions = store
> >>>>
> >>>>>>> >and in %rules-dir%/spam.blacklist.rules, I placed the lines:
> >>>>>>> >FromOrTo: name@isp.com yes FromOrTo: name2@isp2.com yes
> >>>>>>> >FromOrTo: default no
> >>>>
> >>>>>>> >However, when I send mail from a blocked address, I receive the
> >>>>>>> >mail, but the subject has {SPAM!} (which is how high scoring spam
is
> >>>>>>> >indicate)
> >>> >added
> >>>>>>> >and the header has:
> >>>>>>> >X-engineno9inc-MailScanner-SpamCheck: spam (blacklisted)
> >>
> >>> >Peter Bonivart wrote:
> >>>
> >>>>> >Do you have "Definite Spam Is High Scoring" set to "yes"?
> >>>
> >>>>> >--
> >>>>> >/Peter Bonivart
> >>>
> >>
> >>> >Sorry, forgot to include that in my original email.
> >>> >Yes, I do have:
> >>> >Definite Spam Is High Scoring = yes
> >>
> >>> >--Alden
> >>
>
> >Mike Kercher wrote:
> >>What is your High Scoring Spam Action = set to?
> >>
> >>Mike
>
> >I've set it to:
> >High Scoring Spam Actions = store
>
> >and I've also done:
> >High Scoring Spam Actions = %rules-dir%/high.spam.rules
> >and in high.spam.rules, I put:
> >FromOrTo:       name@isp.com    delete
> >FromOrTo:       name2@isp2.com  delete
> >FromOrTo:       default store
>
> >It works in the second instance, but in the first, I still get the
message
> >delivered (as opposed to just storing it, which is what happens with all
of
> >my other high scoring spam).

> Have you got anything else added, such as an email address in the "Archive
> Mail" setting?
> --
> Julian Field

Nope.  Archive Mail is:
Archive Mail =

I don't *think* I've got any other issues.
FYI, the output of MailScanner -v is:
Running on
Linux mailserver.engineno9inc.com 2.4.20-28.7 #1 Thu Dec 18 11:31:59 EST
2003 i686 unknown
This is Red Hat Linux release 7.3 (Valhalla)
This is Perl version 5.006001 (5.6.1)
This is MailScanner version 4.33.3
Module versions are:
1.13    Archive::Zip
1.119   Convert::BinHex
1.03    Fcntl
2.6     File::Basename
2.03    File::Copy
2.00    FileHandle
1.0404  File::Path
0.14    File::Temp
1.27    HTML::Entities
3.34    HTML::Parser
2.28    HTML::TokeParser
1.20    IO
1.08    IO::File
1.121   IO::Pipe
3.05    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
5.413   MIME::Tools
0.09    Net::CIDR
1.03    POSIX
1.72    Socket
0.01    Sys::Syslog
1.01    Time::localtime
Optional module versions are:
3.000000        Mail::SpamAssassin
0.32    Net::LDAP
missing SAVI
0.11    Mail::ClamAV
0.48    Net::DNS

--Alden

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From spiv007 at gmail.com  Sat Oct  9 16:45:16 2004
From: spiv007 at gmail.com (spiv007)
Date: Thu Jan 12 21:27:13 2006
Subject: realname
Message-ID: <mailman.3313.1137101233.24926.mailscanner@lists.mailscanner.info>

My my mailscanner blocks email with out realname or a name  before the
email address.  how can i turn this off?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Krishna.shekhar at in.spectranet.com  Sat Oct  9 17:26:41 2004
From: Krishna.shekhar at in.spectranet.com (Krishna)
Date: Thu Jan 12 21:27:13 2006
Subject: Stop alerts per domain
Message-ID: <mailman.3314.1137101233.24926.mailscanner@lists.mailscanner.info>

Hi All,

How do I stop sending alerts for spam and virus per domain in MailScanner?


Best regards.
Krishna
Krishna.shekhar@in.spectranet.com
2004-10-09

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Sat Oct  9 19:43:23 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon::Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: realname
Message-ID: <mailman.3315.1137101233.24926.mailscanner@lists.mailscanner.info>

On Sat, 2004-10-09 at 11:45 -0400, spiv007 wrote:
> My my mailscanner blocks email with out realname or a name  before the
> email address.  how can i turn this off?

Do you have example logs for this?

--
 Mr. Michele Neylon
Blacknight Solutions
Hosting, Co-location & Domain Registration
http://www.blacknight.ie/
Tel. +353 (0)59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From cstone at AXINT.NET  Sat Oct  9 22:35:48 2004
From: cstone at AXINT.NET (Chris Stone)
Date: Thu Jan 12 21:27:13 2006
Subject: Resource unavailable
Message-ID: <mailman.3316.1137101233.24926.mailscanner@lists.mailscanner.info>

Still having problems  with MailScanner under Darwin (OSX). I am now
running in foreground debug mode and it seems that the problem is shown as
always the same thing:

Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7426]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.
g5:~ root# ./check_mailscanner
Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7444]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.
g5:~ root# ./check_mailscanner
Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7463]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.
g5:~ root# ./check_mailscanner
Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7481]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.
g5:~ root# ./check_mailscanner
Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7499]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.
g5:~ root# ./check_mailscanner
Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7518]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.
g5:~ root# ./check_mailscanner
Starting MailScanner...
MailScanner 4.34.8 starting in foreground mode - pid is [7536]
About to fork child #1 of 5...
Cannot fork off child process, Resource temporarily unavailable
at /opt/MailScanner/bin/MailScanner line 313.

Any ideas as to what might be causing this and how to resolve it? The
system is a dual processor with 2 gig RAM. I tried uping the ulimit
setting in check_mailscanner from the distribution setting of 2000 to 5000
but that seems to have had no effect.

Trying to start MailScanner will give the errors above for a while and
then start up ok. Then it'll run for a bit and die with another error like:

Can't fork: Resource temporarily unavailable
at /opt/MailScanner/lib/MailScanner/RBLs.pm line 121.
Can't fork: Resource temporarily unavailable
at /opt/MailScanner/lib/MailScanner/RBLs.pm line 121.
Can't fork: Resource temporarily unavailable
at /opt/MailScanner/lib/MailScanner/RBLs.pm line 121.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From david.hooton at gmail.com  Sun Oct 10 03:10:26 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:13 2006
Subject: Notify sender not working
Message-ID: <mailman.3317.1137101233.24926.mailscanner@lists.mailscanner.info>

Hi People,

Sorry to re-post, but has anyone else got any ideas on how I can fix
this issue?  I've been trying to make it work on one of our test boxes
for a few days but have had no success.

> I'm running Version 4.34.8 and am trying to get MailScanner to notify
> senders of blocked file names via a ruleset so only our internal
> customers are notified.
>
> I have got the ruleset in place, but it would appear that filename
> notify isn't actually sending an email to the sender.  I have tried
> doing the same with the notify senders of viruses and sent a test
> through, which did return a message.
>
> Relevant config below:
>
> Notify Senders = yes
> Notify Senders Of Blocked Filenames Or Filetypes = yes
> Notify Senders Of Other Blocked Content = yes
>
> I have used yes above to eliminate the possibility of ruleset errors causing it.
>
> On a side not it would be really cool if we could have a "Notify
> Recipient" option for blocked files
--
Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From andrew at DONEHUE.NET  Sun Oct 10 03:49:28 2004
From: andrew at DONEHUE.NET (Andrew)
Date: Thu Jan 12 21:27:13 2006
Subject: mailscanner defunct
Message-ID: <mailman.3318.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi All!

I have been using mailscanner for a few years now, and it is going
well.  I recently setup a Debian system, and used mailscanner from the
testing tree (as well as exim4.x).  All works well, except for the fact
that after the email is delivered, the mailscanner process becomes
'defunct'.  I have a cron script in to restart it every 10 mins (to get
rid of the defunct processes) - but it isn't the prettiest way to go
about things.

I have run mailscanner in debug mode, and it works fine - no errors,
etc.  Everything is working (email gets scanned for infections, spam,
and it gets delivered), except I get a lot of extra left over processes :(

I found this in my  mail.err log file -
Cannot create + lock headers file
/var/spool/MailScanner/incoming/32759/1CGR2j-0000BL-6l.header,

However, the permissions and ownership are correct - are there any other
known issues that could be causing this?

Some system info -

#uname -r
2.4.27b

#dpkg -p mailscanner
Package: mailscanner
Priority: optional
Section: mail
Installed-Size: 4352
Maintainer: Matthias Klose <doko@debian.org>
Architecture: all
Version: 4.33.3-1
Depends: exim4 | mail-transport-agent, spamassassin (>= 2.11), unzip,
ncftp | wget, ucf (>= 1.08), perl (>= 5.6.1), libarchive-zip-perl (>=
1.12), libconvert-tnef-perl, libhtml-parser-perl, libmime-perl (>=
5.411-2), libnet-cidr-perl, libcompress-zlib-perl (>= 1.33),
libconvert-binhex-perl
Pre-Depends: debconf (>= 0.5.00)
Recommends: tnef (>= 1.1.1)
Suggests: clamav, f-prot-installer, libnet-ldap-perl
Conflicts: exim4-base (<< 4.30-3)
Filename: pool/main/m/mailscanner/mailscanner_3.13.2-4_all.deb
Size: 816514
MD5sum: 02a110f8cff5f2576a67608795d4429a
Description: An email virus scanner and spam tagger


Any thoughts?

Cheers,
Andrew

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From cstone at AXINT.NET  Sun Oct 10 06:47:10 2004
From: cstone at AXINT.NET (Chris Stone)
Date: Thu Jan 12 21:27:13 2006
Subject: Resource unavailable - RESOLVED
Message-ID: <mailman.3319.1137101233.24926.mailscanner@lists.mailscanner.info>

Problem solved. Have to change the 'ulimit -n 2000' line in
check_mailscanner to 'ulimit -n unlimited' and add the following two lines:

ulimit -Su 8000
ulimit -Hu 10000

(could also have used unlimited instead of the numbers).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sun Oct 10 15:35:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3320.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
For those of you suffering from the perl module dependency problems,
particularly on RHEL3, I think I have cracked it.

I have just released a new 4.35.1 beta release, which contains a new
MIME::Base64 module in which I have fixed the problem.

Please give it a try and let me know how you get on with it.

Download from www.mailscanner.info as usual.

ChangeLog is:
* New Features and Improvements *
- SpamAssassin 3 SPF checks are now fully supported.
- Added Disposition-Notification-To and Return-Receipt-To to the list of
   headers I advise you to remove.
- Added "Log Silent Viruses" configuration option.

* Fixes *
- Fixed bug where filetype checks that matched no rules were not logged
   properly.
- Fixed problems with MIME::Base64 dependencies.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From kte at NEXIS.BE  Sun Oct 10 15:38:07 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:13 2006
Subject: RHEL clones
Message-ID: <mailman.3321.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
http://lwn.net/Articles/69534/
Does anyone have an idea which of these support mailscanner? And has a
chance to survive into the future?
Is for chosing a new free OS for making our mailscanner configurations.
thanks Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Sun Oct 10 15:45:47 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon::Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: RHEL clones
Message-ID: <mailman.3322.1137101233.24926.mailscanner@lists.mailscanner.info>

On Sun, 2004-10-10 at 16:38 +0200, Koen Teugels wrote:
> http://lwn.net/Articles/69534/
> Does anyone have an idea which of these support mailscanner? And has a
> chance to survive into the future?
> Is for chosing a new free OS for making our mailscanner configurations.
> thanks Koen

They all support MailScanner.
To be more precise the converse is usually true :)

We are currently using Whitebox linux on a number of machines, while
other people here are using Tao and Centos.

Survival of the more popular ones seems to be fairly good :)

By the way, I wouldn't describe any OS as "free". Open Source and no
licensing fee maybe, but "free" - no way.
--
 Mr. Michele Neylon
Blacknight Solutions
Hosting, Co-location & Domain Registration
http://www.blacknight.ie/
Tel. +353 (0)59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hunter at userfriendly.net  Sun Oct 10 15:48:44 2004
From: hunter at userfriendly.net (Michael Weiner)
Date: Thu Jan 12 21:27:13 2006
Subject: RHEL clones
Message-ID: <mailman.3323.1137101233.24926.mailscanner@lists.mailscanner.info>

On Sun, 2004-10-10 at 16:38 +0200, Koen Teugels wrote:
> http://lwn.net/Articles/69534/
> Does anyone have an idea which of these support mailscanner? And has a
> chance to survive into the future?
> Is for chosing a new free OS for making our mailscanner configurations.
> thanks Koen

since they are ALL based on a RedHat distribution, they all "support"
mailscanner provided the correct perl RPMS and environment is there to
begin with. As to which has a future? Thats a good question, that i
dont think has a real answer - this is all dependent on the support
from the various open source communities (akin to fedora legacy
project) and may be supported now but dropped in the future.
Personally i like white box, but have played with Tao and CentOS, as
its very close to what the RHEL distribution looks like.

HTH
Michael Weiner

All information contained in this email is confidential and may be used by the intended recipient only.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From brose at MED.WAYNE.EDU  Sun Oct 10 17:09:23 2004
From: brose at MED.WAYNE.EDU (Rose, Bobby)
Date: Thu Jan 12 21:27:13 2006
Subject: OT:  Sendmail and Queuegroups
Message-ID: <mailman.3324.1137101233.24926.mailscanner@lists.mailscanner.info>

Has anyone used sendmail queuegroups?  What about with a MailScanner
setup?  I've tried setting it up even without the MailScanner
requirement of an incoming queue and outgoing queue with little success.
Basically what I was hoping to do was take incoming All User listserve
messages from the campus listserver which is a moderated list and place
them in a separate queue that MailScanner doesn't scan.  The reason for
this is that when they send their all user messages, MailScanner with
Spamassassin checks just gets overwhelmed even though they are
whitelisted.  While MS w/SA is processing them, between 5 and 30
messages a min come in and queue up behind it.  I have been running MS
for many months with 15 processes at 30 messages each but when we get
hit with a couple thousand messages at once, I have to disable the
spamassasin checks until the queue clears up.  They used to send their
messages at the end of the day but for some reason they started sending
around 10/11am which tends to be peak times for typical incoming mail.
Incoming mail is merely rerouted to the destination using ldap.

Our MS server is really just a gateway where all our incoming mail comes
thru but it looks like the queue group only works if I'm sending a
message from the gateway box itself.  If I test using sendmail -bt, the
results look successfully but if I send a message that comes into it
from the outside, it still ends up in the default queue.  I've even
tried the Extended Queue Group m4 from http://www.murty.net/qgrpx/.    

I've search the net and can't find any good examples of this setup and
google has some topics on it but they haven't helped.  I've even set it
up using info from O'Reilly sendmail book.  So I'm beginning to wonder
if this will even work in a sendmail router kind of setup.  Besides the
MS config mentioned above, I'm on SunFire box with 2 gig ram and using
tmpfs for the MS incoming process.  I hoping to get a new Dell server
and switch to Linux before the end of the year with faster procs but I
still like to figure out the queuegroup to have that option available.

Thanks for any suggestions.
Bobby Rose
Wayne State University School of Medicine

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mbrijun at HOTMAIL.COM  Sun Oct 10 18:02:11 2004
From: mbrijun at HOTMAIL.COM (Martynas Brijunas)
Date: Thu Jan 12 21:27:13 2006
Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3325.1137101233.24926.mailscanner@lists.mailscanner.info>

hi Julian

I have just tried out the new Mailscanner 4.35.1-1 on my Fedora Core 2. It
went through the installation of perl modules with several failed builds
(convert-tnef for example) and then gave this error:

************************************************************
Now to install MailScanner itself.

error: Failed dependencies:
        perl-MIME-tools >= 5.412 is needed by mailscanner-4.35.1-1
[root@flox MailScanner-4.35.1-1]#

************************************************************



----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Sunday, October 10, 2004 3:35 PM
Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems


> For those of you suffering from the perl module dependency problems,
> particularly on RHEL3, I think I have cracked it.
>
> I have just released a new 4.35.1 beta release, which contains a new
> MIME::Base64 module in which I have fixed the problem.
>
> Please give it a try and let me know how you get on with it.
>
> Download from www.mailscanner.info as usual.
>
> ChangeLog is:
> * New Features and Improvements *
> - SpamAssassin 3 SPF checks are now fully supported.
> - Added Disposition-Notification-To and Return-Receipt-To to the list of
>    headers I advise you to remove.
> - Added "Log Silent Viruses" configuration option.
>
> * Fixes *
> - Fixed bug where filetype checks that matched no rules were not logged
>    properly.
> - Fixed problems with MIME::Base64 dependencies.
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sun Oct 10 18:10:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3326.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Can you send me (off-list) the output of install.sh.
I haven't touched perl-MIME-tools since 4.34.8-4.

At 18:02 10/10/2004, you wrote:
>hi Julian
>
>I have just tried out the new Mailscanner 4.35.1-1 on my Fedora Core 2. It
>went through the installation of perl modules with several failed builds
>(convert-tnef for example) and then gave this error:
>
>************************************************************
>Now to install MailScanner itself.
>
>error: Failed dependencies:
>         perl-MIME-tools >= 5.412 is needed by mailscanner-4.35.1-1
>[root@flox MailScanner-4.35.1-1]#
>
>************************************************************
>
>
>
>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Sunday, October 10, 2004 3:35 PM
>Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
>
>
> > For those of you suffering from the perl module dependency problems,
> > particularly on RHEL3, I think I have cracked it.
> >
> > I have just released a new 4.35.1 beta release, which contains a new
> > MIME::Base64 module in which I have fixed the problem.
> >
> > Please give it a try and let me know how you get on with it.
> >
> > Download from www.mailscanner.info as usual.
> >
> > ChangeLog is:
> > * New Features and Improvements *
> > - SpamAssassin 3 SPF checks are now fully supported.
> > - Added Disposition-Notification-To and Return-Receipt-To to the list of
> >    headers I advise you to remove.
> > - Added "Log Silent Viruses" configuration option.
> >
> > * Fixes *
> > - Fixed bug where filetype checks that matched no rules were not logged
> >    properly.
> > - Fixed problems with MIME::Base64 dependencies.
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sun Oct 10 19:20:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3327.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Please can you try this patch to install.sh and then run it again:

-----SNIP-----
--- install.sh.old      2004-10-10 16:43:53.000000000 +0100
+++ install.sh  2004-10-10 19:18:42.000000000 +0100
@@ -156,6 +156,12 @@
  sleep 5

  echo
+echo Setting Perl5 search path
+echo
+PERL5LIB=`perl -V | grep site_perl | tr -d ' ' | tr '\n' ':'`
+export PERL5LIB
+
+echo
  echo Rebuilding all the Perl RPMs for your version of Perl
  echo
  sleep 5
-----SNIP-----

At 18:10 10/10/2004, you wrote:
>Can you send me (off-list) the output of install.sh.
>I haven't touched perl-MIME-tools since 4.34.8-4.
>
>At 18:02 10/10/2004, you wrote:
>>hi Julian
>>
>>I have just tried out the new Mailscanner 4.35.1-1 on my Fedora Core 2. It
>>went through the installation of perl modules with several failed builds
>>(convert-tnef for example) and then gave this error:
>>
>>************************************************************
>>Now to install MailScanner itself.
>>
>>error: Failed dependencies:
>>         perl-MIME-tools >= 5.412 is needed by mailscanner-4.35.1-1
>>[root@flox MailScanner-4.35.1-1]#
>>
>>************************************************************
>>
>>
>>
>>----- Original Message -----
>>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>>To: <MAILSCANNER@JISCMAIL.AC.UK>
>>Sent: Sunday, October 10, 2004 3:35 PM
>>Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
>>
>>
>> > For those of you suffering from the perl module dependency problems,
>> > particularly on RHEL3, I think I have cracked it.
>> >
>> > I have just released a new 4.35.1 beta release, which contains a new
>> > MIME::Base64 module in which I have fixed the problem.
>> >
>> > Please give it a try and let me know how you get on with it.
>> >
>> > Download from www.mailscanner.info as usual.
>> >
>> > ChangeLog is:
>> > * New Features and Improvements *
>> > - SpamAssassin 3 SPF checks are now fully supported.
>> > - Added Disposition-Notification-To and Return-Receipt-To to the list of
>> >    headers I advise you to remove.
>> > - Added "Log Silent Viruses" configuration option.
>> >
>> > * Fixes *
>> > - Fixed bug where filetype checks that matched no rules were not logged
>> >    properly.
>> > - Fixed problems with MIME::Base64 dependencies.
>> > --
>> > Julian Field
>> > www.MailScanner.info
>> > Professional Support Services at www.MailScanner.biz
>> > MailScanner thanks transtec Computers for their support
>> > Buy the MailScanner book at www.MailScanner.info/store
>> >
>> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>> >
>> > ------------------------ MailScanner list ------------------------
>> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> > 'leave mailscanner' in the body of the email.
>> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>> >
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sanjay.patel at REXWIRE.COM  Sun Oct 10 20:36:46 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3328.1137101233.24926.mailscanner@lists.mailscanner.info>

I cannot get it to install. MailScanner install keeps erroring out with
following error
error: Failed dependencies:
        perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4

I have tried Mandrake 10 and 10.1 and same results.


SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Sun Oct 10 20:42:55 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3329.1137101233.24926.mailscanner@lists.mailscanner.info>

On Sun, 2004-10-10 at 15:36 -0400, Sanjay K. Patel wrote:
> I cannot get it to install. MailScanner install keeps erroring out with
> following error
> error: Failed dependencies:
>         perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4
>
> I have tried Mandrake 10 and 10.1 and same results.

Have you tried to install the missing module from src/rpm/cpan?

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Sun Oct 10 20:58:39 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3330.1137101233.24926.mailscanner@lists.mailscanner.info>

Yes I have I installed all the modules but the install script wants to
reinstall them again.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Michele Neylon : Blacknight Solutions
Sent: Sunday, October 10, 2004 3:43 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Has anyone got MaiScanner running on Mandrake 10.1?

On Sun, 2004-10-10 at 15:36 -0400, Sanjay K. Patel wrote:
> I cannot get it to install. MailScanner install keeps erroring out
> with following error
> error: Failed dependencies:
>         perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4
>
> I have tried Mandrake 10 and 10.1 and same results.

Have you tried to install the missing module from src/rpm/cpan?

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james at grayonline.id.au  Mon Oct 11 00:14:44 2004
From: james at grayonline.id.au (James Gray)
Date: Thu Jan 12 21:27:13 2006
Subject: RHEL clones
Message-ID: <mailman.3331.1137101233.24926.mailscanner@lists.mailscanner.info>

On Mon, 11 Oct 2004 12:45 am, Michele Neylon::Blacknight Solutions wrote:
> By the way, I wouldn't describe any OS as "free". Open Source and no
> licensing fee maybe, but "free" - no way.

"Free" as in speech, not "free" as in beer.
http://www.gnu.org/philosophy/free-sw.html.  It's a philosophy more than a
sales pitch :)

James
--
"If God lived on Earth, people would knock out all His windows."
                -- Yiddish saying

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From gdoris at rogers.com  Mon Oct 11 01:09:21 2004
From: gdoris at rogers.com (Gerry Doris)
Date: Thu Jan 12 21:27:13 2006
Subject: FC2 and MailScanner-MRTG
Message-ID: <mailman.3332.1137101233.24926.mailscanner@lists.mailscanner.info>

I posted the following message on the MailScanner-MRTG list on SourceForge
but that list doesn't have much traffic and I was hoping someone here
might be able to help me...

I just upgraded from Fedora Core 1 to 2. I think I finally have everything
working again except for MailScanner-MRTG.

I'm seeing two problems:

1. snmpd is kicking out a continuous stream of errors about no page line
in /proc/stat and then no swap line in /proc/stat.

2. when mailq runs php complains about an undefined constant VIRUS_REGEX
in functions.php on lines 54 and 66 and then an undefined varible output
on line 166 of mailq.php.


Fedora Core 2 has all the updates applied and I'm using the newest
versions of MailScanner, MailScaner-MRTG and snmp.  Has anyone else
experienced the above?


Gerry

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jkau at JASPER.K12.GA.US  Mon Oct 11 07:12:16 2004
From: jkau at JASPER.K12.GA.US (Jason Kau)
Date: Thu Jan 12 21:27:13 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3333.1137101233.24926.mailscanner@lists.mailscanner.info>

A few MCP-related bugs I've noticed in 4.34.8 on my server (RHEL 3 AS on Dell
PowerEdge 2500):

1) MCP messages are quaratined with incorrect ownership of the individual
message files (but directories have correct ownership).  My MailScanner.conf
says:

Quaratine User = apache
Quarantine Group = apache
Quarantine Permissions = 0660

Individual MCP message files are quarantined owned by root:root:

[root@cheetah mcp]# pwd
/var/spool/MailScanner/quarantine/20041011/mcp
[root@cheetah mcp]# ls -al
total 20
drwxrwx---    2 apache   apache       4096 Oct 11 01:25 .
drwxrwx---    3 apache   apache       4096 Oct 11 01:14 ..
-rw-rw----    1 root     root          882 Oct 11 01:14 i9B5DhuS026130
-rw-rw----    1 root     root         1720 Oct 11 01:25 i9B5OqOs026471
-rw-rw----    1 root     root          882 Oct 11 01:58 i9B5vNM3027985
[root@cheetah mcp]#

But individual spam message files are quarantined with the correct ownership:

[root@cheetah spam]# pwd
/var/spool/MailScanner/quarantine/20041011/spam
[root@cheetah spam]# ls -al
total 68
drwxrwx---    2 apache   apache       4096 Oct 11 01:47 .
drwxrwx---    4 apache   apache       4096 Oct 11 01:47 ..
-rw-rw----    1 apache   apache      38752 Oct 11 01:56 i9B5uUUf027938
-rw-rw----    1 apache   apache       6971 Oct 11 01:58 i9B5vJtF027982
-rw-rw----    1 apache   apache       2094 Oct 11 01:58 i9B5vSS7027989
-rw-rw----    1 apache   apache       2108 Oct 11 01:58 i9B5vSS8027989
-rw-rw----    1 apache   apache       2094 Oct 11 01:58 i9B5vSS9027989

[root@cheetah spam]#

2) If an email is marked as spam, it is also always logged in syslog as MCP:

For example, here's an email that is certainly not matching my MCP rules but
MailScanner says it's an MCP message:

Oct 11 02:05:47 cheetah MailScanner[28508]: Message i9B65FSe028510 from
63.251.59.120 (money_finders.bfb@reply.ic10.com) to jasper.k12.ga.us is spam,
SBL+XBL, NJABL, SpamAssassin (score=5.1, required 3, CLICK_BELOW 0.10,
HTML_30_40 0.89, HTML_LINK_CLICK_HERE 0.10, HTML_MESSAGE 0.10,
SARE_HTML_FONT_INVIS2 0.64, SARE_HTML_NO_BODY1 1.03, SARE_MONEYTERMS 0.68,
UNCLAIMED_MONEY 1.64)
Oct 11 02:05:47 cheetah MailScanner[28508]: Spam Checks: Found 1 spam messages
Oct 11 02:05:48 cheetah MailScanner[28508]: Spam Actions: message i9B65FSe028510
actions are alerts@localhost,forward
Oct 11 02:05:48 cheetah MailScanner[28508]: MCP Checks: Starting
Oct 11 02:05:48 cheetah MailScanner[28508]: MCP Checks: Found 1 MCP messages
Oct 11 02:05:48 cheetah MailScanner[28508]: Virus and Content Scanning: Starting
Oct 11 02:05:48 cheetah MailScanner[28508]: Content Checks: Detected and will
disarm HTML message in i9B65FSe028510
Oct 11 02:05:49 cheetah MailScanner[28508]: Uninfected: Delivered 1 messages

Thank you for MailScanner.  Very nice.

--
Jason Kau
Consultant
Jasper County Schools
Monticello, GA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Mon Oct 11 07:40:24 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3334.1137101233.24926.mailscanner@lists.mailscanner.info>

The scr rpms won't rebuild under Mandrake.  My solution is to download
the binary rpms from: http://rpmpan.sourceforge.net/

Install those first, then just rpm -ivh mailscanner.

I have raised this a few times, but nobody seems interested in making
the install script work with Mandrake.  This way works well though.

HTH
Brian

On Mon, 2004-10-11 at 05:58, Sanjay K. Patel wrote:
> Yes I have I installed all the modules but the install script wants to
> reinstall them again.
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Michele Neylon : Blacknight Solutions
> Sent: Sunday, October 10, 2004 3:43 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Has anyone got MaiScanner running on Mandrake 10.1?
>
> On Sun, 2004-10-10 at 15:36 -0400, Sanjay K. Patel wrote:
> > I cannot get it to install. MailScanner install keeps erroring out
> > with following error
> > error: Failed dependencies:
> >         perl-MIME-tools >= 5.412 is needed by mailscanner-4.34.8-4
> >
> > I have tried Mandrake 10 and 10.1 and same results.
>
> Have you tried to install the missing module from src/rpm/cpan?
>
> --
> Mr Michele Neylon
> Blacknight Solutions
> http://www.blacknight.ie
> 059 9137101
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From j.sharp at ECON.USYD.EDU.AU  Mon Oct 11 08:21:41 2004
From: j.sharp at ECON.USYD.EDU.AU (Justin Sharp)
Date: Thu Jan 12 21:27:13 2006
Subject: Silent Virus List
Message-ID: <mailman.3335.1137101233.24926.mailscanner@lists.mailscanner.info>

Hi

I'm having trouble finding the format for the silent viruses rule set. I
have a Send Notices ruleset of the format:

Virus:    Mabutu     no
Virus:    SomeFool   no
Virus:    sober      no
Virus:    bagle      no
Virus:    lovgate    no
Virus:    nyxem      no
Virus:    mydoom     no
Virus:    zafi       no
Virus:    gibe       no
Virus:    urlspoof   no
Virus:    default    yes

This means that the postmaster does not get notified of the above viruses.
Whats the ruleset format for the "Silent Viruses" parameter. Thanks is
advance!

Just

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 08:34:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3336.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What happens when you try to rebuild a srpm into a rpm under Mandrake?

At 07:40 11/10/2004, you wrote:
>The scr rpms won't rebuild under Mandrake.  My solution is to download
>the binary rpms from: http://rpmpan.sourceforge.net/
>
>Install those first, then just rpm -ivh mailscanner.
>
>I have raised this a few times, but nobody seems interested in making
>the install script work with Mandrake.  This way works well though.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 09:13:32 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3337.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have just added this patch to the core distribution and have released
4.35.1-2 which includes it.

At 19:20 10/10/2004, you wrote:
>Please can you try this patch to install.sh and then run it again:
>
>-----SNIP-----
>--- install.sh.old      2004-10-10 16:43:53.000000000 +0100
>+++ install.sh  2004-10-10 19:18:42.000000000 +0100
>@@ -156,6 +156,12 @@
>  sleep 5
>
>  echo
>+echo Setting Perl5 search path
>+echo
>+PERL5LIB=`perl -V | grep site_perl | tr -d ' ' | tr '\n' ':'`
>+export PERL5LIB
>+
>+echo
>  echo Rebuilding all the Perl RPMs for your version of Perl
>  echo
>  sleep 5
>-----SNIP-----
>
>At 18:10 10/10/2004, you wrote:
>>Can you send me (off-list) the output of install.sh.
>>I haven't touched perl-MIME-tools since 4.34.8-4.
>>
>>At 18:02 10/10/2004, you wrote:
>>>hi Julian
>>>
>>>I have just tried out the new Mailscanner 4.35.1-1 on my Fedora Core 2. It
>>>went through the installation of perl modules with several failed builds
>>>(convert-tnef for example) and then gave this error:
>>>
>>>************************************************************
>>>Now to install MailScanner itself.
>>>
>>>error: Failed dependencies:
>>>         perl-MIME-tools >= 5.412 is needed by mailscanner-4.35.1-1
>>>[root@flox MailScanner-4.35.1-1]#
>>>
>>>************************************************************
>>>
>>>
>>>
>>>----- Original Message -----
>>>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>>>To: <MAILSCANNER@JISCMAIL.AC.UK>
>>>Sent: Sunday, October 10, 2004 3:35 PM
>>>Subject: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
>>>
>>>
>>> > For those of you suffering from the perl module dependency problems,
>>> > particularly on RHEL3, I think I have cracked it.
>>> >
>>> > I have just released a new 4.35.1 beta release, which contains a new
>>> > MIME::Base64 module in which I have fixed the problem.
>>> >
>>> > Please give it a try and let me know how you get on with it.
>>> >
>>> > Download from www.mailscanner.info as usual.
>>> >
>>> > ChangeLog is:
>>> > * New Features and Improvements *
>>> > - SpamAssassin 3 SPF checks are now fully supported.
>>> > - Added Disposition-Notification-To and Return-Receipt-To to the list of
>>> >    headers I advise you to remove.
>>> > - Added "Log Silent Viruses" configuration option.
>>> >
>>> > * Fixes *
>>> > - Fixed bug where filetype checks that matched no rules were not logged
>>> >    properly.
>>> > - Fixed problems with MIME::Base64 dependencies.
>>> > --
>>> > Julian Field
>>> > www.MailScanner.info
>>> > Professional Support Services at www.MailScanner.biz
>>> > MailScanner thanks transtec Computers for their support
>>> > Buy the MailScanner book at www.MailScanner.info/store
>>> >
>>> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>> >
>>> > ------------------------ MailScanner list ------------------------
>>> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> > 'leave mailscanner' in the body of the email.
>>> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>> >
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 11 09:54:23 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3338.1137101233.24926.mailscanner@lists.mailscanner.info>

> I have raised this a few times, but nobody seems interested
> in making the install script work with Mandrake.

It's not that nobody is interested, but that most of us don't have access to
MDK servers :)




Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From usergroups at THEARGONCOMPANY.COM  Mon Oct 11 10:23:43 2004
From: usergroups at THEARGONCOMPANY.COM (Boskey)
Date: Thu Jan 12 21:27:13 2006
Subject: Rules for Delivery method
Message-ID: <mailman.3339.1137101233.24926.mailscanner@lists.mailscanner.info>

Hi ,

I have a mail server with MailScanner /Sendmail installed.
We have a Dail-up connection, and we are also relaying mails to our domain
servers.

Due, to the dail-up connection we wanted to use the HoldExpensive=True feature
of sendmail, also wanted the delivery of internal mails instant.
So added the following rule for the Variable "Delivery Method=" in
MailScanner.conf

-------------------------------------
To:  *@mydomain.com  batch
FromOrTo:  default   queue
-------------------------------------

This works well, however if i send a mail to an external ID and CC an internal
member in a mail , both the mails are being delievered instantly, rather than
one being delivered and the other being queued.

Regards,

Boskey.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 10:36:44 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Rules for Delivery method
Message-ID: <mailman.3340.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:23 11/10/2004, you wrote:
>Hi ,
>
>I have a mail server with MailScanner /Sendmail installed.
>We have a Dail-up connection, and we are also relaying mails to our domain
>servers.
>
>Due, to the dail-up connection we wanted to use the HoldExpensive=True feature
>of sendmail, also wanted the delivery of internal mails instant.
>So added the following rule for the Variable "Delivery Method=" in
>MailScanner.conf
>
>-------------------------------------
>To:  *@mydomain.com  batch
>FromOrTo:  default   queue
>-------------------------------------
>
>This works well, however if i send a mail to an external ID and CC an internal
>member in a mail , both the mails are being delievered instantly, rather than
>one being delivered and the other being queued.

That's because when sendmail receives the message, it's only 1 message with
2 recipients, not 2 separate messages. You can get round this by using
queue-groups to limit the number of recipients per message to 1, at which
point MailScanner will be given 2 messages. Search the archives for
"sendmail queue groups" and you should find it. It's been discussed on the
mailing list quite a few times before.


--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From clicknow at SWIFTDSL.COM.AU  Mon Oct 11 11:39:24 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3341.1137101233.24926.mailscanner@lists.mailscanner.info>

Can rebuild source rpms designed for Mandrake use, but attempting it
with the rpms provided with MS, you'll get results like this:

bzip2: Bad flag `-n'
bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.

   usage: bzip2 [flags and input files in any order]

   -h --help           print this message
   -d --decompress     force decompression
   -z --compress       force compression
   -k --keep           keep (don't delete) input files
   -f --force          overwrite existing output files
   -t --test           test compressed file integrity
   -c --stdout         output to standard out
   -q --quiet          suppress noncritical error messages
   -v --verbose        be verbose (a 2nd -v gives more)
   -L --license        display software version & license
   -V --version        display software version & license
   -s --small          use less memory (at most 2500k)
   -1 .. -9            set block size to 100k .. 900k
   --fast              alias for -1
   --best              alias for -9

   If invoked as `bzip2', default action is to compress.
              as `bunzip2',  default action is to decompress.
              as `bzcat', default action is to decompress to stdout.

   If no file names are given, bzip2 compresses or decompresses
   from standard input to standard output.  You can combine
   short flags, so `-v -4' means the same as -v4 or -4v, &c.

+ find /var/tmp/perl-Convert-BinHex-root/usr -type f -print
+ sed 's@^/var/tmp/perl-Convert-BinHex-root@@g'
+ grep -v perllocal.pod
+ grep -v '\.packlist'
++ cat Convert-BinHex-1.119-filelist
+ '[' '/usr/lib/perl5/site_perl/5.8.3/Convert/BinHex.pm
/usr/share/man/man3/Convert::BinHex.3pmX' = X ']'
+ /usr/lib/rpm/brp-mandrake
Cleaning files...done
Compressing files...done
Stripping files...done
Relativisation of symlinks...done
Clean perl...done
Building libraries symlinks...done
Processing files: perl-Convert-BinHex-1.119-2
error: File not found:
/var/tmp/perl-Convert-BinHex-root/usr/share/man/man3/Convert::BinHex.3pm


RPM build errors:
    File not found:
/var/tmp/perl-Convert-BinHex-root/usr/share/man/man3/Convert::BinHex.3pm

and variations on the theme.  I have no knowledge of how a src rpm is
built, but understand that it's some difference with the way Mandrake is
set up that needs to be reflected in the spec files.  ODes that make
sense?

I would be happy to provide ssh access to a Mandrake server for testing
purposes if that helps.

cheers
Brian

On Mon, 2004-10-11 at 17:34, Julian Field wrote:
> What happens when you try to rebuild a srpm into a rpm under Mandrake?
>
> At 07:40 11/10/2004, you wrote:
> >The scr rpms won't rebuild under Mandrake.  My solution is to download
> >the binary rpms from: http://rpmpan.sourceforge.net/
> >
> >Install those first, then just rpm -ivh mailscanner.
> >
> >I have raised this a few times, but nobody seems interested in making
> >the install script work with Mandrake.  This way works well though.
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 11:47:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3342.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Remote access would be useful, yes.

At 11:39 11/10/2004, you wrote:
>Can rebuild source rpms designed for Mandrake use, but attempting it
>with the rpms provided with MS, you'll get results like this:
>
>bzip2: Bad flag `-n'
>bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
>
>    usage: bzip2 [flags and input files in any order]
>
>    -h --help           print this message
>    -d --decompress     force decompression
>    -z --compress       force compression
>    -k --keep           keep (don't delete) input files
>    -f --force          overwrite existing output files
>    -t --test           test compressed file integrity
>    -c --stdout         output to standard out
>    -q --quiet          suppress noncritical error messages
>    -v --verbose        be verbose (a 2nd -v gives more)
>    -L --license        display software version & license
>    -V --version        display software version & license
>    -s --small          use less memory (at most 2500k)
>    -1 .. -9            set block size to 100k .. 900k
>    --fast              alias for -1
>    --best              alias for -9
>
>    If invoked as `bzip2', default action is to compress.
>               as `bunzip2',  default action is to decompress.
>               as `bzcat', default action is to decompress to stdout.
>
>    If no file names are given, bzip2 compresses or decompresses
>    from standard input to standard output.  You can combine
>    short flags, so `-v -4' means the same as -v4 or -4v, &c.
>
>+ find /var/tmp/perl-Convert-BinHex-root/usr -type f -print
>+ sed 's@^/var/tmp/perl-Convert-BinHex-root@@g'
>+ grep -v perllocal.pod
>+ grep -v '\.packlist'
>++ cat Convert-BinHex-1.119-filelist
>+ '[' '/usr/lib/perl5/site_perl/5.8.3/Convert/BinHex.pm
>/usr/share/man/man3/Convert::BinHex.3pmX' = X ']'
>+ /usr/lib/rpm/brp-mandrake
>Cleaning files...done
>Compressing files...done
>Stripping files...done
>Relativisation of symlinks...done
>Clean perl...done
>Building libraries symlinks...done
>Processing files: perl-Convert-BinHex-1.119-2
>error: File not found:
>/var/tmp/perl-Convert-BinHex-root/usr/share/man/man3/Convert::BinHex.3pm
>
>
>RPM build errors:
>     File not found:
>/var/tmp/perl-Convert-BinHex-root/usr/share/man/man3/Convert::BinHex.3pm
>
>and variations on the theme.  I have no knowledge of how a src rpm is
>built, but understand that it's some difference with the way Mandrake is
>set up that needs to be reflected in the spec files.  ODes that make
>sense?
>
>I would be happy to provide ssh access to a Mandrake server for testing
>purposes if that helps.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jags at CSA.IISC.ERNET.IN  Mon Oct 11 11:32:08 2004
From: jags at CSA.IISC.ERNET.IN (Jagadish Murthy)
Date: Thu Jan 12 21:27:13 2006
Subject: help
Message-ID: <mailman.3343.1137101233.24926.mailscanner@lists.mailscanner.info>

Hello Mailscan users,

i am a newbie  trying to get recent version
4.30.3-1 version of mailscanner on RedHat
enterprise linux 3.0. (sendmail)

i have tried both rpm version  and tar.gz
version.

both fail in some dependency  on perl-MIME-tools 5.4 needed.

can anbody give some tips on the installation if
they have tried on RHEnterprise Server 3.0 and any
thing else to be installed ?

also can somebody guide me to better documentation
than is available thru the distro / website ?

i cant buy the book - too expensive to import and not
available in our local stores ( Bangalore, INDIA )

TIA

jagadish

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Mon Oct 11 12:35:42 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:13 2006
Subject: Has anyone got MaiScanner running on Mandrake 10.1?
Message-ID: <mailman.3344.1137101233.24926.mailscanner@lists.mailscanner.info>

OK - contact me off list at: brian@univex.com.au and we'll set it up.

cheers
Brian

On Mon, 2004-10-11 at 20:47, Julian Field wrote:
> Remote access would be useful, yes.
>
> At 11:39 11/10/2004, you wrote:
> >Can rebuild source rpms designed for Mandrake use, but attempting it
> >with the rpms provided with MS, you'll get results like this:
> >
> >bzip2: Bad flag `-n'
> >bzip2, a block-sorting file compressor.  Version 1.0.2, 30-Dec-2001.
> >
> >    usage: bzip2 [flags and input files in any order]
> >
> >    -h --help           print this message
> >    -d --decompress     force decompression
> >    -z --compress       force compression
> >    -k --keep           keep (don't delete) input files
> >    -f --force          overwrite existing output files
> >    -t --test           test compressed file integrity
> >    -c --stdout         output to standard out
> >    -q --quiet          suppress noncritical error messages
> >    -v --verbose        be verbose (a 2nd -v gives more)
> >    -L --license        display software version & license
> >    -V --version        display software version & license
> >    -s --small          use less memory (at most 2500k)
> >    -1 .. -9            set block size to 100k .. 900k
> >    --fast              alias for -1
> >    --best              alias for -9
> >
> >    If invoked as `bzip2', default action is to compress.
> >               as `bunzip2',  default action is to decompress.
> >               as `bzcat', default action is to decompress to stdout.
> >
> >    If no file names are given, bzip2 compresses or decompresses
> >    from standard input to standard output.  You can combine
> >    short flags, so `-v -4' means the same as -v4 or -4v, &c.
> >
> >+ find /var/tmp/perl-Convert-BinHex-root/usr -type f -print
> >+ sed 's@^/var/tmp/perl-Convert-BinHex-root@@g'
> >+ grep -v perllocal.pod
> >+ grep -v '\.packlist'
> >++ cat Convert-BinHex-1.119-filelist
> >+ '[' '/usr/lib/perl5/site_perl/5.8.3/Convert/BinHex.pm
> >/usr/share/man/man3/Convert::BinHex.3pmX' = X ']'
> >+ /usr/lib/rpm/brp-mandrake
> >Cleaning files...done
> >Compressing files...done
> >Stripping files...done
> >Relativisation of symlinks...done
> >Clean perl...done
> >Building libraries symlinks...done
> >Processing files: perl-Convert-BinHex-1.119-2
> >error: File not found:
> >/var/tmp/perl-Convert-BinHex-root/usr/share/man/man3/Convert::BinHex.3pm
> >
> >
> >RPM build errors:
> >     File not found:
> >/var/tmp/perl-Convert-BinHex-root/usr/share/man/man3/Convert::BinHex.3pm
> >
> >and variations on the theme.  I have no knowledge of how a src rpm is
> >built, but understand that it's some difference with the way Mandrake is
> >set up that needs to be reflected in the spec files.  ODes that make
> >sense?
> >
> >I would be happy to provide ssh access to a Mandrake server for testing
> >purposes if that helps.
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From G.Pentland at SOTON.AC.UK  Mon Oct 11 12:56:46 2004
From: G.Pentland at SOTON.AC.UK (Pentland G.)
Date: Thu Jan 12 21:27:13 2006
Subject: help
Message-ID: <mailman.3345.1137101233.24926.mailscanner@lists.mailscanner.info>

Hi,

take a look at
http://www.sng.ecs.soton.ac.uk/mailscanner/install/perl.shtml

That's the list of perl modules you'll need.

http://www.sng.ecs.soton.ac.uk/mailscanner/install/gcc.shtml

is a tips page for solaris but the info should apply to Linux.

Hope that helps,


Jagadish Murthy wrote:
> Hello Mailscan users,
> 
> i am a newbie  trying to get recent version
> 4.30.3-1 version of mailscanner on RedHat
> enterprise linux 3.0. (sendmail)
> 
> i have tried both rpm version  and tar.gz
> version.
> 
> both fail in some dependency  on perl-MIME-tools 5.4 needed.
> 
> can anbody give some tips on the installation if
> they have tried on RHEnterprise Server 3.0 and any
> thing else to be installed ?
> 
> also can somebody guide me to better documentation
> than is available thru the distro / website ?
> 
> i cant buy the book - too expensive to import and not
> available in our local stores ( Bangalore, INDIA )
> 
> TIA
> 
> jagadish
> 
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
> mailscanner' in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).    

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Mail-Lists at KARAN.ORG  Mon Oct 11 14:13:10 2004
From: Mail-Lists at KARAN.ORG (Karanbir Singh)
Date: Thu Jan 12 21:27:13 2006
Subject: Postfix release from Quarantine
Message-ID: <mailman.3346.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Stephen Swaney wrote:
>>
>> [root B710F4D00F4]# chmod +x B710F4D00F4
>> [root B710F4D00F4]# cp -p B710F4D00F4 /var/spool/postfix/incoming/B/
>>
> Joshua,
>
> I'm happy to report that this appeared to work perfectly for the single
> instance version of postfix. The logs show message was delivered and removed
>

FWIW,

While running Cyrus imapd, you might need to disable dupechecking by
lmtp to get the emails through. Otherwise they will just die a quiet
death at the hands of deliver.

- KB

--
Karanbir Singh   : http://www.karan.org/
GnuPG Public Key : http://www.karan.org/publickey.asc

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hywel.burris at COMTEC-EUROPE.CO.UK  Mon Oct 11 14:55:57 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:13 2006
Subject: Error after upgrading to 4.35.1-2
Message-ID: <mailman.3347.1137101233.24926.mailscanner@lists.mailscanner.info>

Hi I have just upgraded to the latest beta 4.35.1-2 mailscanner is
crashing with the following error:-
 
Undefined subroutine &MailScanner::Conf::Value called at
/usr/lib/MailScanner/MailScanner/SA.pm line 331, <GEN55> line 33. 

I didn't see any errors during the install.
 
Version information is as follows:-

[root@mail MailScanner]# MailScanner -v
Running on
Linux mail.burris.org.uk 2.6.8-1.521 #1 Mon Aug 16 09:01:18 EDT 2004
i686 athlon i386 GNU/Linux
This is Fedora Core release 2 (Tettnang)
This is Perl version 5.008003 (5.8.3)

This is MailScanner version 4.35.1
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.35    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.122   IO::Pipe
2.12    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.07    POSIX
1.76    Socket
0.04    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
missing Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
0.31    Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.40    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.31    URI
 
=================================== 
 
Hywel Burris


************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 11 15:33:22 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: help
Message-ID: <mailman.3348.1137101233.24926.mailscanner@lists.mailscanner.info>

> also can somebody guide me to better documentation than is
> available thru the distro / website ?
>
> i cant buy the book - too expensive to import and not
> available in our local stores ( Bangalore, INDIA )

http://www.fsl.com/support/MailScanner-Manual-Version-1.0.1.pdf


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hywel.burris at COMTEC-EUROPE.CO.UK  Mon Oct 11 16:25:38 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:13 2006
Subject: Error after upgrading to 4.35.1-2
Message-ID: <mailman.3349.1137101233.24926.mailscanner@lists.mailscanner.info>

 

> -----Original Message-----
> From: Hywel Burris 
> Sent: 11 October 2004 14:56
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Error after upgrading to 4.35.1-2
> 
> Hi I have just upgraded to the latest beta 4.35.1-2 
> mailscanner is crashing with the following error:-
>  
> Undefined subroutine &MailScanner::Conf::Value called at 
> /usr/lib/MailScanner/MailScanner/SA.pm line 331, <GEN55> line 33. 
> 
> I didn't see any errors during the install.
>  
> Version information is as follows:-
> 


Looks like there is a typo on line 331 I changed

my $fromheader = MailScanner::Conf::Value('envfromheader', $message);

To 

my $fromheader = MailScanner::Config::Value('envfromheader', $message);

And all jumped into life, has anyone else seen this weird that it only
seems to be me?

Hywel

************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From prandal at HEREFORDSHIRE.GOV.UK  Mon Oct 11 16:46:21 2004
From: prandal at HEREFORDSHIRE.GOV.UK (Randal, Phil)
Date: Thu Jan 12 21:27:13 2006
Subject: Error after upgrading to 4.35.1-2
Message-ID: <mailman.3350.1137101233.24926.mailscanner@lists.mailscanner.info>

That might explain why 4.35.1-2 didn't work for me.  I didn't have the
time to investigate.

Cheers,

Phil

----
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Hywel Burris
> Sent: 11 October 2004 16:26
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Error after upgrading to 4.35.1-2
>
>
>
> > -----Original Message-----
> > From: Hywel Burris
> > Sent: 11 October 2004 14:56
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Error after upgrading to 4.35.1-2
> >
> > Hi I have just upgraded to the latest beta 4.35.1-2 mailscanner is
> > crashing with the following error:-
> >
> > Undefined subroutine &MailScanner::Conf::Value called at
> > /usr/lib/MailScanner/MailScanner/SA.pm line 331, <GEN55> line 33.
> >
> > I didn't see any errors during the install.
> >
> > Version information is as follows:-
> >
>
>
> Looks like there is a typo on line 331 I changed
>
> my $fromheader = MailScanner::Conf::Value('envfromheader', $message);
>
> To
>
> my $fromheader = MailScanner::Config::Value('envfromheader',
> $message);
>
> And all jumped into life, has anyone else seen this weird
> that it only seems to be me?
>
> Hywel
>
> **************************************************************
> **********
> This e-mail and any attachments are strictly confidential and
> intended solely for the addressee. They may contain
> information which is covered by legal, professional or other
> privilege. If you are not the intended addressee, you must
> not copy the e-mail or the attachments, or use them for any
> purpose or disclose their contents to any other person. To do
> so may be unlawful. If you have received this transmission in
> error, please notify us as soon as possible and delete the
> message and attachments from all places in your computer
> where they are stored.
>
> Although we have scanned this e-mail and any attachments for
> viruses, it is your responsibility to ensure that they are
> actually virus free.
>
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From alexn at teleserv.ru  Mon Oct 11 16:58:04 2004
From: alexn at teleserv.ru ([Windows-1251] Íîâîæåíèí Àëåêñàíäð Àíäðååâè÷)
Date: Thu Jan 12 21:27:13 2006
Subject: In Start didn't find a C record when I wanted one
Message-ID: <mailman.3351.1137101233.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "Windows-1251" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Çäðàâñòâóéòå, MAILSCANNER.

The question to source writers. What`s meen SUBJ in MailScanner.
When somebody send me some spam, the daemon of MailScanner is suspend.
But sometimes it go on work.

---cut here---
[root@mail log]# MailScanner -V
Running on
Linux mail.domain.ru 2.4.22-1.2154.nptl.aspsmp #1 SMP Wed Jan 14 19:48:31 MSK 2004 i686 i686 i386 GNU/Linux
This is Fedora Core release 1 (Yarrow)
This is Perl version 5.008005 (5.8.5)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.03    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.73    File::Basename
2.08    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.03    MIME::Base64
5.414   MIME::Decoder
5.414   MIME::Decoder::UU
5.414   MIME::Head
5.414   MIME::Parser
3.03    MIME::QuotedPrint
5.414   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.809   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.42    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.33    URI
---cut here---



-- 
Íîâîæåíèí Àëåêñàíäð Àíäðååâè÷
Ðóêîâîäèòåëü ñåêòîðà òåõíè÷åñêîãî îáñëóæèâàíè^?
Îòäåë òåõíè÷åñêîé ïîääåðæêè.
Äåïàðòàìåíò ñåòåâûõ òåõíîëîãèé.
--
internet: http://support.teleserv.ru
mailto: alexn@teleserv.ru
UIN: 829126
--

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
    [ Part 1.2, Application/OCTET-STREAM (Name: "MailScanner.conf")  ]
    [ 102KB. ]
    [ Unable to print this part. ]


    [ Part 2, Application/PGP-SIGNATURE  194bytes. ]
    [ Unable to print this part. ]


From kte at NEXIS.BE  Mon Oct 11 17:15:14 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:13 2006
Subject: Error clamav on RH
Message-ID: <mailman.3352.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
ClamAV updater /usr/local/bin/freshclam cannot be run
Is this normal? I istalled clamav with an rpm but he istalled it in
/usr/bin.freshclam.

thanks Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hywel.burris at COMTEC-EUROPE.CO.UK  Mon Oct 11 17:36:41 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:13 2006
Subject: Error after upgrading to 4.35.1-2
Message-ID: <mailman.3353.1137101233.24926.mailscanner@lists.mailscanner.info>

 

> -----Original Message-----
> From: Hywel Burris 
> Sent: 11 October 2004 16:26
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Error after upgrading to 4.35.1-2
> 
>  
> 
> > -----Original Message-----
> > From: Hywel Burris
> > Sent: 11 October 2004 14:56
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Error after upgrading to 4.35.1-2
> > 
> > Hi I have just upgraded to the latest beta 4.35.1-2 mailscanner is 
> > crashing with the following error:-
> >  
> > Undefined subroutine &MailScanner::Conf::Value called at 
> > /usr/lib/MailScanner/MailScanner/SA.pm line 331, <GEN55> line 33.
> > 
> > I didn't see any errors during the install.
> >  
> > Version information is as follows:-
> > 
> 
> 
> Looks like there is a typo on line 331 I changed
> 
> my $fromheader = MailScanner::Conf::Value('envfromheader', $message);
> 
> To 
> 
> my $fromheader = MailScanner::Config::Value('envfromheader', 
> $message);
> 
> And all jumped into life, has anyone else seen this weird 
> that it only seems to be me?
> 
> Hywel

Mail is now being delivered but vireses seem to be caught in a loop
holding up the other mails, once they are manually deleted mail gets
delivered again.

************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 17:56:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: New MailScanner Beta: Mandrake support
Message-ID: <mailman.3354.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have added Mandrake Linux support to the RedHat RPM distribution.

The main problems were some automatic clearing up that Mandrake do
differently from everyone else, and a bug in one of the scripts provided by
Mandrake involved in building RPMs. They specify a command-line to bzip2
that contains an illegal option.

I have also fixed the typo in SA.pm. Sorry about that.

You can download as usual from www.mailscanner.info.

The full Changelog is:

11/11/2004 New in Version 4.35.2
===============================
* New Features and Improvements *
- SpamAssassin 3 SPF checks are now fully supported.
- Added Disposition-Notification-To and Return-Receipt-To to the list of
   headers I advise you to remove.
- Added "Log Silent Viruses" configuration option.
- Mandrake Linux 10 is now supported by the RPM installation script.

* Fixes *
- Fixed bug where filetype checks that matched no rules were not logged
   properly.
- Fixed problems with MIME::Base64 dependencies.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 17:57:20 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Error clamav on RH
Message-ID: <mailman.3355.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:15 11/10/2004, you wrote:
>ClamAV updater /usr/local/bin/freshclam cannot be run
>Is this normal? I istalled clamav with an rpm but he istalled it in
>/usr/bin.freshclam.

Check that /etc/MailScanner/virus.scanners.conf points to your installation
of ClamAV.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From MyBSD at comcast.net  Mon Oct 11 17:11:51 2004
From: MyBSD at comcast.net (My BSD)
Date: Thu Jan 12 21:27:13 2006
Subject: QuarantineReport
Message-ID: <mailman.3356.1137101233.24926.mailscanner@lists.mailscanner.info>

On Mon, October 11, 2004 10:23 am, Steve Swaney said:
>> >> ...
>> >>
>> > ...
>> >
>>
>> With all due respect to the authors (unless I am missing something very
>> basic), these scripts, although they work as advertised (after some
>> tweaking) and very "cool", can also be very dangerous if improperly
>> used.
>>
>> There does not seem to be a way to "lock" quarantine messages that are
>> both spam and virus infected.  An unwitting user could release an
>> infected
>> message from the quarantine to him/herself with possibly resulting dire
>>
>> So unless consequences.
>> this "feature" can be disabled (or a warning message included in
>> the distribution) they should not be incorporated into SA.
>>
>
> Sorry for the late reply but I've been on vacation and am just now wading
> through the emails that piled up.
>
> When I get around to expanding the INSTALL documentation I do need to add
> a
> Security Notes section. There are several security issues with the scripts
> but the point raised above is not one of them if you've installed
> MailScanner to:
>
> 1) Use rule sets that skip "Spam Checks =", "Use SpamAssassin = " and File
> name and File type checks for messages which originate from the local host
> while
>
> 2) Virus checking ALL emails whether they originate on the local host or
> not.
>
> All releasing a message from quarantine does is to resend the message from
> the localhost. The message is again checked by MailScanner. If you don't
> skip the checks described in 1), the message will be quarantined again :(
> -
> for the same reason it was quarantined in the first place.
>
> If the message does contain a virus it WILL be quarantined again because
> it
> will again be run through the virus scanner. If your setup is correct, you
> should not be able to release a virus.
>
> Having said that, the scripts in their current state provide little
> security
> for viewing or releasing messages in quarantine.  If someone can guess the
> message ID of an email in quarantine it would be possible for them to
> release it - only to the original recipient or to view it using the web
> interface. There is also a major omission in the INSTALL documantation.
> The
> typical default httpd options for the spam directory directory should be
> changed to NOT show the Indexes of the spam directory:
>
> Putting a file spam.direcroty.conf in /etc/httpd/conf.d that contains:
>
>       # Don't show the content's of the spam viewing directory
>
>               <Directory "/var/www/html/spam">
>                Options FollowSymLinks
>               AllowOverride None
>               Order allow,deny
>               Allow from all
>
>       </Directory>
>
> Will require that the viewing link explicitly contain the message ID of
> the
> spam email to view.
>
> In the environment that the scripts were designed to be use in, this was
> not
> considered to be a major flaw.
>
> Hope this helps,
>
> Steve
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>

*********** REPLY SEPARATOR  ***********

Steve:

Thank you for your erudite reply to my comments.

As I understand it, your recommended set up is to scan all locally
generated mail for viruses only.

We run two instances of Postfix, one for inbound mail with MS scanning for
viruses and Spam with SA, and one for outbound and sendmail mail (which is
not scanned).

Because our small internal network is composed of only trusted users, we
do not feel compelled to scan outbound mail.  To do so would require a
policy decision which would have to take into account current resources,
trust philosophy, etc.

It appears then that we will not be able to use QR safely (to prevent
releasing Spam mail which is also virus infected) unless we start scanning
(at least) sendmail mail for viruses.

One last thing (I'll have to check the documentation), I believe that
there may be a MS setting to quarantine mail if it is found to be virus
infected without doing a subsequent Spam check.  This may work in our set
up because, as I understand it, the virus quarantine is separate from the
Spam quarantine.

Would this work if there is such a setting?

Thank you again!

--
My

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hywel.burris at COMTEC-EUROPE.CO.UK  Mon Oct 11 19:27:51 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:13 2006
Subject: Problem with viruses with beta 4.35.2-1
Message-ID: <mailman.3357.1137101233.24926.mailscanner@lists.mailscanner.info>

Since upgrading to the last 2 versions when a virus gets caught I am
seeing them looping which is stopping new mails from being processed.
The error I am seeing in debug is:-

format error: can't find EOCD signature
 at /usr/sbin/MailScanner line 558
Undefined subroutine &MIME::QuotedPrint::encode_qp called at
/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 74.

Any idea's?

Thanks

Hywel

************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 21:05:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Problem with viruses with beta 4.35.2-1
Message-ID: <mailman.3358.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 19:27 11/10/2004, you wrote:
>Since upgrading to the last 2 versions when a virus gets caught I am
>seeing them looping which is stopping new mails from being processed.
>The error I am seeing in debug is:-
>
>format error: can't find EOCD signature
>  at /usr/sbin/MailScanner line 558
>Undefined subroutine &MIME::QuotedPrint::encode_qp called at
>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 74.

Can you try this for me please?

Edit /usr/sbin/MailScanner. At line 52 you should find
         require MIME::Base64;
Please add a line immediately beneath that that says
         require MIME::QuotedPrint;

Then kill and re-run MailScanner.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 21:20:48 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Problem with viruses with beta 4.35.2-1
Message-ID: <mailman.3359.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have just managed to re-create your problem (involved uninstalling perl
and forcing up2date to do nasty things :-)
Good news: This change solved the problem for me.

At 21:05 11/10/2004, you wrote:
>At 19:27 11/10/2004, you wrote:
>>Since upgrading to the last 2 versions when a virus gets caught I am
>>seeing them looping which is stopping new mails from being processed.
>>The error I am seeing in debug is:-
>>
>>format error: can't find EOCD signature
>>  at /usr/sbin/MailScanner line 558
>>Undefined subroutine &MIME::QuotedPrint::encode_qp called at
>>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 74.
>
>Can you try this for me please?
>
>Edit /usr/sbin/MailScanner. At line 52 you should find
>         require MIME::Base64;
>Please add a line immediately beneath that that says
>         require MIME::QuotedPrint;
>
>Then kill and re-run MailScanner.
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hb.maillists at DFS.DK  Mon Oct 11 21:34:08 2004
From: hb.maillists at DFS.DK (Henrik Bro)
Date: Thu Jan 12 21:27:13 2006
Subject: SV: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3360.1137101233.24926.mailscanner@lists.mailscanner.info>

I have tried upgrading to 4.35-2 but Red Hat still says:


# up2date -u

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7
i386


Testing package set / solving RPM inter-dependencies...
########################################
RPM package conflict error.  The message was:
Test install failed because of package conflicts:
package perl-5.8.0-88.7 is already installed
 


# up2date -l

Fetching Obsoletes list for channel: rhel-i386-as-3...

Fetching rpm headers...
########################################

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7
i386

The following Packages are obsoleted by newer packages:

Name-Version-Release        obsoleted by      Name-Version-Release
----------------------------------------------------------------------------
---
perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7



Before upgrading I have uninstalled MIME-Base64!

/henrik



-----Oprindelig meddelelse-----
Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne
af Julian Field
Sendt: 10. oktober 2004 16:35
Til: MAILSCANNER@JISCMAIL.AC.UK
Emne: New MailScanner Beta Release: Re: MIME::Base64 rpm problems

For those of you suffering from the perl module dependency problems,
particularly on RHEL3, I think I have cracked it.

I have just released a new 4.35.1 beta release, which contains a new
MIME::Base64 module in which I have fixed the problem.

Please give it a try and let me know how you get on with it.

Download from www.mailscanner.info as usual.

ChangeLog is:
* New Features and Improvements *
- SpamAssassin 3 SPF checks are now fully supported.
- Added Disposition-Notification-To and Return-Receipt-To to the list of
   headers I advise you to remove.
- Added "Log Silent Viruses" configuration option.

* Fixes *
- Fixed bug where filetype checks that matched no rules were not logged
   properly.
- Fixed problems with MIME::Base64 dependencies.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 22:13:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: SV: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3361.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What happens when you
rpm -e --nodeps perl-MIME-Base64
and then re-run the install.sh script?
Does this result in the same problem?

At 21:34 11/10/2004, you wrote:
>I have tried upgrading to 4.35-2 but Red Hat still says:
>
>
># up2date -u
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7
>i386
>
>
>Testing package set / solving RPM inter-dependencies...
>########################################
>RPM package conflict error.  The message was:
>Test install failed because of package conflicts:
>package perl-5.8.0-88.7 is already installed
>
>
>
># up2date -l
>
>Fetching Obsoletes list for channel: rhel-i386-as-3...
>
>Fetching rpm headers...
>########################################
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7
>i386
>
>The following Packages are obsoleted by newer packages:
>
>Name-Version-Release        obsoleted by      Name-Version-Release
>----------------------------------------------------------------------------
>---
>perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
>
>
>
>Before upgrading I have uninstalled MIME-Base64!
>
>/henrik
>
>
>
>-----Oprindelig meddelelse-----
>Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne
>af Julian Field
>Sendt: 10. oktober 2004 16:35
>Til: MAILSCANNER@JISCMAIL.AC.UK
>Emne: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
>
>For those of you suffering from the perl module dependency problems,
>particularly on RHEL3, I think I have cracked it.
>
>I have just released a new 4.35.1 beta release, which contains a new
>MIME::Base64 module in which I have fixed the problem.
>
>Please give it a try and let me know how you get on with it.
>
>Download from www.mailscanner.info as usual.
>
>ChangeLog is:
>* New Features and Improvements *
>- SpamAssassin 3 SPF checks are now fully supported.
>- Added Disposition-Notification-To and Return-Receipt-To to the list of
>    headers I advise you to remove.
>- Added "Log Silent Viruses" configuration option.
>
>* Fixes *
>- Fixed bug where filetype checks that matched no rules were not logged
>    properly.
>- Fixed problems with MIME::Base64 dependencies.
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support Buy the MailScanner book at
>www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From hywel.burris at comtec-europe.co.uk  Mon Oct 11 22:11:23 2004
From: hywel.burris at comtec-europe.co.uk (Hywel Burris)
Date: Thu Jan 12 21:27:13 2006
Subject: Problem with viruses with beta 4.35.2-1
Message-ID: <mailman.3362.1137101233.24926.mailscanner@lists.mailscanner.info>

 

> -----Original Message-----
> From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> Sent: 11 October 2004 21:21
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problem with viruses with beta 4.35.2-1
> 
> I have just managed to re-create your problem (involved 
> uninstalling perl and forcing up2date to do nasty things :-) 
> Good news: This change solved the problem for me.
> 
> At 21:05 11/10/2004, you wrote:
> >At 19:27 11/10/2004, you wrote:
> >>Since upgrading to the last 2 versions when a virus gets 
> caught I am 
> >>seeing them looping which is stopping new mails from being 
> processed.
> >>The error I am seeing in debug is:-
> >>
> >>format error: can't find EOCD signature
> >>  at /usr/sbin/MailScanner line 558
> >>Undefined subroutine &MIME::QuotedPrint::encode_qp called at 
> >>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 74.
> >
> >Can you try this for me please?
> >
> >Edit /usr/sbin/MailScanner. At line 52 you should find
> >         require MIME::Base64;
> >Please add a line immediately beneath that that says
> >         require MIME::QuotedPrint;
> >
> >Then kill and re-run MailScanner.
> >--

Hi Julian,

Thanks for the Reply, I am now getting the following errors in
/var/log/maillog:-

Oct 11 22:06:06 mail MailScanner[21134]: Cannot parse
/var/spool/MailScanner/incoming/21134/i9BKeBCv014736.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179

Regards

Hywel


************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 22:17:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: SV: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3363.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
The RPM database has got confused because of the earlier MIME-Base64 problems.
You can do exactly what I did here:
         rpm -e --nodeps perl
         up2date -u perl
and if that fails then
         up2date -u --force perl
to put it back in.
Then your Perl installation should be cleaner and you can rerun install.sh.

At 21:34 11/10/2004, you wrote:
>I have tried upgrading to 4.35-2 but Red Hat still says:
>
>
># up2date -u
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7
>i386
>
>
>Testing package set / solving RPM inter-dependencies...
>########################################
>RPM package conflict error.  The message was:
>Test install failed because of package conflicts:
>package perl-5.8.0-88.7 is already installed
>
>
>
># up2date -l
>
>Fetching Obsoletes list for channel: rhel-i386-as-3...
>
>Fetching rpm headers...
>########################################
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7
>i386
>
>The following Packages are obsoleted by newer packages:
>
>Name-Version-Release        obsoleted by      Name-Version-Release
>----------------------------------------------------------------------------
>---
>perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
>
>
>
>Before upgrading I have uninstalled MIME-Base64!
>
>/henrik
>
>
>
>-----Oprindelig meddelelse-----
>Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne
>af Julian Field
>Sendt: 10. oktober 2004 16:35
>Til: MAILSCANNER@JISCMAIL.AC.UK
>Emne: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
>
>For those of you suffering from the perl module dependency problems,
>particularly on RHEL3, I think I have cracked it.
>
>I have just released a new 4.35.1 beta release, which contains a new
>MIME::Base64 module in which I have fixed the problem.
>
>Please give it a try and let me know how you get on with it.
>
>Download from www.mailscanner.info as usual.
>
>ChangeLog is:
>* New Features and Improvements *
>- SpamAssassin 3 SPF checks are now fully supported.
>- Added Disposition-Notification-To and Return-Receipt-To to the list of
>    headers I advise you to remove.
>- Added "Log Silent Viruses" configuration option.
>
>* Fixes *
>- Fixed bug where filetype checks that matched no rules were not logged
>    properly.
>- Fixed problems with MIME::Base64 dependencies.
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support Buy the MailScanner book at
>www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 22:19:59 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Problem with viruses with beta 4.35.2-1
Message-ID: <mailman.3364.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 22:11 11/10/2004, you wrote:
> > -----Original Message-----
> > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
> > Sent: 11 October 2004 21:21
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Problem with viruses with beta 4.35.2-1
> >
> > I have just managed to re-create your problem (involved
> > uninstalling perl and forcing up2date to do nasty things :-)
> > Good news: This change solved the problem for me.
> >
> > At 21:05 11/10/2004, you wrote:
> > >At 19:27 11/10/2004, you wrote:
> > >>Since upgrading to the last 2 versions when a virus gets
> > caught I am
> > >>seeing them looping which is stopping new mails from being
> > processed.
> > >>The error I am seeing in debug is:-
> > >>
> > >>format error: can't find EOCD signature
> > >>  at /usr/sbin/MailScanner line 558
> > >>Undefined subroutine &MIME::QuotedPrint::encode_qp called at
> > >>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 74.
> > >
> > >Can you try this for me please?
> > >
> > >Edit /usr/sbin/MailScanner. At line 52 you should find
> > >         require MIME::Base64;
> > >Please add a line immediately beneath that that says
> > >         require MIME::QuotedPrint;
> > >
> > >Then kill and re-run MailScanner.
> > >--
>
>Hi Julian,
>
>Thanks for the Reply, I am now getting the following errors in
>/var/log/maillog:-
>
>Oct 11 22:06:06 mail MailScanner[21134]: Cannot parse
>/var/spool/MailScanner/incoming/21134/i9BKeBCv014736.header and , Can't
>locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179

Access would be handy, after all.
I think it's just an issue created by screwed up Perl installations.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hb.maillists at DFS.DK  Mon Oct 11 22:39:26 2004
From: hb.maillists at DFS.DK (Henrik Bro)
Date: Thu Jan 12 21:27:13 2006
Subject: SV: SV: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
Message-ID: <mailman.3365.1137101233.24926.mailscanner@lists.mailscanner.info>

SUPER!

Thanks for the help!

Now I will start reading my new "MailScanner: A User Guide & Training
Manual" :)

/henrik 

-----Oprindelig meddelelse-----
Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På vegne
af Julian Field
Sendt: 11. oktober 2004 23:17
Til: MAILSCANNER@JISCMAIL.AC.UK
Emne: Re: SV: New MailScanner Beta Release: Re: MIME::Base64 rpm problems

The RPM database has got confused because of the earlier MIME-Base64
problems.
You can do exactly what I did here:
         rpm -e --nodeps perl
         up2date -u perl
and if that fails then
         up2date -u --force perl
to put it back in.
Then your Perl installation should be cleaner and you can rerun install.sh.

At 21:34 11/10/2004, you wrote:
>I have tried upgrading to 4.35-2 but Red Hat still says:
>
>
># up2date -u
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7
>i386
>
>
>Testing package set / solving RPM inter-dependencies...
>########################################
>RPM package conflict error.  The message was:
>Test install failed because of package conflicts:
>package perl-5.8.0-88.7 is already installed
>
>
>
># up2date -l
>
>Fetching Obsoletes list for channel: rhel-i386-as-3...
>
>Fetching rpm headers...
>########################################
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7
>i386
>
>The following Packages are obsoleted by newer packages:
>
>Name-Version-Release        obsoleted by      Name-Version-Release
>-----------------------------------------------------------------------
>-----
>---
>perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
>
>
>
>Before upgrading I have uninstalled MIME-Base64!
>
>/henrik
>
>
>
>-----Oprindelig meddelelse-----
>Fra: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] På 
>vegne af Julian Field
>Sendt: 10. oktober 2004 16:35
>Til: MAILSCANNER@JISCMAIL.AC.UK
>Emne: New MailScanner Beta Release: Re: MIME::Base64 rpm problems
>
>For those of you suffering from the perl module dependency problems, 
>particularly on RHEL3, I think I have cracked it.
>
>I have just released a new 4.35.1 beta release, which contains a new
>MIME::Base64 module in which I have fixed the problem.
>
>Please give it a try and let me know how you get on with it.
>
>Download from www.mailscanner.info as usual.
>
>ChangeLog is:
>* New Features and Improvements *
>- SpamAssassin 3 SPF checks are now fully supported.
>- Added Disposition-Notification-To and Return-Receipt-To to the list of
>    headers I advise you to remove.
>- Added "Log Silent Viruses" configuration option.
>
>* Fixes *
>- Fixed bug where filetype checks that matched no rules were not logged
>    properly.
>- Fixed problems with MIME::Base64 dependencies.
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks 
>transtec Computers for their support Buy the MailScanner book at 
>www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To 
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the 
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------ To 
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the 
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From xterm1 at TATORZ.COM  Mon Oct 11 23:06:20 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:13 2006
Subject: Question?
Message-ID: <mailman.3366.1137101233.24926.mailscanner@lists.mailscanner.info>

                Does MailScanner reread the various sendmail files ie:

/etc/mail/access

and so on, when you issue restart/reload ?

no luck searching for my answer!

Brian


RedHat 9
MailScanner 4.34.8-4
spamasaassin 2.44-11.8.x
clamav 75.1

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 11 23:09:46 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: Question?
Message-ID: <mailman.3367.1137101233.24926.mailscanner@lists.mailscanner.info>

On Mon, 2004-10-11 at 18:06 -0400, xterm1 wrote:
>                 Does MailScanner reread the various sendmail files ie:
>
> /etc/mail/access
>
> and so on, when you issue restart/reload ?

If you issue restart and are calling sendmail via MailScanner (normal
configuration) then yes
To prove this put something incorrect in there and try a restart

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 11 23:11:22 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: YAB: was Re: Problem with viruses with beta 4.35.2-1
Message-ID: <mailman.3368.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
YAB = Yet Another Beta.

The last problem would only have shown up on some of the systems that have
had multiple versions of Perl installed on them. Some elements in the @INC
path were getting in the wrong order. A 1-word fix :-)

So 4.35.3-1 is out there at www.mailscanner.info.

Thanks for all your patience while we get these problems ironed out.

P.S. Next feature to hit the streets will be a phishing attack detector. It
finds links claiming to be from your bank which are actually from somewhere
else, and highlights them with a warning. Appears to work quite nicely so far.

At 22:19 11/10/2004, you wrote:
>At 22:11 11/10/2004, you wrote:
>> > -----Original Message-----
>> > From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
>> > Sent: 11 October 2004 21:21
>> > To: MAILSCANNER@JISCMAIL.AC.UK
>> > Subject: Re: Problem with viruses with beta 4.35.2-1
>> >
>> > I have just managed to re-create your problem (involved
>> > uninstalling perl and forcing up2date to do nasty things :-)
>> > Good news: This change solved the problem for me.
>> >
>> > At 21:05 11/10/2004, you wrote:
>> > >At 19:27 11/10/2004, you wrote:
>> > >>Since upgrading to the last 2 versions when a virus gets
>> > caught I am
>> > >>seeing them looping which is stopping new mails from being
>> > processed.
>> > >>The error I am seeing in debug is:-
>> > >>
>> > >>format error: can't find EOCD signature
>> > >>  at /usr/sbin/MailScanner line 558
>> > >>Undefined subroutine &MIME::QuotedPrint::encode_qp called at
>> > >>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder/QuotedPrint.pm line 74.
>> > >
>> > >Can you try this for me please?
>> > >
>> > >Edit /usr/sbin/MailScanner. At line 52 you should find
>> > >         require MIME::Base64;
>> > >Please add a line immediately beneath that that says
>> > >         require MIME::QuotedPrint;
>> > >
>> > >Then kill and re-run MailScanner.
>> > >--
>>
>>Hi Julian,
>>
>>Thanks for the Reply, I am now getting the following errors in
>>/var/log/maillog:-
>>
>>Oct 11 22:06:06 mail MailScanner[21134]: Cannot parse
>>/var/spool/MailScanner/incoming/21134/i9BKeBCv014736.header and , Can't
>>locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>>/usr/lib/perl5/site_perl/5.8.3/MIME/Decoder.pm line 179
>
>Access would be handy, after all.
>I think it's just an issue created by screwed up Perl installations.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Mon Oct 11 23:25:19 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:13 2006
Subject: Question?
Message-ID: <mailman.3369.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
xterm1 wrote:
>                 Does MailScanner reread the various sendmail files ie:
>
> /etc/mail/access
>
> and so on, when you issue restart/reload ?

MS doesn't since it doesn't directly interact with Sendmail, it just
uses the queues. You have to restart Sendmail but the Linux start script
can take care of that.

Your example with the access file doesn't need a restart though, just
make it to access.db and it will be used right away like the other db files.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From clicknow at SWIFTDSL.COM.AU  Mon Oct 11 23:50:11 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:13 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3370.1137101233.24926.mailscanner@lists.mailscanner.info>

This could be a purely postfix issue, so apologies if it's a bit OT here.

One of the domains I host requires a catch-all mail account - yes, I
know - spam collector.  I understand that the way this is done is to
put:

@domain mailbox

in /etc/postfix/virtual then postmap virtual

But I find with this defined that some properly defined addresses for
other domains end up having their mail directed to the catch-all.  I
can't work out a pattern, but monitoring shows an incoming message to:

valid-address@valid-domain being scanned by MailScanner, found clean and
directed to the catch-all.  Other addresses in the same domain work
correctly.

By commenting out the catch-all account and running postmap again, these
addresses work correctly without other alteration.

Have I found a bug or a feature I don't understand?

TIA
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 11 23:56:39 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:13 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3371.1137101233.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-10-12 at 08:50 +1000, Brian Parish wrote:
> This could be a purely postfix issue, so apologies if it's a bit OT here.
>
> One of the domains I host requires a catch-all mail account - yes, I
> know - spam collector.  I understand that the way this is done is to
> put:
>
> @domain mailbox
>
> in /etc/postfix/virtual then postmap virtual
>
> But I find with this defined that some properly defined addresses for
> other domains end up having their mail directed to the catch-all.  I
> can't work out a pattern, but monitoring shows an incoming message to:
>
> valid-address@valid-domain being scanned by MailScanner, found clean and
> directed to the catch-all.  Other addresses in the same domain work
> correctly.
>
> By commenting out the catch-all account and running postmap again, these
> addresses work correctly without other alteration.
>
> Have I found a bug or a feature I don't understand?
>
> TIA
> Brian
It sounds like you are doing something wrong :)
I run postfix on a uml for a limited number of domains and one of them
has a catchall.
In main.cf:
virtual_alias_domains = domain1 domain2
In virtual
foo@domain1 user1
foo2@domain1 user2
@domain2 catchalluser

Works fine :)


--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Tue Oct 12 00:11:52 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:13 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3372.1137101233.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-10-12 at 08:56, Michele Neylon : Blacknight Solutions
wrote:
> On Tue, 2004-10-12 at 08:50 +1000, Brian Parish wrote:
> > This could be a purely postfix issue, so apologies if it's a bit OT here.
> >
> > One of the domains I host requires a catch-all mail account - yes, I
> > know - spam collector.  I understand that the way this is done is to
> > put:
> >
> > @domain mailbox
> >
> > in /etc/postfix/virtual then postmap virtual
> >
> > But I find with this defined that some properly defined addresses for
> > other domains end up having their mail directed to the catch-all.  I
> > can't work out a pattern, but monitoring shows an incoming message to:
> >
> > valid-address@valid-domain being scanned by MailScanner, found clean and
> > directed to the catch-all.  Other addresses in the same domain work
> > correctly.
> >
> > By commenting out the catch-all account and running postmap again, these
> > addresses work correctly without other alteration.
> >
> > Have I found a bug or a feature I don't understand?
> >
> > TIA
> > Brian
> It sounds like you are doing something wrong :)
> I run postfix on a uml for a limited number of domains and one of them
> has a catchall.
> In main.cf:
> virtual_alias_domains = domain1 domain2
> In virtual
> foo@domain1 user1
> foo2@domain1 user2
> @domain2 catchalluser
>
> Works fine :)
>
Yes Michele,

I think you are right, except that my setup is exactly as you describe
and *most* e-mail is correctly handled.  There seems to be nothing to
differentiate an account that works and one that gets bypassed.

I'll have to set up a test bed for this and play a bit more.  Thanks for
at least verifying that I am not totally off the track here.

cheers
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Kevin_Miller at CI.JUNEAU.AK.US  Tue Oct 12 00:02:28 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:13 2006
Subject: Disappearing mail
Message-ID: <mailman.3373.1137101233.24926.mailscanner@lists.mailscanner.info>

I've had a few mails that have semi-disappeared lately.  Apparently the
headers remain intact, but the body vanishes.  My users end up with a
message that says:
>> From: Pete Davis [mailto:petedavis@XXX.com]
>> Sent: Monday, October 11, 2004 10:51 AM
>> To: jstimson@xxxxxxx.com
>> Cc: Ken Engquist (E-mail); Rich Etheridge
>> Subject: RE: Fireproofing material approval from Fire Marshal
>>
>> <<< No Message Collected >>>

I'm running SuSE 8.0 on my primary email gateway, sendmail and MailScanner
4-32-4.  (I've got a couple other SuSE boxes that have a different mix and
they do the same thing).

Here's what my logs show.

Oct 11 10:51:35 mis-mxg-lnx sendmail-in[26515]: i9BIpY6m026515:
from=<petedavis@XXX.com>, size=3390, class=0, nrcpts=1,
msgid=<000201c4afc3$3e4c0730$0300a8c0@HOMER>, proto=SMTP, daemon=MTA,
relay=hermod.acsalaska.net [209.112.155.45]
Oct 11 10:51:35 mis-mxg-lnx sendmail-in[26515]: i9BIpY6m026515:
to=<rich_etheridge@ci.juneau.ak.us>, delay=00:00:00, mailer=esmtp,
pri=30992, stat=queued
Oct 11 10:51:35 mis-mxg-lnx MailScanner[5827]: New Batch: Found 5 messages
waiting
Oct 11 10:51:35 mis-mxg-lnx MailScanner[5827]: New Batch: Scanning 1
messages, 3996 bytes
Oct 11 10:51:37 mis-mxg-lnx MailScanner[5827]: Virus and Content Scanning:
Starting
Oct 11 10:51:37 mis-mxg-lnx MailScanner[5827]: Scan ended at Mon Oct 11
10:51:37 2004
Oct 11 10:51:37 mis-mxg-lnx MailScanner[5827]: 3 files scanned
Oct 11 10:51:38 mis-mxg-lnx MailScanner[5691]: New Batch: Found 5 messages
waiting
Oct 11 10:51:38 mis-mxg-lnx MailScanner[5691]: New Batch: Scanning 1
messages, 3996 bytes
Oct 11 10:51:39 mis-mxg-lnx MailScanner[5827]: Uninfected: Delivered 1
messages
Oct 11 10:51:40 mis-mxg-lnx sendmail[26538]: i9BIpY6m026515:
to=<rich_etheridge@ci.juneau.ak.us>, delay=00:00:05, xdelay=00:00:01,
mailer=esmtp, pri=120992, relay=[199.58.55.120] [199.58.55.120], dsn=2.0.0,
stat=Sent (OK)
Oct 11 10:51:40 mis-mxg-lnx MailScanner[5691]: Virus and Content Scanning:
Starting
Oct 11 10:51:40 mis-mxg-lnx MailScanner[5691]: Scan ended at Mon Oct 11
10:51:40 2004
Oct 11 10:51:40 mis-mxg-lnx MailScanner[5691]: 2 files scanned
Oct 11 10:51:42 mis-mxg-lnx MailScanner[5691]: Uninfected: Delivered 1
messages
Oct 11 10:51:42 mis-mxg-lnx sendmail[26552]: i9BIpY6m026515: SYSERR(root):
readqf: cannot open ./dfi9BIpY6m026515: No such file or directory
Oct 11 10:51:42 mis-mxg-lnx sendmail[26552]: i9BIpY6m026515:
to=<rich_etheridge@ci.juneau.ak.us>, delay=00:00:07, xdelay=00:00:00,
mailer=esmtp, pri=120992, relay=[199.58.55.120] [199.58.55.120], dsn=2.0.0,
stat=Sent (OK)

I searched the archives but didn't find any solutions although there were
other posts describing this problem.  One suggestion was that flock was
dicey - should I change that to 'posix' and see what happens?

TIA...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 08:39:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Disappearing mail
Message-ID: <mailman.3374.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 00:02 12/10/2004, you wrote:
>I've had a few mails that have semi-disappeared lately.  Apparently the
>headers remain intact, but the body vanishes.  My users end up with a
>message that says:

[snip]

>I searched the archives but didn't find any solutions although there were
>other posts describing this problem.  One suggestion was that flock was
>dicey - should I change that to 'posix' and see what happens?

Yes.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From kte at NEXIS.BE  Tue Oct 12 08:46:23 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:13 2006
Subject: DCC -1.2.4 problem
Message-ID: <mailman.3375.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
after the .configure command in a whitebox linux i get this
look for sendmail milter library in
./../sendmail/obj.Linux.2.4.21-20.ELsmp.i686
        *** cannot build dccm without sendmail headers in ./../sendmail
                and libraries in
./../sendmail/obj.Linux.2.4.21-20.ELsmp.i686 ***

Dos sombody now what it means?
thanks Koen

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Oct 12 08:36:38 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:13 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3376.1137101233.24926.mailscanner@lists.mailscanner.info>

Julian

Sorry to have taken so long to get back to you on this but there is a
problem with the MCP.pm.patch. Running MS in debug mode gives:

[root@cheviot4 MailScanner]# service MailScanner start
Starting MailScanner daemons:
         incoming sendmail:                                [  OK  ]
         outgoing sendmail:                                [  OK  ]
         MailScanner:       In Debugging mode, not forking...
SA bayes lock is /root/.spamassassin/bayes.lock
Bayes lock is at /root/.spamassassin/bayes.lock
Undefined subroutine &MailScanner::Conf::Value called at
/usr/lib/MailScanner/MailScanner/MCP.pm line 230, <GEN181> line 33.



Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 08 October 2004 14:03
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
>
>Try the attached patches for SA.pm and MCP.pm.
>
>At 12:21 08/10/2004, you wrote:
>>Yes, using the existing "Envelope From Header" value seems the
>>appropriate thing to do.
>>
>>It also meets my requirement (see earlier posting) for a site 
>to be able
>>to specify a locally unique X-header string to use for the 
>envelope-from
>>address that MS can stuff into the message.
>>
>>Without that uniqueness I think SA will get confused when it tries to
>>decide which of the X-MailScanner-From: lines, all but one added by
>>upstream relays, it should use as the value of the pseudo-header
>>"EnvelopeFrom".
>>
>>The SA options document makes a comment that MTAs should avoid using a
>>single, standard, line containing the envelope-from address.
>>
>>When the amended patch is ready I will test it for you.
>>
>>Thanks
>>
>>Quentin
>>
>> >-----Original Message-----
>> >From: MailScanner mailing list
>> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>> >Sent: 08 October 2004 11:57
>> >To: MAILSCANNER@JISCMAIL.AC.UK
>> >Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
>> >
>> >At 11:52 08/10/2004, you wrote:
>> >>Julian
>> >>
>> >>The "EnvelopeFrom" pseudo-header may be working for you 
>and with SPF.
>> >>
>> >>It is not working here unless SA.pm and MCP.pm are patched as I
>> >>described earlier. :-(
>> >
>> >How about I add the
>> >"Envelope From Header"
>> >as defined in MailScanner.conf? That would save yet another
>> >config option.
>> >
>> >
>> >>I need this feature to work because I want to define rules 
>in MCP that
>> >>will allow me to discard messages to certain local addresses if the
>> >>envelope-from address is not from our two domains, ncl.ac.uk or
>> >>newcastle.ac.uk.
>> >
>> >--
>> >Julian Field
>> >www.MailScanner.info
>> >MailScanner thanks transtec Computers for their support
>> >Buy the MailScanner book at www.MailScanner.info/store
>> >
>> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>> >
>> >------------------------ MailScanner list ------------------------
>> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> >'leave mailscanner' in the body of the email.
>> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>> >
>> >
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 09:27:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3377.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Morning folks,

I have written a Phishing fraud detector. It's not 100% perfect, but it
should detect most of them. We are finding here that the SURBL phishing
lists are far from complete, and we regularly get these coming through to
our end-users.

For those of you who don't know what phishing is....

You get an email claiming to be from your bank / credit card company /
utility company / whatever. It looks like a perfectly genuine email, it has
their artwork, disclaimers, everything. There is some text in the message
inviting you to click on a link in the message. The link looks quite
normal, e.g. http://www.citibank.com/ or just www.citibank.com. They
usually look like they want you to confirm security information, or
re-register your account. But when you click on the link it doesn't take
you to the bank's real website, it takes you to a plausible-sounding one
that looks just like your bank's real website, but isn't. You type in
confidential information of some sort, and the bad guys just managed to
steal your information. Now they can steal your money and/or identity.

MailScanner detects these and inserts some text into the message to
highlight the possible fraud, and where it is coming from in reality.
Please could all you translators out there please translate the following
text into the language(s) of your choice? Please don't contribute
translations you aren't 100% sure about, I have no way of telling whose
translation into Spanish is the best, so probably best to post your
translations to the list so we can agree on the best ones.

# Used in Phishing Fraud attack detections. The "End" must close all the
# HTML highlighting done in the "Start".
PossibleFraudStart = <font color="red"><b>MailScanner has detected a
possible fraud attempt from
PossibleFraudEnd = </b></font>

Thanks all!
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Oct 12 09:29:34 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:13 2006
Subject: FW: Bug in MCP & SA.pm patches to MS 4.34.8-1
Message-ID: <mailman.3378.1137101233.24926.mailscanner@lists.mailscanner.info>

Julian

Sorry to have taken so long to get back to you on this but there is a
problem with both MCP.pm.patch and SA.pm.patch. Running MS (4.34.8-1) in
debug mode gives:

[root@cheviot4 MailScanner]# service MailScanner start
Starting MailScanner daemons:
         incoming sendmail:                                [  OK  ]
         outgoing sendmail:                                [  OK  ]
         MailScanner:       In Debugging mode, not forking...
SA bayes lock is /root/.spamassassin/bayes.lock
Bayes lock is at /root/.spamassassin/bayes.lock
Undefined subroutine &MailScanner::Conf::Value called at
/usr/lib/MailScanner/MailScanner/MCP.pm line 230, <GEN181> line 33.

When you restore the original MCP.pm code the same problem then appears
with SA.pm thus:

[root@cheviot4 mqueue.in]# service MailScanner start
Starting MailScanner daemons:
         incoming sendmail:                                [  OK  ]
         outgoing sendmail:                                [  OK  ]
         MailScanner:       In Debugging mode, not forking...
SA bayes lock is /root/.spamassassin/bayes.lock
Bayes lock is at /root/.spamassassin/bayes.lock
Undefined subroutine &MailScanner::Conf::Value called at
/usr/lib/MailScanner/MailScanner/SA.pm line 331.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 08 October 2004 14:03
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
>
>Try the attached patches for SA.pm and MCP.pm.
>
>At 12:21 08/10/2004, you wrote:
>>Yes, using the existing "Envelope From Header" value seems the
>>appropriate thing to do.
>>
>>It also meets my requirement (see earlier posting) for a site 
>to be able
>>to specify a locally unique X-header string to use for the 
>envelope-from
>>address that MS can stuff into the message.
>>
>>Without that uniqueness I think SA will get confused when it tries to
>>decide which of the X-MailScanner-From: lines, all but one added by
>>upstream relays, it should use as the value of the pseudo-header
>>"EnvelopeFrom".
>>
>>The SA options document makes a comment that MTAs should avoid using a
>>single, standard, line containing the envelope-from address.
>>
>>When the amended patch is ready I will test it for you.
>>
>>Thanks
>>
>>Quentin
>>
>> >-----Original Message-----
>> >From: MailScanner mailing list
>> >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>> >Sent: 08 October 2004 11:57
>> >To: MAILSCANNER@JISCMAIL.AC.UK
>> >Subject: Re: Bug in SA.pm patch to MS 4.34.8-1
>> >
>> >At 11:52 08/10/2004, you wrote:
>> >>Julian
>> >>
>> >>The "EnvelopeFrom" pseudo-header may be working for you 
>and with SPF.
>> >>
>> >>It is not working here unless SA.pm and MCP.pm are patched as I
>> >>described earlier. :-(
>> >
>> >How about I add the
>> >"Envelope From Header"
>> >as defined in MailScanner.conf? That would save yet another
>> >config option.
>> >
>> >
>> >>I need this feature to work because I want to define rules 
>in MCP that
>> >>will allow me to discard messages to certain local addresses if the
>> >>envelope-from address is not from our two domains, ncl.ac.uk or
>> >>newcastle.ac.uk.
>> >
>> >--
>> >Julian Field
>> >www.MailScanner.info
>> >MailScanner thanks transtec Computers for their support
>> >Buy the MailScanner book at www.MailScanner.info/store
>> >
>> >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>> >
>> >------------------------ MailScanner list ------------------------
>> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> >'leave mailscanner' in the body of the email.
>> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>> >
>> >
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 09:30:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:13 2006
Subject: Bug in SA.pm patch to MS 4.34.8-1
Message-ID: <mailman.3379.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 08:36 12/10/2004, you wrote:
>Julian
>
>Sorry to have taken so long to get back to you on this but there is a
>problem with the MCP.pm.patch. Running MS in debug mode gives:
>
>[root@cheviot4 MailScanner]# service MailScanner start
>Starting MailScanner daemons:
>          incoming sendmail:                                [  OK  ]
>          outgoing sendmail:                                [  OK  ]
>          MailScanner:       In Debugging mode, not forking...
>SA bayes lock is /root/.spamassassin/bayes.lock
>Bayes lock is at /root/.spamassassin/bayes.lock
>Undefined subroutine &MailScanner::Conf::Value called at
>/usr/lib/MailScanner/MailScanner/MCP.pm line 230, <GEN181> line 33.

This has been fixed. To fix it yourself, just change Conf to Config in that
line.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From drew at THEMARSHALLS.CO.UK  Tue Oct 12 10:10:32 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:13 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3380.1137101233.24926.mailscanner@lists.mailscanner.info>

On Mon, October 11, 2004 23:50, Brian Parish said:
> This could be a purely postfix issue, so apologies if it's a bit OT here.
>
> One of the domains I host requires a catch-all mail account - yes, I
> know - spam collector.  I understand that the way this is done is to
> put:
>
> @domain mailbox
>
> in /etc/postfix/virtual then postmap virtual
>
> But I find with this defined that some properly defined addresses for
> other domains end up having their mail directed to the catch-all.  I
> can't work out a pattern, but monitoring shows an incoming message to:
>
> valid-address@valid-domain being scanned by MailScanner, found clean and
> directed to the catch-all.  Other addresses in the same domain work
> correctly.
>
> By commenting out the catch-all account and running postmap again, these
> addresses work correctly without other alteration.
>
> Have I found a bug or a feature I don't understand?
>
What is the order that you have listed the addesses in
/etc/postfix/virtual? Postfix does work on a first match basis.

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Tue Oct 12 10:27:13 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:13 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3381.1137101233.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian

I very rarely see any of these getting through....here my list of extra
rules I run..

70_sare_adult.cf                99_sare_fraud_post25x.cf
70_sare_bayes_poison_nxm.cf
70_sare_genlsubj.cf             antidrug.cf
70_sare_header.cf               backhair.cf
70_sare_header0.cf              bogus-virus-warnings.cf
70_sare_html.cf                 chickenpox.cf
70_sare_oem.cf                  drugads.cf
70_sare_random.cf               evilnumbers.cf
70_sare_ratware.cf              local.cf
70_sare_specific.cf             nazi.cf
70_sare_spoof.cf                random.cf
70_sare_unsub.cf                random.current.cf
70_sare_uri.cf                  spamcop_uri.cf
71_sare_redirect_pre3.0.0.cf
72_sare_bml_post25x.cf          ssl_local.cf
99_FVGT_Tripwire.cf             tripwire.cf

running on SA 2.64 with bayes, SpamcopXBL, surbl and pyzor 'extras'

my ssl_local.cf needs cleaning up as it's duplicating some of the newer
SARE rules, so it's prob double scoring on some of the bayes poison, Mr
Wiggly etc rules.

Any increase since you upgraded to 3.0???

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> Morning folks,
>
> I have written a Phishing fraud detector. It's not 100% perfect, but it
> should detect most of them. We are finding here that the SURBL phishing
> lists are far from complete, and we regularly get these coming through to
> our end-users.
>
> For those of you who don't know what phishing is....
>
> You get an email claiming to be from your bank / credit card company /
> utility company / whatever. It looks like a perfectly genuine email, it has
> their artwork, disclaimers, everything. There is some text in the message
> inviting you to click on a link in the message. The link looks quite
> normal, e.g. http://www.citibank.com/ or just www.citibank.com. They
> usually look like they want you to confirm security information, or
> re-register your account. But when you click on the link it doesn't take
> you to the bank's real website, it takes you to a plausible-sounding one
> that looks just like your bank's real website, but isn't. You type in
> confidential information of some sort, and the bad guys just managed to
> steal your information. Now they can steal your money and/or identity.
>
> MailScanner detects these and inserts some text into the message to
> highlight the possible fraud, and where it is coming from in reality.
> Please could all you translators out there please translate the following
> text into the language(s) of your choice? Please don't contribute
> translations you aren't 100% sure about, I have no way of telling whose
> translation into Spanish is the best, so probably best to post your
> translations to the list so we can agree on the best ones.
>
> # Used in Phishing Fraud attack detections. The "End" must close all the
> # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>
>
> Thanks all!
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jkau at JASPER.K12.GA.US  Tue Oct 12 10:39:25 2004
From: jkau at JASPER.K12.GA.US (Jason Kau)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3382.1137101233.24926.mailscanner@lists.mailscanner.info>

No thoughts on these anyone?

Related to #2 below, if the the MCP SpamAssassin times out, the email is
quarantined as MCP!

Oct 11 14:05:37 cheetah MailScanner[21950]: Message i9BI347P027207 from
207.250.170.169 (electionshirt@zippedemail.com) to jasper.k12.ga.us is MCP,
MCP-Checker (MCP timed out)

[root@cheetah mcp]# pwd
/var/spool/MailScanner/quarantine/20041011/mcp
[root@cheetah mcp]# ls i9BI347P027207
i9BI347P027207

Have thes bugs been fixed in beta releases?  They seem non-minor as I've had to
stop using MCP.

Quoting Jason Kau <jkau@jasper.k12.ga.us>:
> A few MCP-related bugs I've noticed in 4.34.8 on my server (RHEL 3 AS on Dell
> PowerEdge 2500):
>
> 1) MCP messages are quaratined with incorrect ownership of the individual
> message files (but directories have correct ownership).  My MailScanner.conf
> says:
>
> Quaratine User = apache
> Quarantine Group = apache
> Quarantine Permissions = 0660
>
> Individual MCP message files are quarantined owned by root:root:
>
> [root@cheetah mcp]# pwd
> /var/spool/MailScanner/quarantine/20041011/mcp
> [root@cheetah mcp]# ls -al
> total 20
> drwxrwx---    2 apache   apache       4096 Oct 11 01:25 .
> drwxrwx---    3 apache   apache       4096 Oct 11 01:14 ..
> -rw-rw----    1 root     root          882 Oct 11 01:14 i9B5DhuS026130
> -rw-rw----    1 root     root         1720 Oct 11 01:25 i9B5OqOs026471
> -rw-rw----    1 root     root          882 Oct 11 01:58 i9B5vNM3027985
> [root@cheetah mcp]#
>
> But individual spam message files are quarantined with the correct ownership:
>
> [root@cheetah spam]# pwd
> /var/spool/MailScanner/quarantine/20041011/spam
> [root@cheetah spam]# ls -al
> total 68
> drwxrwx---    2 apache   apache       4096 Oct 11 01:47 .
> drwxrwx---    4 apache   apache       4096 Oct 11 01:47 ..
> -rw-rw----    1 apache   apache      38752 Oct 11 01:56 i9B5uUUf027938
> -rw-rw----    1 apache   apache       6971 Oct 11 01:58 i9B5vJtF027982
> -rw-rw----    1 apache   apache       2094 Oct 11 01:58 i9B5vSS7027989
> -rw-rw----    1 apache   apache       2108 Oct 11 01:58 i9B5vSS8027989
> -rw-rw----    1 apache   apache       2094 Oct 11 01:58 i9B5vSS9027989
>
> [root@cheetah spam]#
>
> 2) If an email is marked as spam, it is also always logged in syslog as MCP:
>
> For example, here's an email that is certainly not matching my MCP rules but
> MailScanner says it's an MCP message:
>
> Oct 11 02:05:47 cheetah MailScanner[28508]: Message i9B65FSe028510 from
> 63.251.59.120 (money_finders.bfb@reply.ic10.com) to jasper.k12.ga.us is spam,
> SBL+XBL, NJABL, SpamAssassin (score=5.1, required 3, CLICK_BELOW 0.10,
> HTML_30_40 0.89, HTML_LINK_CLICK_HERE 0.10, HTML_MESSAGE 0.10,
> SARE_HTML_FONT_INVIS2 0.64, SARE_HTML_NO_BODY1 1.03, SARE_MONEYTERMS 0.68,
> UNCLAIMED_MONEY 1.64)
> Oct 11 02:05:47 cheetah MailScanner[28508]: Spam Checks: Found 1 spam
> messages
> Oct 11 02:05:48 cheetah MailScanner[28508]: Spam Actions: message
> i9B65FSe028510
> actions are alerts@localhost,forward
> Oct 11 02:05:48 cheetah MailScanner[28508]: MCP Checks: Starting
> Oct 11 02:05:48 cheetah MailScanner[28508]: MCP Checks: Found 1 MCP messages
> Oct 11 02:05:48 cheetah MailScanner[28508]: Virus and Content Scanning:
> Starting
> Oct 11 02:05:48 cheetah MailScanner[28508]: Content Checks: Detected and will
> disarm HTML message in i9B65FSe028510
> Oct 11 02:05:49 cheetah MailScanner[28508]: Uninfected: Delivered 1 messages
>
> Thank you for MailScanner.  Very nice.
>
> --
> Jason Kau
> Consultant
> Jasper County Schools
> Monticello, GA
>

--
Jason Kau
Consultant
Jasper County Schools
Monticello, GA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Tue Oct 12 11:15:27 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:14 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3383.1137101234.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-10-12 at 19:10, Drew Marshall wrote:
> On Mon, October 11, 2004 23:50, Brian Parish said:
> > This could be a purely postfix issue, so apologies if it's a bit OT here.
> >
> > One of the domains I host requires a catch-all mail account - yes, I
> > know - spam collector.  I understand that the way this is done is to
> > put:
> >
> > @domain mailbox
> >
> > in /etc/postfix/virtual then postmap virtual
> >
> > But I find with this defined that some properly defined addresses for
> > other domains end up having their mail directed to the catch-all.  I
> > can't work out a pattern, but monitoring shows an incoming message to:
> >
> > valid-address@valid-domain being scanned by MailScanner, found clean and
> > directed to the catch-all.  Other addresses in the same domain work
> > correctly.
> >
> > By commenting out the catch-all account and running postmap again, these
> > addresses work correctly without other alteration.
> >
> > Have I found a bug or a feature I don't understand?
> >
> What is the order that you have listed the addesses in
> /etc/postfix/virtual? Postfix does work on a first match basis.
>
> Drew
>
Thanks Drew,

But it is the last entry in virtual.  Do you (or anyone else) know if
this is supposed to work for each domain?  i.e. Should I theoretically
be able to have a:

@domain  mailbox

line at the end of each set of addresses?  The question is a bit
academic right now as it screws up with just one.  I assume however
that:

addr@domain1  mailbox1
@domain1  catchall1

addr@domain2  mailbox2
@domain2  catchall2

Is supposed to work?

thanks again
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at BARENDSE.TO  Tue Oct 12 11:42:38 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner 4.35.3-1 keeps restarting
Message-ID: <mailman.3384.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I just upgraded to the latest Beta version but it seems this version is
not processing any messages, it keeps finding messages in the queue but
then restarts MS again. This is from the maillog:

Oct 12 12:38:25 gw MailScanner[9247]: MCP Checks: Starting
Oct 12 12:38:34 gw MailScanner[9256]: MailScanner E-Mail Virus Scanner
version 4.35.2 starting...
Oct 12 12:38:35 gw MailScanner[9256]: Using locktype = flock
Oct 12 12:38:35 gw MailScanner[9256]: New Batch: Scanning 5 messages,
80522 bytes
Oct 12 12:38:35 gw MailScanner[9256]: Saved archive copies of
i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941

Oct 12 12:38:35 gw MailScanner[9256]: MCP Checks: Starting
Oct 12 12:38:44 gw MailScanner[9262]: MailScanner E-Mail Virus Scanner
version 4.35.2 starting...
Oct 12 12:38:45 gw MailScanner[9262]: Using locktype = flock
Oct 12 12:38:45 gw MailScanner[9262]: New Batch: Scanning 5 messages,
80522 bytes
Oct 12 12:38:45 gw MailScanner[9262]: Saved archive copies of
i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941


This is MailScanner version 4.35.2
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
0.2701  Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.42    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.33    URI

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 11:13:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3385.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:39 12/10/2004, you wrote:
>No thoughts on these anyone?
>
>Related to #2 below, if the the MCP SpamAssassin times out, the email is
>quarantined as MCP!

Intentional. The MCP checks should all be local checks without any network
tests, so there is very little genuine reason for it to time out. If you
are using MCP to stop critical business information leaving your site to
anyone, the last thing you want is all your information leaking out just
because the server went a bit wrong and timed out.

>Have thes bugs been fixed in beta releases?  They seem non-minor as I've
>had to
>stop using MCP.

I might have to put in another setting to control the timeout behaviour
with MCP. Does my reason above make sense to you?
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 12:06:18 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner 4.35.3-1 keeps restarting
Message-ID: <mailman.3386.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What happens when you run it with "Debug = yes"?

At 11:42 12/10/2004, you wrote:
>I just upgraded to the latest Beta version but it seems this version is
>not processing any messages, it keeps finding messages in the queue but
>then restarts MS again. This is from the maillog:
>
>Oct 12 12:38:25 gw MailScanner[9247]: MCP Checks: Starting
>Oct 12 12:38:34 gw MailScanner[9256]: MailScanner E-Mail Virus Scanner
>version 4.35.2 starting...
>Oct 12 12:38:35 gw MailScanner[9256]: Using locktype = flock
>Oct 12 12:38:35 gw MailScanner[9256]: New Batch: Scanning 5 messages,
>80522 bytes
>Oct 12 12:38:35 gw MailScanner[9256]: Saved archive copies of
>i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941
>
>Oct 12 12:38:35 gw MailScanner[9256]: MCP Checks: Starting
>Oct 12 12:38:44 gw MailScanner[9262]: MailScanner E-Mail Virus Scanner
>version 4.35.2 starting...
>Oct 12 12:38:45 gw MailScanner[9262]: Using locktype = flock
>Oct 12 12:38:45 gw MailScanner[9262]: New Batch: Scanning 5 messages,
>80522 bytes
>Oct 12 12:38:45 gw MailScanner[9262]: Saved archive copies of
>i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941
>
>
>This is MailScanner version 4.35.2
>Module versions are:
>1.00    AnyDBM_File
>1.13    Archive::Zip
>1.01    Carp
>1.119   Convert::BinHex
>1.00    DirHandle
>1.04    Fcntl
>2.71    File::Basename
>2.05    File::Copy
>2.01    FileHandle
>1.05    File::Path
>0.13    File::Temp
>1.23    HTML::Entities
>3.26    HTML::Parser
>2.24    HTML::TokeParser
>1.20    IO
>1.09    IO::File
>1.122   IO::Pipe
>3.05    MIME::Base64
>5.413   MIME::Decoder
>5.413   MIME::Decoder::UU
>5.413   MIME::Head
>5.413   MIME::Parser
>3.03    MIME::QuotedPrint
>5.413   MIME::Tools
>0.09    Net::CIDR
>1.05    POSIX
>1.75    Socket
>0.03    Sys::Syslog
>1.02    Time::localtime
>
>Optional module versions are:
>1.810   DB_File
>1.08    Digest
>1.01    Digest::HMAC
>2.33    Digest::MD5
>2.10    Digest::SHA1
>0.44    Inline
>0.11    Mail::ClamAV
>3.000000        Mail::SpamAssassin
>1.997   Mail::SPF::Query
>0.15    Net::CIDR::Lite
>0.48    Net::DNS
>0.2701  Net::LDAP
>1.94    Parse::RecDescent
>missing SAVI
>1.2     Sys::Hostname::Long
>2.42    Test::Harness
>0.47    Test::Simple
>1.89    Text::Balanced
>1.33    URI
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From lists at DVD-GOETSCH.DE  Tue Oct 12 11:13:42 2004
From: lists at DVD-GOETSCH.DE (sebastian ruchti)
Date: Thu Jan 12 21:27:14 2006
Subject: DE: Phishing Translators please?
Message-ID: <mailman.3387.1137101234.24926.mailscanner@lists.mailscanner.info>

A first one for German:

> # Used in Phishing Fraud attack detections. The "End" must close all the
> # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>

PossibleFraudStart = <font color="red"><b>MailScanner hat einen
m&ouml;glichen T&auml;uschungsversuch durch
PossibleFraudEnd = festgestellt.</b></font>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at BARENDSE.TO  Tue Oct 12 12:23:03 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner 4.35.3-1 keeps restarting
Message-ID: <mailman.3388.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
          MailScanner:       In Debugging mode, not forking...
SA bayes lock is /root/.spamassassin/bayes.lock
Bayes lock is at /root/.spamassassin/bayes.lock
Undefined subroutine &MailScanner::Conf::Value called at
/usr/lib/MailScanner/MailScanner/MCP.pm line 230, <GEN70> line 33.

Looks like the same error that was reported for earlier versions?


On Tue, 12 Oct 2004, Julian Field wrote:

> What happens when you run it with "Debug = yes"?
>
> At 11:42 12/10/2004, you wrote:
>> I just upgraded to the latest Beta version but it seems this version is
>> not processing any messages, it keeps finding messages in the queue but
>> then restarts MS again. This is from the maillog:
>>
>> Oct 12 12:38:25 gw MailScanner[9247]: MCP Checks: Starting
>> Oct 12 12:38:34 gw MailScanner[9256]: MailScanner E-Mail Virus Scanner
>> version 4.35.2 starting...
>> Oct 12 12:38:35 gw MailScanner[9256]: Using locktype = flock
>> Oct 12 12:38:35 gw MailScanner[9256]: New Batch: Scanning 5 messages,
>> 80522 bytes
>> Oct 12 12:38:35 gw MailScanner[9256]: Saved archive copies of
>> i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941
>>
>> Oct 12 12:38:35 gw MailScanner[9256]: MCP Checks: Starting
>> Oct 12 12:38:44 gw MailScanner[9262]: MailScanner E-Mail Virus Scanner
>> version 4.35.2 starting...
>> Oct 12 12:38:45 gw MailScanner[9262]: Using locktype = flock
>> Oct 12 12:38:45 gw MailScanner[9262]: New Batch: Scanning 5 messages,
>> 80522 bytes
>> Oct 12 12:38:45 gw MailScanner[9262]: Saved archive copies of
>> i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941
>>
>>
>> This is MailScanner version 4.35.2
>> Module versions are:
>> 1.00    AnyDBM_File
>> 1.13    Archive::Zip
>> 1.01    Carp
>> 1.119   Convert::BinHex
>> 1.00    DirHandle
>> 1.04    Fcntl
>> 2.71    File::Basename
>> 2.05    File::Copy
>> 2.01    FileHandle
>> 1.05    File::Path
>> 0.13    File::Temp
>> 1.23    HTML::Entities
>> 3.26    HTML::Parser
>> 2.24    HTML::TokeParser
>> 1.20    IO
>> 1.09    IO::File
>> 1.122   IO::Pipe
>> 3.05    MIME::Base64
>> 5.413   MIME::Decoder
>> 5.413   MIME::Decoder::UU
>> 5.413   MIME::Head
>> 5.413   MIME::Parser
>> 3.03    MIME::QuotedPrint
>> 5.413   MIME::Tools
>> 0.09    Net::CIDR
>> 1.05    POSIX
>> 1.75    Socket
>> 0.03    Sys::Syslog
>> 1.02    Time::localtime
>>
>> Optional module versions are:
>> 1.810   DB_File
>> 1.08    Digest
>> 1.01    Digest::HMAC
>> 2.33    Digest::MD5
>> 2.10    Digest::SHA1
>> 0.44    Inline
>> 0.11    Mail::ClamAV
>> 3.000000        Mail::SpamAssassin
>> 1.997   Mail::SPF::Query
>> 0.15    Net::CIDR::Lite
>> 0.48    Net::DNS
>> 0.2701  Net::LDAP
>> 1.94    Parse::RecDescent
>> missing SAVI
>> 1.2     Sys::Hostname::Long
>> 2.42    Test::Harness
>> 0.47    Test::Simple
>> 1.89    Text::Balanced
>> 1.33    URI
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Tue Oct 12 12:27:20 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3389.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
>
> #  Used in Phishing Fraud attack detections. The "End" must close all the
> #  HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>

PossibleFraudStart = <font color="red"><b> MailScanner heeft een e-mail
met mogelijk een poging tot fraude gevonden van
PossibleFraudEnd = </b></font>



>
> Thanks all!
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Tue Oct 12 12:27:50 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3390.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On Tue, 12 Oct 2004, Remco Barendse wrote:

>>
>> #  Used in Phishing Fraud attack detections. The "End" must close all the
>> #  HTML highlighting done in the "Start".
>> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
>> possible fraud attempt from
>> PossibleFraudEnd = </b></font>
>
> PossibleFraudStart = <font color="red"><b> MailScanner heeft een e-mail met
> mogelijk een poging tot fraude gevonden van
> PossibleFraudEnd = </b></font>

aaarghh.. sorry, the above is Dutch (NL)

>
>
>
>>
>> Thanks all!
>> --
>> Julian Field
>> www.MailScanner.info
>> MailScanner thanks transtec Computers for their support
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jkau at JASPER.K12.GA.US  Tue Oct 12 12:15:55 2004
From: jkau at JASPER.K12.GA.US (Jason Kau)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3391.1137101234.24926.mailscanner@lists.mailscanner.info>

Quoting Julian Field <mailscanner@ECS.SOTON.AC.UK>:
> >Related to #2 below, if the the MCP SpamAssassin times out, the email is
> >quarantined as MCP!
>
> Intentional. The MCP checks should all be local checks without any network
> tests, so there is very little genuine reason for it to time out. If you
> are using MCP to stop critical business information leaving your site to
> anyone, the last thing you want is all your information leaking out just
> because the server went a bit wrong and timed out.
>
> >Have thes bugs been fixed in beta releases?  They seem non-minor as I've
> >had to
> >stop using MCP.
>
> I might have to put in another setting to control the timeout behaviour
> with MCP. Does my reason above make sense to you?

Yes your reasoning makes perfect sense but it wasn't clear that was the expected
behavior.  A setting to control the timeout behavior would be ideal but beggers
can't be choosey.

As for fixing bugs, I was mainly referring to the the fact that MCP message
files aren't stored using the Quaratine User/Group settings and that every
message is logged as MCP in syslog.

--
Jason Kau
Consultant
Jasper County Schools
Monticello, GA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From max.gaspari at MERCATONEUNO.IT  Tue Oct 12 13:15:46 2004
From: max.gaspari at MERCATONEUNO.IT (Massimo Gaspari)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3392.1137101234.24926.mailscanner@lists.mailscanner.info>

Suggested Italian translation:

PossibleFraudStart = <font color="red"><b>MailScanner ha rilevato un
possibile tentativo di frode proveniente da
PossibleFraudEnd = </b></font>

bye

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
Sent: Tuesday, October 12, 2004 10:27 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Phishing Translators please?


Morning folks,

I have written a Phishing fraud detector. It's not 100% perfect, but it
should detect most of them. We are finding here that the SURBL phishing
lists are far from complete, and we regularly get these coming through
to
our end-users.

For those of you who don't know what phishing is....

You get an email claiming to be from your bank / credit card company /
utility company / whatever. It looks like a perfectly genuine email, it
has
their artwork, disclaimers, everything. There is some text in the
message
inviting you to click on a link in the message. The link looks quite
normal, e.g. http://www.citibank.com/ or just www.citibank.com. They
usually look like they want you to confirm security information, or
re-register your account. But when you click on the link it doesn't take
you to the bank's real website, it takes you to a plausible-sounding one
that looks just like your bank's real website, but isn't. You type in
confidential information of some sort, and the bad guys just managed to
steal your information. Now they can steal your money and/or identity.

MailScanner detects these and inserts some text into the message to
highlight the possible fraud, and where it is coming from in reality.
Please could all you translators out there please translate the
following
text into the language(s) of your choice? Please don't contribute
translations you aren't 100% sure about, I have no way of telling whose
translation into Spanish is the best, so probably best to post your
translations to the list so we can agree on the best ones.

# Used in Phishing Fraud attack detections. The "End" must close all the
# HTML highlighting done in the "Start".
PossibleFraudStart = <font color="red"><b>MailScanner has detected a
possible fraud attempt from
PossibleFraudEnd = </b></font>

Thanks all!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From zichovsky at TRUL.CZ  Tue Oct 12 12:27:16 2004
From: zichovsky at TRUL.CZ (Pavel Zichovsky)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3393.1137101234.24926.mailscanner@lists.mailscanner.info>

Hi There

> Morning folks,
>
> Please could all you translators out there please translate
> the following text into the language(s) of your choice?
> Please don't contribute translations you aren't 100% sure
> about, I have no way of telling whose translation into
> Spanish is the best, so probably best to post your
> translations to the list so we can agree on the best ones.
>
> # Used in Phishing Fraud attack detections. The "End" must
> close all the # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has
> detected a possible fraud attempt from PossibleFraudEnd = </b></font>

Suggested Czech translation:

PossibleFraudStart = <font color="red"><b>MailScanner zjistil mozny pokus o
podvod (kradez osobnich dat) ze stranky
PossibleFraudEnd = NEDOPORUCUJE se otevirat odkazy z teto zpravy a vyplnovat
jakekoliv osobni udaje.</b></font>

With regards
Pavel Zichovsky (zichovsky@trul)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 14:12:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3394.1137101234.24926.mailscanner@lists.mailscanner.info>

At 12:15 12/10/2004, you wrote:
>As for fixing bugs, I was mainly referring to the the fact that MCP message
>files aren't stored using the Quaratine User/Group settings

Attached is a tiny patch for MCPMessage.pm which will fix this.

>  and that every
>message is logged as MCP in syslog.

Not for me it isn't. If you log the detailed report, what does it say for
messages that shouldn't have been logged as MCP? And is it just a logging
problem?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
    [ Part 2, Application/OCTET-STREAM (Name: "MCPMessage.pm.patch")  ]
    [ 582bytes. ]
    [ Unable to print this part. ]


    [ Part 3: "Attached Text" ]

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From mailscanner at ecs.soton.ac.uk  Tue Oct 12 13:40:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3395.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12:27 12/10/2004, you wrote:
> > # Used in Phishing Fraud attack detections. The "End" must
> > close all the # HTML highlighting done in the "Start".
> > PossibleFraudStart = <font color="red"><b>MailScanner has
> > detected a possible fraud attempt from PossibleFraudEnd = </b></font>
>
>Suggested Czech translation:
>
>PossibleFraudStart = <font color="red"><b>MailScanner zjistil mozny pokus o
>podvod (kradez osobnich dat) ze stranky
>PossibleFraudEnd = NEDOPORUCUJE se otevirat odkazy z teto zpravy a vyplnovat
>jakekoliv osobni udaje.</b></font>

How did </B></FONT> change into the huge string you have for PossibleFraudEnd?

And please define "suggested " czech translation. I have no idea whether
your translation is good or bad.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 13:55:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner 4.35.3-1 keeps restarting
Message-ID: <mailman.3396.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Same error, different place. Replace "Conf" with "Config".

At 12:23 12/10/2004, you wrote:
>          MailScanner:       In Debugging mode, not forking...
>SA bayes lock is /root/.spamassassin/bayes.lock
>Bayes lock is at /root/.spamassassin/bayes.lock
>Undefined subroutine &MailScanner::Conf::Value called at
>/usr/lib/MailScanner/MailScanner/MCP.pm line 230, <GEN70> line 33.
>
>Looks like the same error that was reported for earlier versions?
>
>
>On Tue, 12 Oct 2004, Julian Field wrote:
>
>>What happens when you run it with "Debug = yes"?
>>
>>At 11:42 12/10/2004, you wrote:
>>>I just upgraded to the latest Beta version but it seems this version is
>>>not processing any messages, it keeps finding messages in the queue but
>>>then restarts MS again. This is from the maillog:
>>>
>>>Oct 12 12:38:25 gw MailScanner[9247]: MCP Checks: Starting
>>>Oct 12 12:38:34 gw MailScanner[9256]: MailScanner E-Mail Virus Scanner
>>>version 4.35.2 starting...
>>>Oct 12 12:38:35 gw MailScanner[9256]: Using locktype = flock
>>>Oct 12 12:38:35 gw MailScanner[9256]: New Batch: Scanning 5 messages,
>>>80522 bytes
>>>Oct 12 12:38:35 gw MailScanner[9256]: Saved archive copies of
>>>i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941
>>>
>>>Oct 12 12:38:35 gw MailScanner[9256]: MCP Checks: Starting
>>>Oct 12 12:38:44 gw MailScanner[9262]: MailScanner E-Mail Virus Scanner
>>>version 4.35.2 starting...
>>>Oct 12 12:38:45 gw MailScanner[9262]: Using locktype = flock
>>>Oct 12 12:38:45 gw MailScanner[9262]: New Batch: Scanning 5 messages,
>>>80522 bytes
>>>Oct 12 12:38:45 gw MailScanner[9262]: Saved archive copies of
>>>i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513 i9CAT4W5007941
>>>
>>>
>>>This is MailScanner version 4.35.2
>>>Module versions are:
>>>1.00    AnyDBM_File
>>>1.13    Archive::Zip
>>>1.01    Carp
>>>1.119   Convert::BinHex
>>>1.00    DirHandle
>>>1.04    Fcntl
>>>2.71    File::Basename
>>>2.05    File::Copy
>>>2.01    FileHandle
>>>1.05    File::Path
>>>0.13    File::Temp
>>>1.23    HTML::Entities
>>>3.26    HTML::Parser
>>>2.24    HTML::TokeParser
>>>1.20    IO
>>>1.09    IO::File
>>>1.122   IO::Pipe
>>>3.05    MIME::Base64
>>>5.413   MIME::Decoder
>>>5.413   MIME::Decoder::UU
>>>5.413   MIME::Head
>>>5.413   MIME::Parser
>>>3.03    MIME::QuotedPrint
>>>5.413   MIME::Tools
>>>0.09    Net::CIDR
>>>1.05    POSIX
>>>1.75    Socket
>>>0.03    Sys::Syslog
>>>1.02    Time::localtime
>>>
>>>Optional module versions are:
>>>1.810   DB_File
>>>1.08    Digest
>>>1.01    Digest::HMAC
>>>2.33    Digest::MD5
>>>2.10    Digest::SHA1
>>>0.44    Inline
>>>0.11    Mail::ClamAV
>>>3.000000        Mail::SpamAssassin
>>>1.997   Mail::SPF::Query
>>>0.15    Net::CIDR::Lite
>>>0.48    Net::DNS
>>>0.2701  Net::LDAP
>>>1.94    Parse::RecDescent
>>>missing SAVI
>>>1.2     Sys::Hostname::Long
>>>2.42    Test::Harness
>>>0.47    Test::Simple
>>>1.89    Text::Balanced
>>>1.33    URI
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Tue Oct 12 15:07:15 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner 4.35.3-1 keeps restarting
Message-ID: <mailman.3397.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Thanks, that solved it indeed :)



On Tue, 12 Oct 2004, Julian Field wrote:

> Same error, different place. Replace "Conf" with "Config".
>
> At 12:23 12/10/2004, you wrote:
>>          MailScanner:       In Debugging mode, not forking...
>> SA bayes lock is /root/.spamassassin/bayes.lock
>> Bayes lock is at /root/.spamassassin/bayes.lock
>> Undefined subroutine &MailScanner::Conf::Value called at
>> /usr/lib/MailScanner/MailScanner/MCP.pm line 230, <GEN70> line 33.
>>
>> Looks like the same error that was reported for earlier versions?
>>
>>
>> On Tue, 12 Oct 2004, Julian Field wrote:
>>
>>> What happens when you run it with "Debug = yes"?
>>>
>>> At 11:42 12/10/2004, you wrote:
>>>> I just upgraded to the latest Beta version but it seems this version is
>>>> not processing any messages, it keeps finding messages in the queue but
>>>> then restarts MS again. This is from the maillog:
>>>>
>>>> Oct 12 12:38:25 gw MailScanner[9247]: MCP Checks: Starting
>>>> Oct 12 12:38:34 gw MailScanner[9256]: MailScanner E-Mail Virus Scanner
>>>> version 4.35.2 starting...
>>>> Oct 12 12:38:35 gw MailScanner[9256]: Using locktype = flock
>>>> Oct 12 12:38:35 gw MailScanner[9256]: New Batch: Scanning 5 messages,
>>>> 80522 bytes
>>>> Oct 12 12:38:35 gw MailScanner[9256]: Saved archive copies of
>>>> i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513
>>>> i9CAT4W5007941
>>>>
>>>> Oct 12 12:38:35 gw MailScanner[9256]: MCP Checks: Starting
>>>> Oct 12 12:38:44 gw MailScanner[9262]: MailScanner E-Mail Virus Scanner
>>>> version 4.35.2 starting...
>>>> Oct 12 12:38:45 gw MailScanner[9262]: Using locktype = flock
>>>> Oct 12 12:38:45 gw MailScanner[9262]: New Batch: Scanning 5 messages,
>>>> 80522 bytes
>>>> Oct 12 12:38:45 gw MailScanner[9262]: Saved archive copies of
>>>> i9CAR1dt007756 i9CAPsPY007657 i9CAXsVo008594 i9CAXFpK008513
>>>> i9CAT4W5007941
>>>>
>>>>
>>>> This is MailScanner version 4.35.2
>>>> Module versions are:
>>>> 1.00    AnyDBM_File
>>>> 1.13    Archive::Zip
>>>> 1.01    Carp
>>>> 1.119   Convert::BinHex
>>>> 1.00    DirHandle
>>>> 1.04    Fcntl
>>>> 2.71    File::Basename
>>>> 2.05    File::Copy
>>>> 2.01    FileHandle
>>>> 1.05    File::Path
>>>> 0.13    File::Temp
>>>> 1.23    HTML::Entities
>>>> 3.26    HTML::Parser
>>>> 2.24    HTML::TokeParser
>>>> 1.20    IO
>>>> 1.09    IO::File
>>>> 1.122   IO::Pipe
>>>> 3.05    MIME::Base64
>>>> 5.413   MIME::Decoder
>>>> 5.413   MIME::Decoder::UU
>>>> 5.413   MIME::Head
>>>> 5.413   MIME::Parser
>>>> 3.03    MIME::QuotedPrint
>>>> 5.413   MIME::Tools
>>>> 0.09    Net::CIDR
>>>> 1.05    POSIX
>>>> 1.75    Socket
>>>> 0.03    Sys::Syslog
>>>> 1.02    Time::localtime
>>>>
>>>> Optional module versions are:
>>>> 1.810   DB_File
>>>> 1.08    Digest
>>>> 1.01    Digest::HMAC
>>>> 2.33    Digest::MD5
>>>> 2.10    Digest::SHA1
>>>> 0.44    Inline
>>>> 0.11    Mail::ClamAV
>>>> 3.000000        Mail::SpamAssassin
>>>> 1.997   Mail::SPF::Query
>>>> 0.15    Net::CIDR::Lite
>>>> 0.48    Net::DNS
>>>> 0.2701  Net::LDAP
>>>> 1.94    Parse::RecDescent
>>>> missing SAVI
>>>> 1.2     Sys::Hostname::Long
>>>> 2.42    Test::Harness
>>>> 0.47    Test::Simple
>>>> 1.89    Text::Balanced
>>>> 1.33    URI
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> MailScanner thanks transtec Computers for their support
>>> Buy the MailScanner book at www.MailScanner.info/store
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From clicknow at SWIFTDSL.COM.AU  Tue Oct 12 15:21:24 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:14 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3398.1137101234.24926.mailscanner@lists.mailscanner.info>

On Wed, 2004-10-13 at 00:04, Peter Bates wrote:
> Hello all...
>
> > clicknow@SWIFTDSL.COM.AU 12/10/04 11:15:27 >>>
> On Tue, 2004-10-12 at 19:10, Drew Marshall wrote:
> > On Mon, October 11, 2004 23:50, Brian Parish said:
> > > This could be a purely postfix issue, so apologies if it's a bit OT
> here.
> > >
> > > One of the domains I host requires a catch-all mail account - yes,
> I
> > > know - spam collector.  I understand that the way this is done is
> to
> > > put:
> >But it is the last entry in virtual.  Do you (or anyone else) know if
> >this is supposed to work for each domain?  i.e. Should I
> theoretically
> >be able to have a:
>
> >@domain  mailbox
>
> >line at the end of each set of addresses?
>
> Probably not a help right now, but I did have a similar problem and
> wasted a morning fiddling with Postfix trying to fix it. In the end, my
> problem was caused by one of the domains also being listed in
> mydestination or myorigin (I forget which)... I think it was myorigin
> because I kept thinking 'why would this parameter have any effect on
> incoming mail?', but it did in fact break using virtual domains and lead
> to rather 'odd' behaviour...
>
> Other than that, might be a question for the Postfix users mailing
> list... good luck!
>
Well that's exactly the situation I have here!  The catch-all mail is to
be pushed off elsewhere via a fetchmail from another machine, so I think
of it a "another domain", but it is the home domain that is being
specified here.  I think you have put me on the right track.

cheers
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Denis.Beauchemin at USHERBROOKE.CA  Tue Oct 12 15:45:55 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3399.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:

>
>
> # Used in Phishing Fraud attack detections. The "End" must close all the
> # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>
>

Julian,

My French translation:
PossibleFraudStart = <font color="red"><b>MailScanner a 
d&eacute;tect&eacute; une tentative de fraude par
PossibleFraudEnd = </b></font>

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From jstevens at ATHENSDISTRIBUTING.COM  Tue Oct 12 16:02:39 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:14 2006
Subject: Question?
Message-ID: <mailman.3400.1137101234.24926.mailscanner@lists.mailscanner.info>

I just reload the access map into memory after any changes without
stopping the queues.

CLI->mapmap hash /etc/mail/access < /etc/mail/access 

-----Original Message-----
From: Peter Bonivart [mailto:peter@UCGBOOK.COM] 
Sent: Monday, October 11, 2004 5:25 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Question?

xterm1 wrote:
>                 Does MailScanner reread the various sendmail files ie:
>
> /etc/mail/access
>
> and so on, when you issue restart/reload ?

MS doesn't since it doesn't directly interact with Sendmail, it just
uses the queues. You have to restart Sendmail but the Linux start script
can take care of that.

Your example with the access file doesn't need a restart though, just
make it to access.db and it will be used right away like the other db
files.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstevens at ATHENSDISTRIBUTING.COM  Tue Oct 12 16:06:07 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:14 2006
Subject: Question?
Message-ID: <mailman.3401.1137101234.24926.mailscanner@lists.mailscanner.info>

Sorry TYPO ...Too Early for me

Command should have been:

CLI->makemap hash /etc/mail/access < /etc/mail/access

-----Original Message-----
From: James R. Stevens 
Sent: Tuesday, October 12, 2004 10:03 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Question?

I just reload the access map into memory after any changes without
stopping the queues.

CLI->mapmap hash /etc/mail/access < /etc/mail/access 

-----Original Message-----
From: Peter Bonivart [mailto:peter@UCGBOOK.COM] 
Sent: Monday, October 11, 2004 5:25 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Question?

xterm1 wrote:
>                 Does MailScanner reread the various sendmail files ie:
>
> /etc/mail/access
>
> and so on, when you issue restart/reload ?

MS doesn't since it doesn't directly interact with Sendmail, it just
uses the queues. You have to restart Sendmail but the Linux start script
can take care of that.

Your example with the access file doesn't need a restart though, just
make it to access.db and it will be used right away like the other db
files.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Peter.Bates at LSHTM.AC.UK  Tue Oct 12 15:04:51 2004
From: Peter.Bates at LSHTM.AC.UK (Peter Bates)
Date: Thu Jan 12 21:27:14 2006
Subject: Maybe OT - postfix and catch-all accounts
Message-ID: <mailman.3402.1137101234.24926.mailscanner@lists.mailscanner.info>

Hello all...

> clicknow@SWIFTDSL.COM.AU 12/10/04 11:15:27 >>>
On Tue, 2004-10-12 at 19:10, Drew Marshall wrote:
> On Mon, October 11, 2004 23:50, Brian Parish said:
> > This could be a purely postfix issue, so apologies if it's a bit OT
here.
> >
> > One of the domains I host requires a catch-all mail account - yes,
I
> > know - spam collector.  I understand that the way this is done is
to
> > put:
>But it is the last entry in virtual.  Do you (or anyone else) know if
>this is supposed to work for each domain?  i.e. Should I
theoretically
>be able to have a:

>@domain  mailbox

>line at the end of each set of addresses?

Probably not a help right now, but I did have a similar problem and
wasted a morning fiddling with Postfix trying to fix it. In the end, my
problem was caused by one of the domains also being listed in
mydestination or myorigin (I forget which)... I think it was myorigin
because I kept thinking 'why would this parameter have any effect on
incoming mail?', but it did in fact break using virtual domains and lead
to rather 'odd' behaviour...

Other than that, might be a question for the Postfix users mailing
list... good luck!



--------------------------------------------------------------------------------------------------->
Peter Bates, Systems Support Officer, IT Services.
London School of Hygiene & Tropical Medicine.
Telephone:0207-958 8353 / Fax: 0207- 636 9838

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From el.baby at gmail.com  Tue Oct 12 16:21:44 2004
From: el.baby at gmail.com (Mariano Absatz)
Date: Thu Jan 12 21:27:14 2006
Subject: [SPANISH] Phishing Translators please?
Message-ID: <mailman.3403.1137101234.24926.mailscanner@lists.mailscanner.info>

On Tue, 12 Oct 2004 09:27:04 +0100, Julian Field
<mailscanner@ecs.soton.ac.uk> wrote:
> # Used in Phishing Fraud attack detections. The "End" must close all the
> # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>

PossibleFraudStart = <font color="red"><b>MailScanner ha detectado un
posible intento de fraude desde
PossibleFraudEnd = </b></font>


--
Mariano Absatz - El Baby
el (dot) baby (AT) gmail (dot) com
el (punto) baby (ARROBA:@) gmail (punto) com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Tue Oct 12 17:32:46 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3404.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Denis Beauchemin wrote:
> Julian Field wrote:
>
>>
>>
>> # Used in Phishing Fraud attack detections. The "End" must close all the
>> # HTML highlighting done in the "Start".
>> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
>> possible fraud attempt from
>> PossibleFraudEnd = </b></font>
>>
>
> Julian,
>
> My French translation:
> PossibleFraudStart = <font color="red"><b>MailScanner a
> d&eacute;tect&eacute; une tentative de fraude par
> PossibleFraudEnd = </b></font>

Denis, je mettrais un "probable" ou "possible" ou qqch de semblable pour
temperer l'affirmation et donner l'equivalent de "possible fraud
attempt", donc ca donnerait

"MailScanner a d&eacute;tect&eacute; une possibilit&eacute; de tentative
de fraude par"

Qu'en penses-tu?

>
> Denis
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ssilva at SGVWATER.COM  Tue Oct 12 17:35:20 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:14 2006
Subject: Notify the sender, but don't deliver
Message-ID: <mailman.3405.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Field wrote:
| There is 1 problem. Some people legitimately want to warn the senders of
| macro-viruses, which by their very nature do not spoof the From address.
| This is what has stopped me removing it in the past.
|
| Any votes either way people?
1 vote to remove it! IF it is that fairly rare breed of macro virus,
that means you will be warning a user who, it seems, cannot even keep
their virus scanner up to date on their machine. I have only seen 1
macro virus in 3 years, and that was on a file recovery side job for
someone who had the machine sitting for a while and wanted their thesis
files recovered.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBbAfIRADw9lziUqQRAsUhAJwJ9Ln7sX/n+M9IHPhCloMGbDFIIACaA+TG
lzdBSalldUiqYzc1ZTquUF8=
=mclE
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Tue Oct 12 17:39:38 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:14 2006
Subject: In Start didn't find a C record when I wanted one
Message-ID: <mailman.3406.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Íîâîæåíèí Àëåêñàíäð Àíäðååâè÷ wrote:
> Çäðàâñòâóéòå, MAILSCANNER.
> 
> The question to source writers. What`s meen SUBJ in MailScanner.
> When somebody send me some spam, the daemon of MailScanner is suspend.
> But sometimes it go on work.

What do you mean by "suspend"?

> 
> ---cut here---
> [root@mail log]# MailScanner -V
> Running on
> Linux mail.domain.ru 2.4.22-1.2154.nptl.aspsmp #1 SMP Wed Jan 14 19:48:31 MSK 2004 i686 i686 i386 GNU/Linux
> This is Fedora Core release 1 (Yarrow)
> This is Perl version 5.008005 (5.8.5)
> 
> This is MailScanner version 4.34.8
> Module versions are:
> 1.00    AnyDBM_File
> 1.13    Archive::Zip
> 1.03    Carp
> 1.119   Convert::BinHex
> 1.00    DirHandle
> 1.05    Fcntl
> 2.73    File::Basename
> 2.08    File::Copy
> 2.01    FileHandle
> 1.06    File::Path
> 0.14    File::Temp
> 1.27    HTML::Entities
> 3.36    HTML::Parser
> 2.28    HTML::TokeParser
> 1.21    IO
> 1.10    IO::File
> 1.123   IO::Pipe
> 3.03    MIME::Base64
> 5.414   MIME::Decoder
> 5.414   MIME::Decoder::UU
> 5.414   MIME::Head
> 5.414   MIME::Parser
> 3.03    MIME::QuotedPrint
> 5.414   MIME::Tools
> 0.10    Net::CIDR
> 1.08    POSIX
> 1.77    Socket
> 0.05    Sys::Syslog
> 1.02    Time::localtime
> 
> Optional module versions are:
> 1.809   DB_File
> 1.08    Digest
> 1.01    Digest::HMAC
> 2.33    Digest::MD5
> 2.10    Digest::SHA1
> 0.44    Inline
> 0.11    Mail::ClamAV
> 3.000000        Mail::SpamAssassin
> 1.997   Mail::SPF::Query
> 0.15    Net::CIDR::Lite
> 0.48    Net::DNS
> missing Net::LDAP
> 1.94    Parse::RecDescent
> missing SAVI
> 1.2     Sys::Hostname::Long
> 2.42    Test::Harness
> 0.47    Test::Simple
> 1.95    Text::Balanced
> 1.33    URI
> ---cut here---
> 
> 
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From ugob at CAMO-ROUTE.COM  Tue Oct 12 17:36:47 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:14 2006
Subject: DCC -1.2.4 problem
Message-ID: <mailman.3407.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Koen Teugels wrote:
> after the .configure command in a whitebox linux i get this
> look for sendmail milter library in
> ./../sendmail/obj.Linux.2.4.21-20.ELsmp.i686
>        *** cannot build dccm without sendmail headers in ./../sendmail
>                and libraries in
> ./../sendmail/obj.Linux.2.4.21-20.ELsmp.i686 ***
>
> Dos sombody now what it means?

Maybe you'd need the sendmail-devel package?

yum install sendmail-devel

However, I did install dcc on my Tao boxes without this package.  I only
have sendmail and sendmail-cf instaled.

> thanks Koen
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 18:29:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3408.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
With the Conf vs Config typo corrected, is 4.35.3 working okay for the
brave few of you who have tried it? I haven't heard any more reports of
problems, so hopefully it is alright.

The next beta will have the phishing detector in it. I have been running
this here today and it has already caught a whole load of attacks against
Abbey National and SunTrust bank customers.

Your comments please...

Thanks folks, particularly for being so patient while I get these nasty
Perl dependency and packaging problems sorted out.

Jules.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Kevin_Miller at CI.JUNEAU.AK.US  Tue Oct 12 18:43:15 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3409.1137101234.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> With the Conf vs Config typo corrected, is 4.35.3 working okay for
> the brave few of you who have tried it? I haven't heard any more
> reports of problems, so hopefully it is alright.
>
> The next beta will have the phishing detector in it. I have been
> running this here today and it has already caught a whole load of
> attacks against Abbey National and SunTrust bank customers.
>
> Your comments please...
>
> Thanks folks, particularly for being so patient while I get these
> nasty Perl dependency and packaging problems sorted out.
>
> Jules.

What is the default action associated with phishing schemes?  Spam, High
Scoring Spam, mail bomb 'em (just kidding!)?

If one downloads the current 4.35.3 beta do we need to apply any patches or
edit for the conf/config errors, or are they fixed I the build?

Thanks much Julian...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 18:49:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3410.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:43 12/10/2004, you wrote:
>Julian Field wrote:
> > With the Conf vs Config typo corrected, is 4.35.3 working okay for
> > the brave few of you who have tried it? I haven't heard any more
> > reports of problems, so hopefully it is alright.
> >
> > The next beta will have the phishing detector in it. I have been
> > running this here today and it has already caught a whole load of
> > attacks against Abbey National and SunTrust bank customers.
> >
> > Your comments please...
> >
> > Thanks folks, particularly for being so patient while I get these
> > nasty Perl dependency and packaging problems sorted out.
> >
> > Jules.
>
>What is the default action associated with phishing schemes?  Spam, High
>Scoring Spam, mail bomb 'em (just kidding!)?

It inserts a warning right next to the link, telling you (a) that
MailScanner found a suspicious link and (b) the real target of the link.
The link itself is left active, so you can click on it if it is a false alarm.
The subject line is also tagged as containing dangerous content.

>If one downloads the current 4.35.3 beta do we need to apply any patches or
>edit for the conf/config errors, or are they fixed I the build?

Do a
         cd /usr/lib/MailScanner/MailScanner
         grep Conf:: *pm
and change any you find to Config instead of Conf. You will find either 1
or 2 of them.

If you like I will publish a new beta with these fixes in, and the phishing
detector.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Kevin_Miller at CI.JUNEAU.AK.US  Tue Oct 12 18:54:28 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3411.1137101234.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:

> If you like I will publish a new beta with these fixes in, and the
> phishing detector.

No, don't go to the extra effort until you're ready to publish the phishing
scheme beta anyway (I assume that you'll beta test it <g>) - two simple
edits is easy enough to do, just wasn't sure if those were included or not.
Much easier for us to make the edits than for you to spend your time
building rpm files.  Unless you're having a really slow, boring day.  Like
that ever happens...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greg at BLASTZONE.COM  Tue Oct 12 18:55:45 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing detector
Message-ID: <mailman.3412.1137101234.24926.mailscanner@lists.mailscanner.info>

The phishing detector sounds great!  Is it something that will be turned
on with virus scanning, spam, or will it have a separate setting to turn
it on and off independent of virus and spam scanning?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Denis.Beauchemin at USHERBROOKE.CA  Tue Oct 12 18:58:51 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3413.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ugo Bellavance wrote:

> Denis Beauchemin wrote:
>
>> Julian Field wrote:
>>
>>>
>>>
>>> # Used in Phishing Fraud attack detections. The "End" must close all 
>>> the
>>> # HTML highlighting done in the "Start".
>>> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
>>> possible fraud attempt from
>>> PossibleFraudEnd = </b></font>
>>>
>>
>> Julian,
>>
>> My French translation:
>> PossibleFraudStart = <font color="red"><b>MailScanner a
>> d&eacute;tect&eacute; une tentative de fraude par
>> PossibleFraudEnd = </b></font>
>
>
> Denis, je mettrais un "probable" ou "possible" ou qqch de semblable pour
> temperer l'affirmation et donner l'equivalent de "possible fraud
> attempt", donc ca donnerait
>
> "MailScanner a d&eacute;tect&eacute; une possibilit&eacute; de tentative
> de fraude par"
>
> Qu'en penses-tu?


Julian,

Ugo and I finally agreed on:
PossibleFraudStart = <font color="red"><b>MailScanner soup&ccedil;onne 
ce message d'&ecirc;tre une tentative de fraude de la part de
PossibleFraudEnd = </b></font>

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From Denis.Beauchemin at USHERBROOKE.CA  Tue Oct 12 19:02:25 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3414.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:

> At 18:43 12/10/2004, you wrote:
>
>> Julian Field wrote:
>> > With the Conf vs Config typo corrected, is 4.35.3 working okay for
>> > the brave few of you who have tried it? I haven't heard any more
>> > reports of problems, so hopefully it is alright.
>> >
>> > The next beta will have the phishing detector in it. I have been
>> > running this here today and it has already caught a whole load of
>> > attacks against Abbey National and SunTrust bank customers.
>> >
>> > Your comments please...
>> >
>> > Thanks folks, particularly for being so patient while I get these
>> > nasty Perl dependency and packaging problems sorted out.
>> >
>> > Jules.
>>
>> What is the default action associated with phishing schemes?  Spam, High
>> Scoring Spam, mail bomb 'em (just kidding!)?
>
>
> It inserts a warning right next to the link, telling you (a) that
> MailScanner found a suspicious link and (b) the real target of the link.
> The link itself is left active, so you can click on it if it is a 
> false alarm.
> The subject line is also tagged as containing dangerous content.
>

Julian,

Do we need a new translation for the subject tag or are you using an 
existing one?

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 19:27:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3415.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:54 12/10/2004, you wrote:
>Julian Field wrote:
> > If you like I will publish a new beta with these fixes in, and the
> > phishing detector.
>
>No, don't go to the extra effort until you're ready to publish the phishing
>scheme beta anyway (I assume that you'll beta test it <g>) - two simple
>edits is easy enough to do, just wasn't sure if those were included or not.
>Much easier for us to make the edits than for you to spend your time
>building rpm files.  Unless you're having a really slow, boring day.  Like
>that ever happens...

I'm going to leave it running on my own site for a few more days to see if
anything untoward happens.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 19:23:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing detector
Message-ID: <mailman.3416.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:55 12/10/2004, you wrote:
>The phishing detector sounds great!  Is it something that will be turned
>on with virus scanning, spam, or will it have a separate setting to turn
>it on and off independent of virus and spam scanning?

It has its own setting. It's part of the dangerous content scanning, like
the HTML tags I look for.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 19:22:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3417.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 19:02 12/10/2004, you wrote:
>Julian Field wrote:
>>At 18:43 12/10/2004, you wrote:
>>>Julian Field wrote:
>>> > With the Conf vs Config typo corrected, is 4.35.3 working okay for
>>> > the brave few of you who have tried it? I haven't heard any more
>>> > reports of problems, so hopefully it is alright.
>>> >
>>> > The next beta will have the phishing detector in it. I have been
>>> > running this here today and it has already caught a whole load of
>>> > attacks against Abbey National and SunTrust bank customers.
>>> >
>>> > Your comments please...
>>> >
>>> > Thanks folks, particularly for being so patient while I get these
>>> > nasty Perl dependency and packaging problems sorted out.
>>> >
>>> > Jules.
>>>
>>>What is the default action associated with phishing schemes?  Spam, High
>>>Scoring Spam, mail bomb 'em (just kidding!)?
>>
>>
>>It inserts a warning right next to the link, telling you (a) that
>>MailScanner found a suspicious link and (b) the real target of the link.
>>The link itself is left active, so you can click on it if it is a false
>>alarm.
>>The subject line is also tagged as containing dangerous content.
>
>Julian,
>
>Do we need a new translation for the subject tag or are you using an
>existing one?

I'm just using the Dangerous Content subject tag. I didn't feel like adding
all the code to add yet another infection report type just for this.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From zichovsky at TRUL.CZ  Tue Oct 12 20:04:40 2004
From: zichovsky at TRUL.CZ (Pavel Zichovsky)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3418.1137101234.24926.mailscanner@lists.mailscanner.info>

Hi there,

> >Suggested Czech translation:
> >
> >PossibleFraudStart = <font color="red"><b>MailScanner zjistil mozny
> >pokus o podvod (kradez osobnich dat) ze stranky PossibleFraudEnd =
> >NEDOPORUCUJE se otevirat odkazy z teto zpravy a vyplnovat jakekoliv
> >osobni udaje.</b></font>
>
> How did </B></FONT> change into the huge string you have for
> PossibleFraudEnd?

If I understand it correctly, in final mail will be

[PossibleFraudStart] [real addres from fraud link] [PossibleFraudEnd]

So in "end" i have only added warning about clicking on link and  filling
personal details (as i know users clicking on almost everything :-( ). It
can be easily omitted, so czech translation is:

PossibleFraudStart = <font color="red"><b>MailScanner zjistil mozny pokus o
podvod (kradez osobnich dat) ze stranky

PossibleFraudEnd = </b></font>

> And please define "suggested " czech translation. I have no
> idea whether your translation is good or bad.

I think that my translation is good.

With regards
Pavel Zichovsky (zichovsky@trul)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jkau at JASPER.K12.GA.US  Tue Oct 12 20:18:27 2004
From: jkau at JASPER.K12.GA.US (Jason Kau)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3419.1137101234.24926.mailscanner@lists.mailscanner.info>

Quoting Julian Field <mailscanner@ECS.SOTON.AC.UK>:
> At 12:15 12/10/2004, you wrote:
> >As for fixing bugs, I was mainly referring to the the fact that MCP message
> >files aren't stored using the Quaratine User/Group settings
>
> Attached is a tiny patch for MCPMessage.pm which will fix this.

Thanks!  Is this fix (or a more complete one?) going to show up in 4.35.X and
later?  I see 4.35.3 doesn't have it.

> >  and that every
> >message is logged as MCP in syslog.
>
> Not for me it isn't. If you log the detailed report, what does it say for
> messages that shouldn't have been logged as MCP? And is it just a logging
> problem?

Yes it's just a logging problem.  An email that doesn't get marked as SPAM or
MCP shows:

Oct 12 15:04:23 cheetah MailScanner[22501]: New Batch: Scanning 1 messages, 1141
bytes
Oct 12 15:04:23 cheetah MailScanner[22501]: Spam Checks: Starting
Oct 12 15:04:33 cheetah MailScanner[22501]: Message i9CJ4M5Y022755 from
199.77.147.250 (jkau@cnd.gatech.edu) to jasper.k12.ga.us is not spam,
SpamAssassin (score=0, required 3, USER_AGENT_PINE 0.00)
Oct 12 15:04:33 cheetah MailScanner[22501]: MCP Checks: Starting
Oct 12 15:04:33 cheetah MailScanner[22501]: Virus and Content Scanning: Starting
Oct 12 15:04:34 cheetah MailScanner[22501]: Uninfected: Delivered 1 messages

However, if an email is marked as spam but not as MCP (I'm sending these emails
to test MCP so I know they're not matching my MCP SpamAssassin rules), it
always says "Found 1 MCP messages":

Oct 12 15:05:48 cheetah MailScanner[22687]: Spam Checks: Found 1 spam messages
Oct 12 15:05:48 cheetah MailScanner[22687]: Spam Actions: message i9CJ5fV3022834
actions are alerts@localhost,forward
Oct 12 15:05:48 cheetah MailScanner[22687]: MCP Checks: Starting
Oct 12 15:05:48 cheetah MailScanner[22687]: MCP Checks: Found 1 MCP messages
Oct 12 15:05:48 cheetah MailScanner[22660]: Virus and Content Scanning: Starting
Oct 12 15:05:48 cheetah MailScanner[22660]: Uninfected: Delivered 1 messages

In other words "MCP Checks: Found X MCP messages" seems to be just a repeating
"Spam Check: Found X spam messages" but with the phrase "MCP Checks" replacing
"Spam Check".

Does this make sense?

--
Jason Kau
Consultant
Jasper County Schools
Monticello, GA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 12 20:34:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.34.8 MCP bugs
Message-ID: <mailman.3420.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:18 12/10/2004, you wrote:
>Quoting Julian Field <mailscanner@ECS.SOTON.AC.UK>:
> > At 12:15 12/10/2004, you wrote:
> > >As for fixing bugs, I was mainly referring to the the fact that MCP
> message
> > >files aren't stored using the Quaratine User/Group settings
> >
> > Attached is a tiny patch for MCPMessage.pm which will fix this.
>
>Thanks!  Is this fix (or a more complete one?) going to show up in 4.35.X and
>later?  I see 4.35.3 doesn't have it.

Fixes for both these problems will be in 4.35.4.

>In other words "MCP Checks: Found X MCP messages" seems to be just a repeating
>"Spam Check: Found X spam messages" but with the phrase "MCP Checks" replacing
>"Spam Check".
>
>Does this make sense?

Yes, found and fixed. I'll release 4.35.4 in a few days.

If you need to fix it now, find line 235 of MCPMessage.pm. It should say
   return $this->{isspam};
Change this to
   return $this->{ismcp};

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Tue Oct 12 21:03:17 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3421.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:
> # Used in Phishing Fraud attack detections. The "End" must close all the
> # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>

Swedish:

PossibleFraudStart = <font color="red"><b>MailScanner har detekterat ett
m&ouml;jligt bedr&auml;gerif&ouml;rs&ouml;k fr&aring;n
PossibleFraudEnd = </b></font>


--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Tue Oct 12 21:45:42 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:14 2006
Subject: DCC -1.2.4 problem
Message-ID: <mailman.3422.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Koen Teugels wrote:
> after the .configure command in a whitebox linux i get this
> look for sendmail milter library in
> ./../sendmail/obj.Linux.2.4.21-20.ELsmp.i686
>        *** cannot build dccm without sendmail headers in ./../sendmail
>                and libraries in
> ./../sendmail/obj.Linux.2.4.21-20.ELsmp.i686 ***
>
> Dos sombody now what it means?
> thanks Koen

Dccm is the Sendmail interface, you don't need that since it's only
SpamAssassin that uses DCC, not Sendmail. You only need dccproc and
optionally dccifd if you want to run it as a daemon.

Add "--disable-dccm" to your configure line and it should pass.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at pdscc.com  Wed Oct 13 05:17:01 2004
From: mailscanner at pdscc.com (Harondel J. Sibble)
Date: Thu Jan 12 21:27:14 2006
Subject: web based front end for archival access
Message-ID: <mailman.3423.1137101234.24926.mailscanner@lists.mailscanner.info>

Okay, I asked about the approx 8 months ago and the issue has come up again.

Basically, client is running an MS based based mail relay for the natted
network. Archiving is turned on, on the MS relay. The management folks want
to be able to access a web based archive of all email in/out of the mail
relay machine for say the past month. This is so they can verify when a
message was sent/received.  After a month, the archive file (currently stored
in standard mbx format) is backed up to dvd and the file is zeroed and
restarted.  The plan is then to convert the mbx files to either discrete
emails or into  outlook pst format so the mails can easily be accessed
offline.

The web archive needs to be able to be restricted to specific users. Also
they need to be able to forward mail from the current archive to other
internal users or outside clients.  The ability to view the headers and keep
them intact when forwarding is very important as is the ability to view the
received/sent message in it's entirety along with attachments.

So, what do folks suggest now to accomplish the above?
--
Harondel J. Sibble
Sibble Computer Consulting
Creating solutions for the small business and home computer user.
help@pdscc.com (use pgp keyid 0x3AD5C11D) http://www.pdscc.com
(604) 739-3709 (voice/fax)      (604) 686-2253 (pager)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hburbano at NOVADEVICES.COM  Tue Oct 12 23:15:22 2004
From: hburbano at NOVADEVICES.COM (Henry Burbano)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3424.1137101234.24926.mailscanner@lists.mailscanner.info>

In spanish:

PossibleFraudStart = <font color="red"><b>MailScanner ha detectado
un posible fraude proveniente de
PossibleFraudEnd = </b></font>



Saludos,

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 12, 2004 3:27 AM
Subject: Phishing Translators please?


> Morning folks,
>
> I have written a Phishing fraud detector. It's not 100% perfect, but it
> should detect most of them. We are finding here that the SURBL phishing
> lists are far from complete, and we regularly get these coming through to
> our end-users.
>
> For those of you who don't know what phishing is....
>
> You get an email claiming to be from your bank / credit card company /
> utility company / whatever. It looks like a perfectly genuine email, it
has
> their artwork, disclaimers, everything. There is some text in the message
> inviting you to click on a link in the message. The link looks quite
> normal, e.g. http://www.citibank.com/ or just www.citibank.com. They
> usually look like they want you to confirm security information, or
> re-register your account. But when you click on the link it doesn't take
> you to the bank's real website, it takes you to a plausible-sounding one
> that looks just like your bank's real website, but isn't. You type in
> confidential information of some sort, and the bad guys just managed to
> steal your information. Now they can steal your money and/or identity.
>
> MailScanner detects these and inserts some text into the message to
> highlight the possible fraud, and where it is coming from in reality.
> Please could all you translators out there please translate the following
> text into the language(s) of your choice? Please don't contribute
> translations you aren't 100% sure about, I have no way of telling whose
> translation into Spanish is the best, so probably best to post your
> translations to the list so we can agree on the best ones.
>
> # Used in Phishing Fraud attack detections. The "End" must close all the
> # HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>
>
> Thanks all!
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


*******************************************************
This message has been scanned for viruses and
dangerous content by Kypus Server Appliance E-Mail
Protection Service, and is believed to be clean.
*******************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Wed Oct 13 05:23:01 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:14 2006
Subject: Anyone got a Panda update script?
Message-ID: <mailman.3425.1137101234.24926.mailscanner@lists.mailscanner.info>

We have purchased panda sendmail license so we have username password to
download the latest signatures. We don't have a script to automate this.
Does someone out there have a working one.

SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From john at TRADOC.FR  Wed Oct 13 07:06:30 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3426.1137101234.24926.mailscanner@lists.mailscanner.info>

On Tue, 12 Oct 2004 13:58:51 -0400, Denis Beauchemin wrote:
> Ugo and I finally agreed on:
> PossibleFraudStart = <font color="red"><b>MailScanner soup&ccedil;onne 
> ce message d'&ecirc;tre une tentative de fraude de la part de
> PossibleFraudEnd = </b></font>

Except that this text is, if I understand things correctly, going to be
inserted in the body of the message, immediately before the doubtful
link itself. I'd suggest deleting "ce message d'être" from the above.

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vlado at AGENDA.SI  Wed Oct 13 08:45:48 2004
From: vlado at AGENDA.SI (Vladimir Nikolic)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3427.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

I am using MailScanner for 2 years now and it works very well. But I
have found lately one strange problem in communications with MS exchange
servers. It happens only when my users replying on some mail which
contains one or more attachments (pdf, rtf...). If that replyed mail
goes through MS exchange servers it becomes corrupted (there is no line:
Content-Transfer-Encoding: base64 for attachments in message source). If
  that mail goes only through Unix/Linux mail servers it come
uncorrupted to the destination.
I've upgraded MailScanner to 4.34 but it didn't help.

Regards,
Vlado

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 08:56:25 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3428.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 08:45 13/10/2004, you wrote:
>Hi!
>
>I am using MailScanner for 2 years now and it works very well. But I
>have found lately one strange problem in communications with MS exchange
>servers. It happens only when my users replying on some mail which
>contains one or more attachments (pdf, rtf...). If that replyed mail
>goes through MS exchange servers it becomes corrupted (there is no line:
>Content-Transfer-Encoding: base64 for attachments in message source). If
>  that mail goes only through Unix/Linux mail servers it come
>uncorrupted to the destination.
>I've upgraded MailScanner to 4.34 but it didn't help.

Did you upgrade the MIME-tools and MIME-Base64 as well? If not, it would
explain the symptoms you are seeing.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcin.rozek at IOS.EDU.PL  Wed Oct 13 09:08:40 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Ro¿ek)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3429.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:
> With the Conf vs Config typo corrected, is 4.35.3 working okay for the
> brave few of you who have tried it? I haven't heard any more reports of
> problems, so hopefully it is alright.
Yeah - all rpms now builds and installs fine on my Mandrake 10 Official.
Great work!

Regards,
Marcin
ps. rpm -q mailscanner shows mailscanner-4.35.3-1 but MailScanner -v shows
4.35.2. Is it right?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 09:08:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: 4.35.3 working okay?
Message-ID: <mailman.3430.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 09:08 13/10/2004, you wrote:
>Julian Field wrote:
>>With the Conf vs Config typo corrected, is 4.35.3 working okay for the
>>brave few of you who have tried it? I haven't heard any more reports of
>>problems, so hopefully it is alright.
>Yeah - all rpms now builds and installs fine on my Mandrake 10 Official.
>Great work!
>
>Regards,
>Marcin
>ps. rpm -q mailscanner shows mailscanner-4.35.3-1 but MailScanner -v shows
>4.35.2. Is it right?

I forgot to set the version number properly. Will be fixed in the next
release :-)
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike.norton at JOBSITE.CO.UK  Wed Oct 13 09:10:11 2004
From: mike.norton at JOBSITE.CO.UK (Mike Norton)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner errors
Message-ID: <mailman.3431.1137101234.24926.mailscanner@lists.mailscanner.info>

Hi,

I have just noticed this in the logs on one of our mailservers is this anything I should be worried about ? if so how do I correct this

Cannot parse /var/spool/MailScanner/incoming/27797/i9CIIUUt030730.header and , Can't locate object method "init" via package "MIME::Decoder::QuotedPrint" at /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 173.

 Cannot parse /var/spool/MailScanner/incoming/28135/i9CH9pUt029877.header and , Too many arguments for MIME::QuotedPrint::encode_qp at /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder/QuotedPrint.pm line 74, near "shift)"

Thanks

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 09:13:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner errors
Message-ID: <mailman.3432.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 09:10 13/10/2004, you wrote:
>Hi,
>
>I have just noticed this in the logs on one of our mailservers is this
>anything I should be worried about ? if so how do I correct this
>
>Cannot parse /var/spool/MailScanner/incoming/27797/i9CIIUUt030730.header
>and , Can't locate object method "init" via package
>"MIME::Decoder::QuotedPrint" at
>/usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 173.
>
>  Cannot parse /var/spool/MailScanner/incoming/28135/i9CH9pUt029877.header
> and , Too many arguments for MIME::QuotedPrint::encode_qp at
> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder/QuotedPrint.pm line 74, near
> "shift)"

The quick solution is to use CPAN to upgrade MIME-tools and MIME::Base64.
The longer solution involves the latest MailScanner beta and a couple of
edits. Try the quick solution first and come back here if it doesn't help.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vlado at AGENDA.SI  Wed Oct 13 09:25:58 2004
From: vlado at AGENDA.SI (Vladimir Nikolic)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3433.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have perl-MIME-Base64-3.05 and perl-MIME-tools-5.412 on my system.
That should be ok.

Julian Field wrote:
> At 08:45 13/10/2004, you wrote:
>
>> Hi!
>>
>> I am using MailScanner for 2 years now and it works very well. But I
>> have found lately one strange problem in communications with MS exchange
>> servers. It happens only when my users replying on some mail which
>> contains one or more attachments (pdf, rtf...). If that replyed mail
>> goes through MS exchange servers it becomes corrupted (there is no line:
>> Content-Transfer-Encoding: base64 for attachments in message source). If
>>  that mail goes only through Unix/Linux mail servers it come
>> uncorrupted to the destination.
>> I've upgraded MailScanner to 4.34 but it didn't help.
>
>
> Did you upgrade the MIME-tools and MIME-Base64 as well? If not, it would
> explain the symptoms you are seeing.
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 09:29:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3434.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In which case turn off "Sign Clean Messages" and see if the problem still
occurs.

At 09:25 13/10/2004, you wrote:
>I have perl-MIME-Base64-3.05 and perl-MIME-tools-5.412 on my system.
>That should be ok.
>
>Julian Field wrote:
>>At 08:45 13/10/2004, you wrote:
>>
>>>Hi!
>>>
>>>I am using MailScanner for 2 years now and it works very well. But I
>>>have found lately one strange problem in communications with MS exchange
>>>servers. It happens only when my users replying on some mail which
>>>contains one or more attachments (pdf, rtf...). If that replyed mail
>>>goes through MS exchange servers it becomes corrupted (there is no line:
>>>Content-Transfer-Encoding: base64 for attachments in message source). If
>>>  that mail goes only through Unix/Linux mail servers it come
>>>uncorrupted to the destination.
>>>I've upgraded MailScanner to 4.34 but it didn't help.
>>
>>
>>Did you upgrade the MIME-tools and MIME-Base64 as well? If not, it would
>>explain the symptoms you are seeing.
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vlado at AGENDA.SI  Wed Oct 13 09:37:56 2004
From: vlado at AGENDA.SI (Vladimir Nikolic)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3435.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have 'Sign Clean Messages = no' from the begining.
I've also tried with turning off all 'X-...' lines in message header but
that didn't help too.

Julian Field wrote:
> In which case turn off "Sign Clean Messages" and see if the problem still
> occurs.
>
> At 09:25 13/10/2004, you wrote:
>
>> I have perl-MIME-Base64-3.05 and perl-MIME-tools-5.412 on my system.
>> That should be ok.
>>
>> Julian Field wrote:
>>
>>> At 08:45 13/10/2004, you wrote:
>>>
>>>> Hi!
>>>>
>>>> I am using MailScanner for 2 years now and it works very well. But I
>>>> have found lately one strange problem in communications with MS
>>>> exchange
>>>> servers. It happens only when my users replying on some mail which
>>>> contains one or more attachments (pdf, rtf...). If that replyed mail
>>>> goes through MS exchange servers it becomes corrupted (there is no
>>>> line:
>>>> Content-Transfer-Encoding: base64 for attachments in message
>>>> source). If
>>>>  that mail goes only through Unix/Linux mail servers it come
>>>> uncorrupted to the destination.
>>>> I've upgraded MailScanner to 4.34 but it didn't help.
>>>
>>>
>>>
>>> Did you upgrade the MIME-tools and MIME-Base64 as well? If not, it would
>>> explain the symptoms you are seeing.
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> MailScanner thanks transtec Computers for their support
>>> Buy the MailScanner book at www.MailScanner.info/store
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 09:41:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3436.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In which case I'm not convinced it's a MailScanner problem. Note that
Outlook does encode PDF files incorrectly, and some other mail systems may
render them unusable due to this bug in Outlook. I expect the same
(incorrect) code is used in Exchange too, if you are connecting Outlook to
Exchange via MAPI.

At 09:37 13/10/2004, you wrote:
>I have 'Sign Clean Messages = no' from the begining.
>I've also tried with turning off all 'X-...' lines in message header but
>that didn't help too.
>
>Julian Field wrote:
>>In which case turn off "Sign Clean Messages" and see if the problem still
>>occurs.
>>
>>At 09:25 13/10/2004, you wrote:
>>
>>>I have perl-MIME-Base64-3.05 and perl-MIME-tools-5.412 on my system.
>>>That should be ok.
>>>
>>>Julian Field wrote:
>>>
>>>>At 08:45 13/10/2004, you wrote:
>>>>
>>>>>Hi!
>>>>>
>>>>>I am using MailScanner for 2 years now and it works very well. But I
>>>>>have found lately one strange problem in communications with MS
>>>>>exchange
>>>>>servers. It happens only when my users replying on some mail which
>>>>>contains one or more attachments (pdf, rtf...). If that replyed mail
>>>>>goes through MS exchange servers it becomes corrupted (there is no
>>>>>line:
>>>>>Content-Transfer-Encoding: base64 for attachments in message
>>>>>source). If
>>>>>  that mail goes only through Unix/Linux mail servers it come
>>>>>uncorrupted to the destination.
>>>>>I've upgraded MailScanner to 4.34 but it didn't help.
>>>>
>>>>
>>>>
>>>>Did you upgrade the MIME-tools and MIME-Base64 as well? If not, it would
>>>>explain the symptoms you are seeing.
>>>>--
>>>>Julian Field
>>>>www.MailScanner.info
>>>>MailScanner thanks transtec Computers for their support
>>>>Buy the MailScanner book at www.MailScanner.info/store
>>>>
>>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at BARENDSE.TO  Wed Oct 13 09:44:58 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3437.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Just a remark, I noticed that clam 0.80rc3 is also detecting phishing
e-mails as a virus.

I get virus reports from clam about phishing

On Tue, 12 Oct 2004, Julian Field wrote:

> Morning folks,
>
> I have written a Phishing fraud detector. It's not 100% perfect, but it
> should detect most of them. We are finding here that the SURBL phishing
> lists are far from complete, and we regularly get these coming through to
> our end-users.
>
> For those of you who don't know what phishing is....
>
> You get an email claiming to be from your bank / credit card company /
> utility company / whatever. It looks like a perfectly genuine email, it has
> their artwork, disclaimers, everything. There is some text in the message
> inviting you to click on a link in the message. The link looks quite
> normal, e.g. http://www.citibank.com/ or just www.citibank.com. They
> usually look like they want you to confirm security information, or
> re-register your account. But when you click on the link it doesn't take
> you to the bank's real website, it takes you to a plausible-sounding one
> that looks just like your bank's real website, but isn't. You type in
> confidential information of some sort, and the bad guys just managed to
> steal your information. Now they can steal your money and/or identity.
>
> MailScanner detects these and inserts some text into the message to
> highlight the possible fraud, and where it is coming from in reality.
> Please could all you translators out there please translate the following
> text into the language(s) of your choice? Please don't contribute
> translations you aren't 100% sure about, I have no way of telling whose
> translation into Spanish is the best, so probably best to post your
> translations to the list so we can agree on the best ones.
>
> #  Used in Phishing Fraud attack detections. The "End" must close all the
> #  HTML highlighting done in the "Start".
> PossibleFraudStart = <font color="red"><b>MailScanner has detected a
> possible fraud attempt from
> PossibleFraudEnd = </b></font>
>
> Thanks all!
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 09:52:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3438.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Any idea how it's doing it?

At 09:44 13/10/2004, you wrote:
>Just a remark, I noticed that clam 0.80rc3 is also detecting phishing
>e-mails as a virus.
>
>I get virus reports from clam about phishing

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vlado at AGENDA.SI  Wed Oct 13 09:56:31 2004
From: vlado at AGENDA.SI (Vladimir Nikolic)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3439.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ok, maybe you are right.
But that error doesn't have anything with Outlook because message source
is corrupted already on Exchange server. I get error also if I read that
mail with mozilla-mail, webmail...

Thanks
Vlado

Julian Field wrote:
> In which case I'm not convinced it's a MailScanner problem. Note that
> Outlook does encode PDF files incorrectly, and some other mail systems may
> render them unusable due to this bug in Outlook. I expect the same
> (incorrect) code is used in Exchange too, if you are connecting Outlook to
> Exchange via MAPI.
>
> At 09:37 13/10/2004, you wrote:
>
>> I have 'Sign Clean Messages = no' from the begining.
>> I've also tried with turning off all 'X-...' lines in message header but
>> that didn't help too.
>>
>> Julian Field wrote:
>>
>>> In which case turn off "Sign Clean Messages" and see if the problem
>>> still
>>> occurs.
>>>
>>> At 09:25 13/10/2004, you wrote:
>>>
>>>> I have perl-MIME-Base64-3.05 and perl-MIME-tools-5.412 on my system.
>>>> That should be ok.
>>>>
>>>> Julian Field wrote:
>>>>
>>>>> At 08:45 13/10/2004, you wrote:
>>>>>
>>>>>> Hi!
>>>>>>
>>>>>> I am using MailScanner for 2 years now and it works very well. But I
>>>>>> have found lately one strange problem in communications with MS
>>>>>> exchange
>>>>>> servers. It happens only when my users replying on some mail which
>>>>>> contains one or more attachments (pdf, rtf...). If that replyed mail
>>>>>> goes through MS exchange servers it becomes corrupted (there is no
>>>>>> line:
>>>>>> Content-Transfer-Encoding: base64 for attachments in message
>>>>>> source). If
>>>>>>  that mail goes only through Unix/Linux mail servers it come
>>>>>> uncorrupted to the destination.
>>>>>> I've upgraded MailScanner to 4.34 but it didn't help.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Did you upgrade the MIME-tools and MIME-Base64 as well? If not, it
>>>>> would
>>>>> explain the symptoms you are seeing.
>>>>> --
>>>>> Julian Field
>>>>> www.MailScanner.info
>>>>> MailScanner thanks transtec Computers for their support
>>>>> Buy the MailScanner book at www.MailScanner.info/store
>>>>>
>>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>>
>>>>> ------------------------ MailScanner list ------------------------
>>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>> 'leave mailscanner' in the body of the email.
>>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>
>>>
>>> --
>>> Julian Field
>>> www.MailScanner.info
>>> MailScanner thanks transtec Computers for their support
>>> Buy the MailScanner book at www.MailScanner.info/store
>>>
>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike.norton at JOBSITE.CO.UK  Wed Oct 13 09:52:23 2004
From: mike.norton at JOBSITE.CO.UK (Mike Norton)
Date: Thu Jan 12 21:27:14 2006
Subject: MailScanner errors
Message-ID: <mailman.3440.1137101234.24926.mailscanner@lists.mailscanner.info>

Thanks Julian,

Seems to have done the trick

Mike 

-----Original Message-----
From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK]
Sent: 13 October 2004 09:13
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner errors


At 09:10 13/10/2004, you wrote:
>Hi,
>
>I have just noticed this in the logs on one of our mailservers is this
>anything I should be worried about ? if so how do I correct this
>
>Cannot parse /var/spool/MailScanner/incoming/27797/i9CIIUUt030730.header
>and , Can't locate object method "init" via package
>"MIME::Decoder::QuotedPrint" at
>/usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 173.
>
>  Cannot parse /var/spool/MailScanner/incoming/28135/i9CH9pUt029877.header
> and , Too many arguments for MIME::QuotedPrint::encode_qp at
> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder/QuotedPrint.pm line 74, near
> "shift)"

The quick solution is to use CPAN to upgrade MIME-tools and MIME::Base64.
The longer solution involves the latest MailScanner beta and a couple of
edits. Try the quick solution first and come back here if it doesn't help.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 13 14:19:40 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:14 2006
Subject: Phishing Translators please?
Message-ID: <mailman.3441.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
John Wilcock wrote:

>On Tue, 12 Oct 2004 13:58:51 -0400, Denis Beauchemin wrote:
>  
>
>>Ugo and I finally agreed on:
>>PossibleFraudStart = <font color="red"><b>MailScanner soup&ccedil;onne 
>>ce message d'&ecirc;tre une tentative de fraude de la part de
>>PossibleFraudEnd = </b></font>
>>    
>>
>
>Except that this text is, if I understand things correctly, going to be
>inserted in the body of the message, immediately before the doubtful
>link itself. I'd suggest deleting "ce message d'être" from the above.
>
>John.
>
>  
>
John,

You are right...  then (supposing this message is inserted BEFORE the 
fraudulous link):

PossibleFraudStart = <font color="red"><b>MailScanner soup&ccedil;onne le lien suivant d'&ecirc;tre une tentative de fraude de la part de
PossibleFraudEnd = </b></font>


Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From Andrew.Magnusson at COCC.COM  Wed Oct 13 14:24:10 2004
From: Andrew.Magnusson at COCC.COM (Magnusson, Andrew)
Date: Thu Jan 12 21:27:14 2006
Subject: Found to be spam, but subject not modified?
Message-ID: <mailman.3442.1137101234.24926.mailscanner@lists.mailscanner.info>

This email (headers follow) was clearly spam, and the
X-MailScanner-SpamCheck header shows it was determined to be spam by
SpamAssassin as well as a blacklist. But the subject line was never
modified. Has anyone seen this particular issue? I took a look through the
archives but came up blank.

Most spam is properly tagged with {SPAM?} in the header, but not this one,
and several others we received this morning. Any ideas?

We're running MS 4.34.8, SA 3.0.

...
Received: from OUTGOING79.postalmailhostings.com (unknown [69.1.199.80])
        by xxxx.cocc.com (Postfix) with SMTP id 3E2E47D06B6
        for <MATTHEW.RICHARD@COCC.COM>; Wed, 13 Oct 2004 00:19:46 -0400
(EDT)
Date:Wed, 13 Oct 2004 00:19:45 -0700
From: K2Smokes <sorogers@OUTGOING79.emailaccountzip.com>
To: <MATTHEW.RICHARD@COCC.COM>
Subject:$12.99 American Marlboro Cartons
X-ID:1836957
Mime-Version:1.0
Content-type: text/plain
Content-Transfer-Encoding: 7bit
Message-Id: <20041013041946.3E2E47D06B6@xxxx.cocc.com>
X-MailScanner-cocci: Found to be clean, Found to be clean
X-MailScanner-SpamCheck-cocci: spam, SBL+XBL, SpamAssassin (score=14.289,
        required 7, autolearn=spam, BAYES_99 2.00, DNS_FROM_AHBL_RHSBL 0.29,
        HTML_50_60 0.09, HTML_FONT_BIG 0.14, HTML_FONT_SIZE_LARGE 0.15,
        HTML_MESSAGE 0.00, HTML_TEXT_AFTER_BODY 0.06,
        HTML_TEXT_AFTER_HTML 0.03, MIME_HTML_ONLY 0.18,
        MSGID_FROM_MTA_ID 1.72, RCVD_IN_SBL 0.11, RCVD_IN_SBLXBL 7.00,
        SUBJ_DOLLARS 0.05, URIBL_SBL 1.00, URIBL_WS_SURBL 1.46),
X-MailScanner-SpamScore-cocci: ssssssssssssss
X-MailScanner-Information-cocci: Please contact the ISP for more information
X-MailScanner-From: sorogers@outgoing79.emailaccountzip.com
...

Andrew Magnusson
Internet Product Analyst
COCC
1-877-678-0444 extension 640



--
*** This message originates from COCC, Inc.

If the reader of this message, regardless of the address or routing, is not an intended recipient, you are hereby notified that you have received this transmittal in error and any review; use, distribution, dissemination or copying is strictly prohibited.  If you have received this message in error, please delete this e-mail and all files transmitted with it from your system and immediately notify COCC, Inc. by sending reply e-mail to the sender of this message.

Thank you. ***

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 14:38:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: Found to be spam, but subject not modified?
Message-ID: <mailman.3443.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It's got a faulty Subject line. There should always be a space after the
word "Subject:". There isn't in this one.
I'll make the code more tolerant for the next release.

At 14:24 13/10/2004, you wrote:
>This email (headers follow) was clearly spam, and the
>X-MailScanner-SpamCheck header shows it was determined to be spam by
>SpamAssassin as well as a blacklist. But the subject line was never
>modified. Has anyone seen this particular issue? I took a look through the
>archives but came up blank.
>
>Most spam is properly tagged with {SPAM?} in the header, but not this one,
>and several others we received this morning. Any ideas?
>
>We're running MS 4.34.8, SA 3.0.
>
>...
>Received: from OUTGOING79.postalmailhostings.com (unknown [69.1.199.80])
>         by xxxx.cocc.com (Postfix) with SMTP id 3E2E47D06B6
>         for <MATTHEW.RICHARD@COCC.COM>; Wed, 13 Oct 2004 00:19:46 -0400
>(EDT)
>Date:Wed, 13 Oct 2004 00:19:45 -0700
>From: K2Smokes <sorogers@OUTGOING79.emailaccountzip.com>
>To: <MATTHEW.RICHARD@COCC.COM>
>Subject:$12.99 American Marlboro Cartons
>X-ID:1836957
>Mime-Version:1.0
>Content-type: text/plain
>Content-Transfer-Encoding: 7bit
>Message-Id: <20041013041946.3E2E47D06B6@xxxx.cocc.com>
>X-MailScanner-cocci: Found to be clean, Found to be clean
>X-MailScanner-SpamCheck-cocci: spam, SBL+XBL, SpamAssassin (score=14.289,
>         required 7, autolearn=spam, BAYES_99 2.00, DNS_FROM_AHBL_RHSBL 0.29,
>         HTML_50_60 0.09, HTML_FONT_BIG 0.14, HTML_FONT_SIZE_LARGE 0.15,
>         HTML_MESSAGE 0.00, HTML_TEXT_AFTER_BODY 0.06,
>         HTML_TEXT_AFTER_HTML 0.03, MIME_HTML_ONLY 0.18,
>         MSGID_FROM_MTA_ID 1.72, RCVD_IN_SBL 0.11, RCVD_IN_SBLXBL 7.00,
>         SUBJ_DOLLARS 0.05, URIBL_SBL 1.00, URIBL_WS_SURBL 1.46),
>X-MailScanner-SpamScore-cocci: ssssssssssssss
>X-MailScanner-Information-cocci: Please contact the ISP for more information
>X-MailScanner-From: sorogers@outgoing79.emailaccountzip.com
>...
>
>Andrew Magnusson
>Internet Product Analyst
>COCC
>1-877-678-0444 extension 640
>
>
>
>--
>*** This message originates from COCC, Inc.
>
>If the reader of this message, regardless of the address or routing, is
>not an intended recipient, you are hereby notified that you have received
>this transmittal in error and any review; use, distribution, dissemination
>or copying is strictly prohibited.  If you have received this message in
>error, please delete this e-mail and all files transmitted with it from
>your system and immediately notify COCC, Inc. by sending reply e-mail to
>the sender of this message.
>
>Thank you. ***
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 14:44:44 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:14 2006
Subject: Found to be spam, but subject not modified?
Message-ID: <mailman.3444.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What MTA are you using? Most of the header manipulation code is pretty
tolerant of errors already.

However, if you are using Postfix, then find
/usr/lib/MailScanner/MailScanner/Postfix.pm and edit it. On line 690 you
should find this:
     $message->{metadata}[$oldlocation] =~ s/^N$key\s+/N$key $newvalue$sep/i;
Change this to read
     $message->{metadata}[$oldlocation] =~ s/^N$key\s*/N$key $newvalue$sep/i;

At 14:24 13/10/2004, you wrote:
>This email (headers follow) was clearly spam, and the
>X-MailScanner-SpamCheck header shows it was determined to be spam by
>SpamAssassin as well as a blacklist. But the subject line was never
>modified. Has anyone seen this particular issue? I took a look through the
>archives but came up blank.
>
>Most spam is properly tagged with {SPAM?} in the header, but not this one,
>and several others we received this morning. Any ideas?
>
>We're running MS 4.34.8, SA 3.0.
>
>...
>Received: from OUTGOING79.postalmailhostings.com (unknown [69.1.199.80])
>         by xxxx.cocc.com (Postfix) with SMTP id 3E2E47D06B6
>         for <MATTHEW.RICHARD@COCC.COM>; Wed, 13 Oct 2004 00:19:46 -0400
>(EDT)
>Date:Wed, 13 Oct 2004 00:19:45 -0700
>From: K2Smokes <sorogers@OUTGOING79.emailaccountzip.com>
>To: <MATTHEW.RICHARD@COCC.COM>
>Subject:$12.99 American Marlboro Cartons

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Uwe.Krause at FEP.FRAUNHOFER.DE  Wed Oct 13 13:24:51 2004
From: Uwe.Krause at FEP.FRAUNHOFER.DE (Krause, Dr. Uwe)
Date: Thu Jan 12 21:27:14 2006
Subject: antivir-autoupdate broken ?
Message-ID: <mailman.3445.1137101234.24926.mailscanner@lists.mailscanner.info>

Hello,

since a while i read this in my logfile :

Oct 13 14:19:25 server AntiVir-autoupdate[1927]: AntiVir updater
/usr/lib/AntiVir/antivir --update cannot be run 


but update manually works fine for me :

server # /usr/lib/AntiVir/antivir --update
AntiVir / Linux Version 2.1.2-2 +gui
Copyright (c) 1994-2004 by H+BEDV Datentechnik GmbH.
All rights reserved.

checking for updates

06.28.00.13 <=> 06.28.00.13 [vdf database, loaded]
06.28.00.07 <=> 06.28.00.07 [scan engine, running]
02.01.02.02 <=> 02.01.02.02 [main program, running]

AntiVir is up-to-date


any hints ?

Uwe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Wed Oct 13 16:41:08 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:14 2006
Subject: RBL-Online lists
Message-ID: <mailman.3446.1137101234.24926.mailscanner@lists.mailscanner.info>

Hi there,

does anyone know of an website or a list containing (allmost) all RBL and
how to check if some ip is in there?

I found:

http://rbls.org/

and of course spamhaus.org

are there more?

Thanks in advance



Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From David.While at UCE.AC.UK  Wed Oct 13 16:47:26 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:14 2006
Subject: RBL-Online lists
Message-ID: <mailman.3447.1137101234.24926.mailscanner@lists.mailscanner.info>

Try www.dnsstuff.com that checks 150+ RBLs 
--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
-------------------------------------------- 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Marcel Blenkers
Sent: 13 October 2004 16:41
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: RBL-Online lists

Hi there,

does anyone know of an website or a list containing (allmost) all RBL
and
how to check if some ip is in there?

I found:

http://rbls.org/

and of course spamhaus.org

are there more?

Thanks in advance



Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Wed Oct 13 16:48:30 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:14 2006
Subject: RBL-Online lists
Message-ID: <mailman.3448.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:41 AM 10/13/2004, Marcel Blenkers wrote:
>does anyone know of an website or a list containing (allmost) all RBL and
>how to check if some ip is in there?
>
>I found:
>
>http://rbls.org/

Here's two I use:

         http://www.dnsstuff.com/ (has "spam database lookup" along with
other handy DNS tools)

         http://www.openrbl.org/ (query rate limited, but has very good,
highly detailed reports)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hermit921 at YAHOO.COM  Wed Oct 13 17:06:51 2004
From: hermit921 at YAHOO.COM (hermit921)
Date: Thu Jan 12 21:27:14 2006
Subject: RBL-Online lists
Message-ID: <mailman.3449.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Try this one:
http://www.dnsstuff.com/

hermit921


At 08:41 AM 10/13/2004, Marcel Blenkers wrote:
>does anyone know of an website or a list containing (allmost) all RBL and
>how to check if some ip is in there?
>
>I found:
>
>http://rbls.org/
>
>and of course spamhaus.org
>
>are there more?
>
>Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Kevin_Miller at CI.JUNEAU.AK.US  Wed Oct 13 18:04:15 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:14 2006
Subject: trouble with exchange servers
Message-ID: <mailman.3450.1137101234.24926.mailscanner@lists.mailscanner.info>

Vladimir Nikolic wrote:
> Ok, maybe you are right.
> But that error doesn't have anything with Outlook because message
> source is corrupted already on Exchange server. I get error also if I
> read that mail with mozilla-mail, webmail...

Don't know if it's the same/similar problem or not, but recently a fellow at
another company called me saying that they couldn't read certain attachments
from us.  He didn't specify what they were, but most likely .pdf, and
autocad drawings if memory serves, given the nature of our relationship with
them.  I did some poking around in Exchange (version 5.5) and I think I
fixed the problem.  I left a voice mail for him and he never called me back
anyway so no news is good news I guess.

Anyway, go into Exchange Administrator, go to <site>, Protocols and right
click then select Properties.  Go to the MIME Types tab.  There you can
adjust what MIME Type is associated with specific file extensions.  I had to
add:

 image/vnd.dwg  dwg
 image/vnd.dxf  dxf

and a few others. I googled for mime type associations to find out the
appropriate entries.

Like I said, I don't know if this is the fix for the problem you're seeing
or not, but maybe it'll be of some help to you or others.  Hope so...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rob at THEHOSTMASTERS.COM  Wed Oct 13 18:59:12 2004
From: rob at THEHOSTMASTERS.COM (Rob)
Date: Thu Jan 12 21:27:14 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3451.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<META content="MSHTML 6.00.2900.2180" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I guess at some time I must have not allowed .exe 
in a .zip file???</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>But I need to allow this... in the filename rules I 
do not see anything to modify other than allow .exe but I want .exe to be denied 
but not in a zip....</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Any help appreciated...</FONT></DIV><FONT 
face=Arial size=2>
<DIV><BR>Rob....</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR></FONT>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mspieth at NEOD.NET  Wed Oct 13 19:08:36 2004
From: mspieth at NEOD.NET (Mark Spieth)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3452.1137101234.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">




<meta name=Generator content="Microsoft Word 10 (filtered)">

<style>
<!--
 /* Font Definitions */
 @font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
p
        {margin-right:0in;
        margin-left:0in;
        font-size:12.0pt;
        font-family:"Times New Roman";}
span.EmailStyle17
        {font-family:Arial;
        color:navy;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body bgcolor=white lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Maximum Archive Depth = 0 in your Mailscanner.conf
will tell the system not to look into the zip files.</span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>&nbsp;</span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>&nbsp;</span></font></p>

<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>&nbsp;</span></font></p>

<div>

<p style='margin:0in;margin-bottom:.0001pt'><font size=2 color=navy
 face="Times New Roman"><span style='font-size:10.0pt;color:navy'>Mark Spieth</span></font><font
size=2 color=navy><span style='font-size:10.0pt;color:navy'> - Director of
Internet Services</span></font></p>

<p style='margin:0in;margin-bottom:.0001pt'><font size=2 color=navy
face="Times New Roman"><span style='font-size:10.0pt;color:navy'>Northeast Ohio
Digital Inc.</span></font></p>

<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=navy
face="Times New Roman"><span style='font-size:12.0pt;color:navy'><a
href="http://www.neod.net/"></span></font><font size=2><span style='font-size:10.0pt'>http://www.neod.net</a></span></font></p>

<p style='margin:0in;margin-bottom:.0001pt'><font size=2 color=navy
face="Times New Roman"><span style='font-size:10.0pt;color:navy'>mspieth@neod.net</span></font></p>

<p style='margin:0in;margin-bottom:.0001pt'><font size=2 color=navy
face="Times New Roman"><span style='font-size:10.0pt;color:navy'>330-830-6551</span></font></p>

<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=navy
face="Times New Roman"><span style='font-size:12.0pt;color:navy'>&nbsp;</span></font></p>

<p style='margin:0in;margin-bottom:.0001pt'><font size=2 color=navy
face="Times New Roman"><span style='font-size:10.0pt;color:navy'>CONFIDENTIALITY
NOTICE: The materials attached hereto are confidential and the property of the
sender. The information contained in the attached materials is privileged
and/or confidential and is intended only for the use of the above-named
individual(s) or entity(ies). If you are not the intended recipient, be advised
that any unauthorized disclosure, copying, distribution or the taking of any
action in reliance on the contents of the attached information is strictly
prohibited. If you have received this transmission in error, please discard the
information immediately</span></font></p>

</div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Tahoma><span
style='font-size:10.0pt;font-family:Tahoma'>-----Original Message-----<br>
<b><span style='font-weight:bold'>From:</span></b> Rob
[mailto:rob@THEHOSTMASTERS.COM] <br>
<b><span style='font-weight:bold'>Sent:</span></b> </span></font><font size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>Wednesday,
 October 13, 2004</span></font><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma'> </span></font><font size=2 face=Tahoma><span
 style='font-size:10.0pt;font-family:Tahoma'>1:59 PM</span></font><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'><br>
<b><span style='font-weight:bold'>To:</span></b> MAILSCANNER@JISCMAIL.AC.UK<br>
<b><span style='font-weight:bold'>Subject:</span></b> .exe in zip getting
rejected...</span></font></p>

<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>&nbsp;</span></font></p>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>I guess at some time I must have not
allowed .exe in a .zip file???</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>&nbsp;</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>But I need to allow this... in the
filename rules I do not see anything to modify other than allow .exe but I want
.exe to be denied but not in a zip....</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=3 face="Times New Roman"><span
style='font-size:12.0pt'>&nbsp;</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>Any help appreciated...</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><br>
Rob....</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>&nbsp;</span></font></p>

</div>

<div>

<p class=MsoNormal style='margin-left:.5in'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'><br>
</span></font>&nbsp;</p>

</div>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mike at CAMAROSS.NET  Wed Oct 13 19:20:09 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3453.1137101235.24926.mailscanner@lists.mailscanner.info>

Rob wrote:
> I guess at some time I must have not allowed .exe in a .zip file???
>
>
>
> But I need to allow this... in the filename rules I do not see
> anything to modify other than allow .exe but I want .exe to be denied
> but not in a zip....
>
>
>
> Any help appreciated...
>
>
> Rob....
>
>

________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Mark Spieth Sent: Wednesday, October 13, 2004 1:09 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: .exe in zip getting rejected...



Maximum Archive Depth = 0 in your Mailscanner.conf will tell the system
not to look into the zip files.







Mark Spieth - Director of Internet Services

Northeast Ohio Digital Inc.

http://www.neod.net <http://www.neod.net/>

mspieth@neod.net

330-830-6551

________________________________

What does this do in case the .zip file is infected?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greg at BLASTZONE.COM  Wed Oct 13 19:22:03 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:15 2006
Subject: Found to be spam, but subject not modified?
Message-ID: <mailman.3454.1137101235.24926.mailscanner@lists.mailscanner.info>

I see this occasionally, but assumed it was a missing subject line or
something like that

> This email (headers follow) was clearly spam, and the
> X-MailScanner-SpamCheck header shows it was determined to be
> spam by SpamAssassin as well as a blacklist. But the subject
> line was never modified. Has anyone seen this particular
> issue? I took a look through the archives but came up blank.
>
> Most spam is properly tagged with {SPAM?} in the header, but
> not this one, and several others we received this morning. Any ideas?
>
> We're running MS 4.34.8, SA 3.0.
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From tonioli at gmail.com  Wed Oct 13 19:27:34 2004
From: tonioli at gmail.com (Felipe Tonioli)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3455.1137101235.24926.mailscanner@lists.mailscanner.info>

But will be scanned by antivirus ? or will be allowed to go ?


On Wed, 13 Oct 2004 13:20:09 -0500, Mike Kercher <mike@camaross.net> wrote:
> Rob wrote:
> > I guess at some time I must have not allowed .exe in a .zip file???
> >
> >
> >
> > But I need to allow this... in the filename rules I do not see
> > anything to modify other than allow .exe but I want .exe to be denied
> > but not in a zip....
> >
> >
> >
> > Any help appreciated...
> >
> >
> > Rob....
> >
> >
>
> ________________________________
>
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mark Spieth Sent: Wednesday, October 13, 2004 1:09 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: .exe in zip getting rejected...
>
> Maximum Archive Depth = 0 in your Mailscanner.conf will tell the system
> not to look into the zip files.
>
> Mark Spieth - Director of Internet Services
>
> Northeast Ohio Digital Inc.
>
> http://www.neod.net <http://www.neod.net/>
>
> mspieth@neod.net
>
> 330-830-6551
>
> ________________________________
>
> What does this do in case the .zip file is infected?
>
> Mike
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>


--
Felipe Tonioli

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rob at THEHOSTMASTERS.COM  Wed Oct 13 19:29:22 2004
From: rob at THEHOSTMASTERS.COM (Rob)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3456.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I want it to be scanned but just not denied just because its an .exe in a
.zip file..



Rob....



----- Original Message -----
From: "Felipe Tonioli" <tonioli@gmail.com>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 13, 2004 2:27 PM
Subject: Re: .exe in zip getting rejected...


> But will be scanned by antivirus ? or will be allowed to go ?
>
>
> On Wed, 13 Oct 2004 13:20:09 -0500, Mike Kercher <mike@camaross.net>
> wrote:
>> Rob wrote:
>> > I guess at some time I must have not allowed .exe in a .zip file???
>> >
>> >
>> >
>> > But I need to allow this... in the filename rules I do not see
>> > anything to modify other than allow .exe but I want .exe to be denied
>> > but not in a zip....
>> >
>> >
>> >
>> > Any help appreciated...
>> >
>> >
>> > Rob....
>> >
>> >
>>
>> ________________________________
>>
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> Behalf Of Mark Spieth Sent: Wednesday, October 13, 2004 1:09 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: .exe in zip getting rejected...
>>
>> Maximum Archive Depth = 0 in your Mailscanner.conf will tell the system
>> not to look into the zip files.
>>
>> Mark Spieth - Director of Internet Services
>>
>> Northeast Ohio Digital Inc.
>>
>> http://www.neod.net <http://www.neod.net/>
>>
>> mspieth@neod.net
>>
>> 330-830-6551
>>
>> ________________________________
>>
>> What does this do in case the .zip file is infected?
>>
>> Mike
>>
>>
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>
> --
> Felipe Tonioli
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 19:57:06 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3457.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It will still be scanned for viruses.

At 19:29 13/10/2004, you wrote:
>I want it to be scanned but just not denied just because its an .exe in a
>.zip file..
>
>
>
>Rob....
>
>
>
>----- Original Message -----
>From: "Felipe Tonioli" <tonioli@gmail.com>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Wednesday, October 13, 2004 2:27 PM
>Subject: Re: .exe in zip getting rejected...
>
>
>>But will be scanned by antivirus ? or will be allowed to go ?
>>
>>
>>On Wed, 13 Oct 2004 13:20:09 -0500, Mike Kercher <mike@camaross.net>
>>wrote:
>>>Rob wrote:
>>> > I guess at some time I must have not allowed .exe in a .zip file???
>>> >
>>> >
>>> >
>>> > But I need to allow this... in the filename rules I do not see
>>> > anything to modify other than allow .exe but I want .exe to be denied
>>> > but not in a zip....
>>> >
>>> >
>>> >
>>> > Any help appreciated...
>>> >
>>> >
>>> > Rob....
>>> >
>>> >
>>>
>>>________________________________
>>>
>>>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>>>Behalf Of Mark Spieth Sent: Wednesday, October 13, 2004 1:09 PM
>>>To: MAILSCANNER@JISCMAIL.AC.UK
>>>Subject: Re: .exe in zip getting rejected...
>>>
>>>Maximum Archive Depth = 0 in your Mailscanner.conf will tell the system
>>>not to look into the zip files.
>>>
>>>Mark Spieth - Director of Internet Services
>>>
>>>Northeast Ohio Digital Inc.
>>>
>>>http://www.neod.net <http://www.neod.net/>
>>>
>>>mspieth@neod.net
>>>
>>>330-830-6551
>>>
>>>________________________________
>>>
>>>What does this do in case the .zip file is infected?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rob at THEHOSTMASTERS.COM  Wed Oct 13 19:59:04 2004
From: rob at THEHOSTMASTERS.COM (Rob)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3458.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
ok, cool,  thanks guys.....

;)

Rob....



----- Original Message -----
From: "Julian Field" <jkf@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 13, 2004 2:56 PM
Subject: Re: .exe in zip getting rejected...


> It will still be scanned for viruses. Don't worry.
>
> At 19:27 13/10/2004, you wrote:
>>But will be scanned by antivirus ? or will be allowed to go ?
>>
>>
>>On Wed, 13 Oct 2004 13:20:09 -0500, Mike Kercher <mike@camaross.net>
>>wrote:
>> > Rob wrote:
>> > > I guess at some time I must have not allowed .exe in a .zip file???
>> > >
>> > >
>> > >
>> > > But I need to allow this... in the filename rules I do not see
>> > > anything to modify other than allow .exe but I want .exe to be denied
>> > > but not in a zip....
>> > >
>> > >
>> > >
>> > > Any help appreciated...
>> > >
>> > >
>> > > Rob....
>> > >
>> > >
>> >
>> > ________________________________
>> >
>> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> > Behalf Of Mark Spieth Sent: Wednesday, October 13, 2004 1:09 PM
>> > To: MAILSCANNER@JISCMAIL.AC.UK
>> > Subject: Re: .exe in zip getting rejected...
>> >
>> > Maximum Archive Depth = 0 in your Mailscanner.conf will tell the system
>> > not to look into the zip files.
>> > ________________________________
>> >
>> > What does this do in case the .zip file is infected?
>> >
>> > Mike
>
> --
> Julian Field                Teaching Systems Manager
> jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
> Tel. 023 8059 2817          University of Southampton
>                             Southampton SO17 1BJ
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ELKNET.NET  Wed Oct 13 21:06:04 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:15 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3459.1137101235.24926.mailscanner@lists.mailscanner.info>

On Tue, 5 Oct 2004 15:14:24 -0400, Matt Kettler <mkettler@EVI-INC.COM> wrote:

Thanks for the additional input. Unfortunatly, my grep did not show that I
had a pre-release... Here is the output of the grep:
20_dnsbl_tests.cf:header NO_DNS_FOR_FROM eval:check_dns_sender()
20_dnsbl_tests.cf:describe NO_DNS_FOR_FROM Envelope sender has no MX or A
DNS records
20_dnsbl_tests.cf:tflags NO_DNS_FOR_FROM net
30_text_de.cf:lang de describe NO_DNS_FOR_FROM Domain der Absendeadresse
nicht im DNS registriert (kein MX/A Eintrag)
30_text_fr.cf:lang fr describe NO_DNS_FOR_FROM Adresse From: inconnue en DNS
(pas d'enregistrement MX)
30_text_nl.cf:lang nl describe NO_DNS_FOR_FROM Domein in Van heeft geen MX
of A DNS record
30_text_pl.cf:lang pl describe NO_DNS_FOR_FROM Domena w nag³ówku Do: nie
posiada wpisu w DNS (MX lub A)
50_scores.cf:score NO_DNS_FOR_FROM 0 1.1 0 1.6

So I'm still in search of an answer :(

>It would appear there was a bug, but Dan Q tried to fix it before releasing
>SA 3.0 final.
>In which Dan Q tried to fix NO_DNS_FOR_FROM prior to 3.0's release.
>
>I'd double-check to make sure you've got a fully final copy of SA 3.0, not
>a release candidate.
>
>grep NO_DNS_FOR_FROM /usr/share/spamassassin/*.cf
>
>Should return these lines:
>
>20_dnsbl_tests.cf:header NO_DNS_FOR_FROM                eval:check_dns_sender()
>20_dnsbl_tests.cf:describe NO_DNS_FOR_FROM      Envelope sender has no MX
>or A DNS records
>20_dnsbl_tests.cf:tflags NO_DNS_FOR_FROM                net
>30_text_de.cf:lang de describe NO_DNS_FOR_FROM Domain der Absendeadresse
>nicht im DNS registriert (kein MX/A Eintrag)
>30_text_fr.cf:lang fr describe NO_DNS_FOR_FROM  Adresse From: inconnue en
>DNS (pas d'enregistrement MX)
>30_text_nl.cf:lang nl describe NO_DNS_FOR_FROM                 Domein in
>Van heeft geen MX of A DNS record
>30_text_pl.cf:lang pl describe NO_DNS_FOR_FROM
>
>
>
>If you see this line:
>
>20_head_tests.cf header NO_DNS_FOR_FROM         eval:check_for_from_dns()
>
>You've got rules from an outdated release. I know the old code was in pre4
>and earlier, and not in rc3 and later, but I don't have copies of rc1 and
>rc2 on hand to check those.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From combs at magnet.fsu.edu  Wed Oct 13 21:28:27 2004
From: combs at magnet.fsu.edu (Tom Combs)
Date: Thu Jan 12 21:27:15 2006
Subject: MS 4.34.8-1 to 4.34.8-4 no new conf files
Message-ID: <mailman.3460.1137101235.24926.mailscanner@lists.mailscanner.info>

Hi,

  I just upgraded from MS 4.34.8-1 to MS 4.34.8-1 using the rpm
  distribution on a RHEL 3.0 system and I have no new
  MailScanner.conf.rpmnew file or another *rpmnew files.

  Is this to be expected since it was such a minor upgrade or
  does this indicate something went wrong?

  Thanks!

--
Tom Combs                                      E-mail: combs@magnet.fsu.edu
National High Magnetic Field Laboratory        Phone:  (850) 644-1657
1800 E. Paul Dirac Drive                       Tallahassee, FL 32310

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 13 21:33:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: MS 4.34.8-1 to 4.34.8-4 no new conf files
Message-ID: <mailman.3461.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It was just a rebuild (which is why only the build number changed) and so
there were no new config options at all.
Nothing went wrong.

At 21:28 13/10/2004, you wrote:
>Hi,
>
>   I just upgraded from MS 4.34.8-1 to MS 4.34.8-1 using the rpm
>   distribution on a RHEL 3.0 system and I have no new
>   MailScanner.conf.rpmnew file or another *rpmnew files.
>
>   Is this to be expected since it was such a minor upgrade or
>   does this indicate something went wrong?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jkf at ecs.soton.ac.uk  Wed Oct 13 19:56:29 2004
From: jkf at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: .exe in zip getting rejected...
Message-ID: <mailman.3462.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It will still be scanned for viruses. Don't worry.

At 19:27 13/10/2004, you wrote:
>But will be scanned by antivirus ? or will be allowed to go ?
>
>
>On Wed, 13 Oct 2004 13:20:09 -0500, Mike Kercher <mike@camaross.net> wrote:
> > Rob wrote:
> > > I guess at some time I must have not allowed .exe in a .zip file???
> > >
> > >
> > >
> > > But I need to allow this... in the filename rules I do not see
> > > anything to modify other than allow .exe but I want .exe to be denied
> > > but not in a zip....
> > >
> > >
> > >
> > > Any help appreciated...
> > >
> > >
> > > Rob....
> > >
> > >
> >
> > ________________________________
> >
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Mark Spieth Sent: Wednesday, October 13, 2004 1:09 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: .exe in zip getting rejected...
> >
> > Maximum Archive Depth = 0 in your Mailscanner.conf will tell the system
> > not to look into the zip files.
> > ________________________________
> >
> > What does this do in case the .zip file is infected?
> >
> > Mike

--
Julian Field                Teaching Systems Manager
jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Wed Oct 13 21:37:35 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:15 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3463.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:06 PM 10/13/2004, Alan wrote:
>Thanks for the additional input. Unfortunatly, my grep did not show that I
>had a pre-release... Here is the output of the grep:
<snip>


>So I'm still in search of an answer :(
>
> >It would appear there was a bug, but Dan Q tried to fix it before releasing
> >SA 3.0 final.

Hmm.. question for you.. Can you run a message through spamassassin -D?

Specifically I'm looking for "cannot trust envelope-from" debug messages.

After doing some digging, SA 3.0 only applies this test to "envelope" type
headers... X-Sender,X-Envelope-From, Return-Path, Envelope-Sender.


One thing you might consider changing, providing you don't depend on the
header, is in MailScanner.conf:

         #Envelope From Header = X-MailScanner-From:
         Envelope From Header = X-Envelope-From:

SA doesn't recognize the default setting, but does recognize X-Envelope-From.

Optionally you could try patching PerMsgStatus.pm to recognize
X-MailScanner-From, but that's a bit silly.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sanjay.patel at REXWIRE.COM  Wed Oct 13 21:43:26 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:15 2006
Subject: How the heck does this make it through
Message-ID: <mailman.3464.1137101235.24926.mailscanner@lists.mailscanner.info>

Lipitor, Lipitor, Lipitor, Prozac, Cialis, Meridia and more!
http://phlul.beatypeople.biz/

Doesn't this call to be tagged as spam? IT only scored a 3. I am using rbl's
and spamassassin 3.0


SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Wed Oct 13 22:01:47 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:15 2006
Subject: How the heck does this make it through
Message-ID: <mailman.3465.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:43 PM 10/13/2004, Sanjay K. Patel wrote:
>Doesn't this call to be tagged as spam? IT only scored a 3. I am using rbl's
>and spamassassin 3.0

Care to provide a list of hits? Otherwise all we can do is theorize blindly
with no clue what the problem is.

Your message scored an 11.7 on my system. But why it scored so high on
mine, and low on yours, isn't clear unless you look at the list of rules
that hit.

Using 2.64, antidrug, razor and Mail::SpamCopURI:

X-EVI-MailScanner-SpamCheck: spam, SpamAssassin (score=11.567, required 5,
         BIZ_TLD 0.10, DRUGS_DEPRESSION 0.01, DRUGS_DEPR_EREC 1.00,
         DRUGS_DIET 0.01, DRUGS_DIET_EREC 1.00, DRUGS_ERECTILE 1.00,
         OB_URI_RBL 2.10, RAZOR2_CF_RANGE_51_100 0.20, RAZOR2_CHECK 1.05,
         SPAMCOP_URI_RBL 3.00, WS_URI_RBL 2.10)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From BBerglund at TECHPRO.COM  Wed Oct 13 22:20:13 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3466.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone know 
exactly how to get Postfix running on a Linux box to connect to an Imail server 
and Active Directory servers else where?<BR></FONT></SPAN></DIV>
<DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem to 
connect to the local imail box using the ldap connection. </FONT></SPAN></DIV>
<DIV><SPAN class=190191921-13102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
help?<BR></DIV></FONT></SPAN>
<DIV>&nbsp;</DIV>
<DIV align=left>
<MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=3 direction=right behavior=slide loop=1 border="0">
<TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD>
      <DIV 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
      Berglund</DIV></TD>
    <TD></TD></TR>
  <TR>
    <TD>
      <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
      href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
<BR>
<MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=5 behavior=slide loop=1 border="2">
<TABLE cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
      src="cid:190191921@13102004-1E18" width=110 border=0></A></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
      Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
      Boulevard<BR>Geneva, IL 60134 
</TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
<BR>
<TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD align=right colSpan=2><A 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
      href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
      m</A><BR></TD></TR></TBODY></TABLE>
<DIV style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
<DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
e-mail and any accompanying documents is confidential, may be privileged, and is 
intended solely for the person and/or entity to whom it is addressed (i.e. those 
identified in the "To" and "Cc" box). They are the property of TechPro, Inc. 
Unauthorized review, use, disclosure, or copying of this communication, or any 
part thereof, is strictly prohibited and may be unlawful. If you have received 
this e-mail in error, please return the e-mail and attachments to the sender and 
delete the e-mail and attachments and any copy from your system. TechPro, Inc. 
Thank you for your cooperation.</SPAN> </DIV>
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo.gif: 00000001,7221c2ce,00000000,00000000

From chardlist at CHARD.NET  Wed Oct 13 23:14:48 2004
From: chardlist at CHARD.NET (Brendan Chard)
Date: Thu Jan 12 21:27:15 2006
Subject: Scanning Order
Message-ID: <mailman.3467.1137101235.24926.mailscanner@lists.mailscanner.info>

Is there a way to have the Virus and Content scanning happen before the Spam
scanning?

I've just got MailWatch installed so now I have my low scoring spam going to
quarantine.  Problem is, some virus messages are getting quarantined as spam
before they get nailed and deleted as a virus.  This throws off my mail
stats (%ham %spam %virus) and also puts messages that are really viruses
into quarantine.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct 13 23:59:56 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:15 2006
Subject: Scanning Order
Message-ID: <mailman.3468.1137101235.24926.mailscanner@lists.mailscanner.info>

> Is there a way to have the Virus and Content scanning happen before
> the Spam scanning?

Join the queue! Now get back to the end of the line

:)

I've been annoying Julian about this on a monthly basis :)

M


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jeff.Mills at POCOLD.COM.AU  Thu Oct 14 01:08:35 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:15 2006
Subject: Can't locate MIME/Decoder/BinHex.pm
Message-ID: <mailman.3469.1137101235.24926.mailscanner@lists.mailscanner.info>

Hi all,
I currently have MailScanner version 4.34.8 working fine:
angry opt # ln -s MailScanner-4.33.3 MailScanner
angry opt # cd MailScanner/bin
angry bin # ./MailScanner --version
Running on
Linux angry 2.6.8-gentoo-r7 #1 Mon Oct 11 12:35:08 EST 2004 i686 AMD Athlon(tm) processor AuthenticAMD GNU/Linux
This is Perl version 5.008004 (5.8.4)
This is MailScanner version 4.33.3
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.02    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.12    File::Temp
1.27    HTML::Entities
3.34    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.00    MIME::Base64
5.403   MIME::Decoder
5.403   MIME::Decoder::UU
5.403   MIME::Head
5.406   MIME::Parser
5.411   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime
Optional module versions are:
2.64    Mail::SpamAssassin
0.31    Net::LDAP
missing SAVI
missing Mail::ClamAV
0.40    Net::DNS

I tried to install the latest stable version 4.34.8, but I receive an error when I try to run MailScanner:

angry bin # ./MailScanner --version
Can't locate MIME/Decoder/BinHex.pm in @INC (@INC contains: /opt/MailScanner/lib /etc/perl /usr/lib/perl5/site_perl/5.8.4/i686-linux /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.4/i686-linux /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.2/i686-linux /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.4/i686-linux /usr/lib/perl5/5.8.4 /usr/local/lib/site_perl /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 . /opt/MailScanner/lib) at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
BEGIN failed--compilation aborted at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
Compilation failed in require at ./MailScanner line 52.
BEGIN failed--compilation aborted at ./MailScanner line 52.

I did a search of the archives and found that this message may be related to MIME-tools, so I uninstalled my copy and downloaded the one from the MailScanner page.
All the tests seemed to run fine and it installed properly:
angry MIME-tools-5.411 # make test
PERL_DL_NONLAZY=1 /usr/bin/perl5.8.4 "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
t/Body...........ok
t/Decoder........ok
t/Entity.........ok
t/Gauntlet.......ok
t/Head...........ok
t/Misc...........ok
t/Parser.........ok
t/Ref............ok
t/WordDecoder....ok
t/Words..........ok
All tests successful.
Files=10, Tests=223, 14 wallclock secs ( 3.67 cusr +  0.31 csys =  3.98 CPU)

However, I am still getting this error. Switching back to the old version works just fine.
Any ideas as to what my problem might be?

Cheers,
Jeff

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hunter at userfriendly.net  Thu Oct 14 02:00:47 2004
From: hunter at userfriendly.net (Michael Weiner)
Date: Thu Jan 12 21:27:15 2006
Subject: Can't locate MIME/Decoder/BinHex.pm
Message-ID: <mailman.3470.1137101235.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-10-14 at 10:08 +1000, Jeff Mills wrote:
...

> I tried to install the latest stable version 4.34.8, but I receive an error when I try to run MailScanner:
> 
> angry bin # ./MailScanner --version
> Can't locate MIME/Decoder/BinHex.pm in @INC (@INC contains: /opt/MailScanner/lib /etc/perl /usr/lib/perl5/site_perl/5.8.4/i686-linux /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.4/i686-linux /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.2/i686-linux /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.4/i686-linux /usr/lib/perl5/5.8.4 /usr/local/lib/site_perl /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 . /opt/MailScanner/lib) at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
> BEGIN failed--compilation aborted at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
> Compilation failed in require at ./MailScanner line 52.
> BEGIN failed--compilation aborted at ./MailScanner line 52.
> 
> I did a search of the archives and found that this message may be related to MIME-tools, so I uninstalled my copy and downloaded the one from the MailScanner page.
> All the tests seemed to run fine and it installed properly:
...

> However, I am still getting this error. Switching back to the old version works just fine.
> Any ideas as to what my problem might be?

Try installing the Convert::BinHex module, and see if that resolves your
issue.

HTH
Michael Weiner

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


    [ Part 3, Application/LOAF  906bytes. ]
    [ Unable to print this part. ]


From hunter at userfriendly.net  Thu Oct 14 02:00:47 2004
From: hunter at userfriendly.net (Michael Weiner)
Date: Thu Jan 12 21:27:15 2006
Subject: Can't locate MIME/Decoder/BinHex.pm
Message-ID: <mailman.3471.1137101235.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-10-14 at 10:08 +1000, Jeff Mills wrote:
...

> I tried to install the latest stable version 4.34.8, but I receive an error when I try to run MailScanner:
> 
> angry bin # ./MailScanner --version
> Can't locate MIME/Decoder/BinHex.pm in @INC (@INC contains: /opt/MailScanner/lib /etc/perl /usr/lib/perl5/site_perl/5.8.4/i686-linux /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.4/i686-linux /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.2/i686-linux /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.4/i686-linux /usr/lib/perl5/5.8.4 /usr/local/lib/site_perl /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 . /opt/MailScanner/lib) at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
> BEGIN failed--compilation aborted at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
> Compilation failed in require at ./MailScanner line 52.
> BEGIN failed--compilation aborted at ./MailScanner line 52.
> 
> I did a search of the archives and found that this message may be related to MIME-tools, so I uninstalled my copy and downloaded the one from the MailScanner page.
> All the tests seemed to run fine and it installed properly:
...

> However, I am still getting this error. Switching back to the old version works just fine.
> Any ideas as to what my problem might be?

Try installing the Convert::BinHex module, and see if that resolves your
issue.

HTH
Michael Weiner

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From Jeff.Mills at POCOLD.COM.AU  Thu Oct 14 02:09:28 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:15 2006
Subject: Can't locate MIME/Decoder/BinHex.pm
Message-ID: <mailman.3472.1137101235.24926.mailscanner@lists.mailscanner.info>

> 
> Try installing the Convert::BinHex module, and see if that 
> resolves your
> issue.
> 
> HTH
> Michael Weiner
Hi,
thanks for the reply.
Convert::BinHex is installed according to the MailScanner --version that I did

1.119   Convert::BinHex

I have tried gentoo's portage version, and also tried installing from CPAN, all with no luck.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From clicknow at SWIFTDSL.COM.AU  Thu Oct 14 04:17:57 2004
From: clicknow at SWIFTDSL.COM.AU (Brian Parish)
Date: Thu Jan 12 21:27:15 2006
Subject: Requeueing stuck messages in postfix
Message-ID: <mailman.3473.1137101235.24926.mailscanner@lists.mailscanner.info>

One of my servers went a little strange and decided not to pass any
traffic.  Couldn't find the root cause, so have left that to one side
for the minute and did the following.

- removed the header checks line from /etc/postfix/main.cf
- verified that with MailScanner off and postfix running, mail is
processed
- installed the lastest version of MailScanner for Mandrake - thanks
Julian, now installs perfectly using the script
- put header checks back on

All working again.  But I have quite a number of stranded messages left
in the postfix incoming queue.  Did a:

postsuper -r ALL incoming

which said it had requeued 100+ messages and yes, they now sit in the
maildrop folder.  But that's where they stay.  I presume that as these
made it into the incoming queue, they have been processed by MailScanner
and are therefore safe to just queue for delivery, but obviously the
process doesn't quite match what I have done so far.

Can someone point me in the right direction?

TIA
Brian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greg at BLASTZONE.COM  Thu Oct 14 04:49:54 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3474.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1476" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>What 
exactly are you trying to do?</FONT></SPAN></DIV>
<DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>I am 
running a linux/postfix/mailscanner box as a gateway to my windows server 
running imail for a couple hundred domains.&nbsp;&nbsp;I have a batch job that 
grabs all the recipients from the imail box&nbsp;every 15 minutes so the gateway 
has a specific list of addresses to accept mail for and hand off to the imail 
box.&nbsp;&nbsp;Is that close to what you are trying to do?&nbsp; 
</FONT></SPAN></DIV>
<BLOCKQUOTE 
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
  <DIV></DIV>
  <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
  face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> MailScanner 
  mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Brian 
  Berglund<BR><B>Sent:</B> Wednesday, October 13, 2004 2:20 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Postfix Ldap 
  Setup<BR><BR></FONT></DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone know 
  exactly how to get Postfix running on a Linux box to connect to an Imail 
  server and Active Directory servers else where?<BR></FONT></SPAN></DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem to 
  connect to the local imail box using the ldap connection. </FONT></SPAN></DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
  help?<BR></DIV></FONT></SPAN>
  <DIV>&nbsp;</DIV>
  <DIV align=left>
  <MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=3 direction=right behavior=slide loop=1 border="0">
  <TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD>
        <DIV 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
        Berglund</DIV></TD>
      <TD></TD></TR>
    <TR>
      <TD>
        <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
        href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
  <BR>
  <MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=5 behavior=slide loop=1 border="2">
  <TABLE cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
        src="cid:873484703@14102004-00B7" width=110 border=0></A></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
        Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
        Boulevard<BR>Geneva, IL 60134 
  </TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
  <BR>
  <TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD align=right colSpan=2><A 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
        href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
        m</A><BR></TD></TR></TBODY></TABLE>
  <DIV 
style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
  <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
  Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
  e-mail and any accompanying documents is confidential, may be privileged, and 
  is intended solely for the person and/or entity to whom it is addressed (i.e. 
  those identified in the "To" and "Cc" box). They are the property of TechPro, 
  Inc. Unauthorized review, use, disclosure, or copying of this communication, 
  or any part thereof, is strictly prohibited and may be unlawful. If you have 
  received this e-mail in error, please return the e-mail and attachments to the 
  sender and delete the e-mail and attachments and any copy from your system. 
  TechPro, Inc. Thank you for your cooperation.</SPAN> </DIV>
  <DIV>&nbsp;</DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo1.gif: 00000001,26ad8998,00000000,00000000

From BBerglund at TECHPRO.COM  Thu Oct 14 04:56:07 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3475.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>

<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1476" name=GENERATOR></HEAD>
<BODY>
<DIV id=idOWAReplyText56017 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>yes... exactly. </FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>That is what i need to do.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2>Can you send me a config file?&nbsp; Or a 
How to to write the main.cf and whatever else i need?</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2>Thanks,</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>I appreciate it 100%</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list on behalf of Greg 
Deputy<BR><B>Sent:</B> Wed 10/13/2004 10:49 PM<BR><B>To:</B> 
MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
Setup<BR></FONT><BR></DIV>
<DIV>
<DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>What 
exactly are you trying to do?</FONT></SPAN></DIV>
<DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>I am 
running a linux/postfix/mailscanner box as a gateway to my windows server 
running imail for a couple hundred domains.&nbsp;&nbsp;I have a batch job that 
grabs all the recipients from the imail box&nbsp;every 15 minutes so the gateway 
has a specific list of addresses to accept mail for and hand off to the imail 
box.&nbsp;&nbsp;Is that close to what you are trying to do?&nbsp; 
</FONT></SPAN></DIV>
<BLOCKQUOTE 
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
  <DIV></DIV>
  <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
  face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> MailScanner 
  mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Brian 
  Berglund<BR><B>Sent:</B> Wednesday, October 13, 2004 2:20 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Postfix Ldap 
  Setup<BR><BR></FONT></DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone know 
  exactly how to get Postfix running on a Linux box to connect to an Imail 
  server and Active Directory servers else where?<BR></FONT></SPAN></DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem to 
  connect to the local imail box using the ldap connection. </FONT></SPAN></DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
  help?<BR></DIV></FONT></SPAN>
  <DIV>&nbsp;</DIV>
  <DIV align=left>
  <TABLE id=Table1 cellPadding=0 width=348 border=0>
    
    <TR>
      <TD>
        <DIV 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
        Berglund</DIV></TD>
      <TD></TD></TR>
    <TR>
      <TD>
        <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
        href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TABLE></DIV>---------------------------------------------------------- 
  <BR>
  <TABLE cellPadding=0 width=348 border=0>
    
    <TR>
      <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
        src="techpro_email_logo.gif" width=110 border=0></A></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
        Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
        Boulevard<BR>Geneva, IL 60134 
  </TD></TR></TABLE><BR>---------------------------------------------------------- 
  <BR>
  <TABLE id=Table2 cellPadding=0 width=348 border=0>
    
    <TR>
      <TD align=right colSpan=2><A 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS" 
        href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
        m</A><BR></TD></TR></TABLE>
  <DIV 
style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
  <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
  Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
  e-mail and any accompanying documents is confidential, may be privileged, and 
  is intended solely for the person and/or entity to whom it is addressed (i.e. 
  those identified in the "To" and "Cc" box). They are the property of TechPro, 
  Inc. Unauthorized review, use, disclosure, or copying of this communication, 
  or any part thereof, is strictly prohibited and may be unlawful. If you have 
  received this e-mail in error, please return the e-mail and attachments to the 
  sender and delete the e-mail and attachments and any copy from your system. 
  TechPro, Inc. Thank you for your cooperation.</SPAN> </DIV>
  <DIV>&nbsp;</DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' in 
  the body of the email.<BR>Before posting, read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE></DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo2.gif: 00000001,26ad8998,00000000,00000000

From Jeff.Mills at POCOLD.COM.AU  Thu Oct 14 04:53:53 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3476.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=750585203-14102004><FONT face=Arial color=#0000ff size=2>I'm 
doing the same thing here using a perl script to query active directory for a 
list of recipients and it works just fine.</FONT></SPAN></DIV>
<DIV><SPAN class=750585203-14102004><FONT face=Arial color=#0000ff size=2>Saves 
a lot of bandwidth downloading mail for non existant users.</FONT></SPAN></DIV>
<DIV><SPAN class=750585203-14102004></SPAN>&nbsp;</DIV>
<BLOCKQUOTE 
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid">
  <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma 
  size=2>-----Original Message-----<BR><B>From:</B> MailScanner mailing list 
  [mailto:MAILSCANNER@JISCMAIL.AC.UK]<B>On Behalf Of </B>Greg 
  Deputy<BR><B>Sent:</B> Thursday, 14 October 2004 1:50 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
  Setup<BR><BR></FONT></DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>What 
  exactly are you trying to do?</FONT></SPAN></DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>I am 
  running a linux/postfix/mailscanner box as a gateway to my windows server 
  running imail for a couple hundred domains.&nbsp;&nbsp;I have a batch job that 
  grabs all the recipients from the imail box&nbsp;every 15 minutes so the 
  gateway has a specific list of addresses to accept mail for and hand off to 
  the imail box.&nbsp;&nbsp;Is that close to what you are trying to do?&nbsp; 
  </FONT></SPAN></DIV>
  <BLOCKQUOTE 
  style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
    <DIV></DIV>
    <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
    face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> MailScanner 
    mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Brian 
    Berglund<BR><B>Sent:</B> Wednesday, October 13, 2004 2:20 PM<BR><B>To:</B> 
    MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Postfix Ldap 
    Setup<BR><BR></FONT></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone know 
    exactly how to get Postfix running on a Linux box to connect to an Imail 
    server and Active Directory servers else where?<BR></FONT></SPAN></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem to 
    connect to the local imail box using the ldap connection. 
    </FONT></SPAN></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial 
    size=2></FONT></SPAN>&nbsp;</DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
    help?<BR></DIV></FONT></SPAN>
    <DIV>&nbsp;</DIV>
    <DIV align=left>
    <MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
    scrollDelay=3 direction=right behavior=slide loop=1 border="0">
    <TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
      <TBODY>
      <TR>
        <TD>
          <DIV 
          style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
          Berglund</DIV></TD>
        <TD></TD></TR>
      <TR>
        <TD>
          <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
        <TD 
        style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
          href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
    <BR>
    <MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
    scrollDelay=5 behavior=slide loop=1 border="2">
    <TABLE cellPadding=0 width=348 border=0 cellspaing="0">
      <TBODY>
      <TR>
        <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
          src="cid:750585203@14102004-332a" width=110 border=0></A></TD>
        <TD 
        style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
          Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
          Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
          Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
          Boulevard<BR>Geneva, IL 60134 
    </TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
    <BR>
    <TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
      <TBODY>
      <TR>
        <TD align=right colSpan=2><A 
          style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
          href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c 
          o m</A><BR></TD></TR></TBODY></TABLE>
    <DIV 
    style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
    <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
    Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
    e-mail and any accompanying documents is confidential, may be privileged, 
    and is intended solely for the person and/or entity to whom it is addressed 
    (i.e. those identified in the "To" and "Cc" box). They are the property of 
    TechPro, Inc. Unauthorized review, use, disclosure, or copying of this 
    communication, or any part thereof, is strictly prohibited and may be 
    unlawful. If you have received this e-mail in error, please return the 
    e-mail and attachments to the sender and delete the e-mail and attachments 
    and any copy from your system. TechPro, Inc. Thank you for your 
    cooperation.</SPAN> </DIV>
    <DIV>&nbsp;</DIV>------------------------ MailScanner list 
    ------------------------ To unsubscribe, email <A 
    href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
    words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
    read the MAQ (<A 
    href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
    the archives (<A 
    href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
  </BLOCKQUOTE>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo3.gif: 00000001,504a9f79,00000000,00000000

From j.sharp at ECON.USYD.EDU.AU  Thu Oct 14 04:58:27 2004
From: j.sharp at ECON.USYD.EDU.AU (Justin Sharp)
Date: Thu Jan 12 21:27:15 2006
Subject: Release From Quarantine
Message-ID: <mailman.3477.1137101235.24926.mailscanner@lists.mailscanner.info>

This may be a daft question, but I have trawled the archives and
documentation with no result.

I am trying to release a message from quarantine that was blocked due to
double extension filename (using sendmail -toi bloke@domain.com < message).
But on release, it just gets scanned and blocked again. How can I bypass
filename checking when releasing messages?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From BBerglund at TECHPRO.COM  Thu Oct 14 05:05:39 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3478.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>

<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD>
<BODY>
<DIV id=idOWAReplyText29077 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>Is this the perl script that 
is mentioned online?</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2>My goal is to use the configs that Greg has 
to query the Imail box for users since we host 300 domains in there as well as 
use maybe your perl script to access outside exchange servers that we 
have.&nbsp; </FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2>I am a consultant looking to better provide 
spam protection for my clients using a central system.&nbsp; </FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2>So Greg, if you can send me a how to or a 
config to do the imail setup and Jeff a config/how to to do the perl 
script.&nbsp; You guys would help me out very considerably.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV dir=ltr><FONT face=Arial size=2>Thanks</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list on behalf of Jeff 
Mills<BR><B>Sent:</B> Wed 10/13/2004 10:53 PM<BR><B>To:</B> 
MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
Setup<BR></FONT><BR></DIV>
<DIV>
<DIV><SPAN class=750585203-14102004><FONT face=Arial color=#0000ff size=2>I'm 
doing the same thing here using a perl script to query active directory for a 
list of recipients and it works just fine.</FONT></SPAN></DIV>
<DIV><SPAN class=750585203-14102004><FONT face=Arial color=#0000ff size=2>Saves 
a lot of bandwidth downloading mail for non existant users.</FONT></SPAN></DIV>
<DIV><SPAN class=750585203-14102004></SPAN>&nbsp;</DIV>
<BLOCKQUOTE 
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid">
  <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma 
  size=2>-----Original Message-----<BR><B>From:</B> MailScanner mailing list 
  [mailto:MAILSCANNER@JISCMAIL.AC.UK]<B>On Behalf Of </B>Greg 
  Deputy<BR><B>Sent:</B> Thursday, 14 October 2004 1:50 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
  Setup<BR><BR></FONT></DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>What 
  exactly are you trying to do?</FONT></SPAN></DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>I am 
  running a linux/postfix/mailscanner box as a gateway to my windows server 
  running imail for a couple hundred domains.&nbsp;&nbsp;I have a batch job that 
  grabs all the recipients from the imail box&nbsp;every 15 minutes so the 
  gateway has a specific list of addresses to accept mail for and hand off to 
  the imail box.&nbsp;&nbsp;Is that close to what you are trying to do?&nbsp; 
  </FONT></SPAN></DIV>
  <BLOCKQUOTE 
  style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
    <DIV></DIV>
    <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
    face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> MailScanner 
    mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Brian 
    Berglund<BR><B>Sent:</B> Wednesday, October 13, 2004 2:20 PM<BR><B>To:</B> 
    MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Postfix Ldap 
    Setup<BR><BR></FONT></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone know 
    exactly how to get Postfix running on a Linux box to connect to an Imail 
    server and Active Directory servers else where?<BR></FONT></SPAN></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem to 
    connect to the local imail box using the ldap connection. 
    </FONT></SPAN></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial 
    size=2></FONT></SPAN>&nbsp;</DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
    help?<BR></DIV></FONT></SPAN>
    <DIV>&nbsp;</DIV>
    <DIV align=left>
    <TABLE id=Table1 cellPadding=0 width=348 border=0>
      
      <TR>
        <TD>
          <DIV 
          style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
          Berglund</DIV></TD>
        <TD></TD></TR>
      <TR>
        <TD>
          <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
        <TD 
        style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
          href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TABLE></DIV>---------------------------------------------------------- 
    <BR>
    <TABLE cellPadding=0 width=348 border=0>
      
      <TR>
        <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
          src="techpro_email_logo.gif" width=110 border=0></A></TD>
        <TD 
        style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
          Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
          Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
          Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
          Boulevard<BR>Geneva, IL 60134 
    </TD></TR></TABLE><BR>---------------------------------------------------------- 
    <BR>
    <TABLE id=Table2 cellPadding=0 width=348 border=0>
      
      <TR>
        <TD align=right colSpan=2><A 
          style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS" 
          href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c 
          o m</A><BR></TD></TR></TABLE>
    <DIV 
    style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
    <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
    Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
    e-mail and any accompanying documents is confidential, may be privileged, 
    and is intended solely for the person and/or entity to whom it is addressed 
    (i.e. those identified in the "To" and "Cc" box). They are the property of 
    TechPro, Inc. Unauthorized review, use, disclosure, or copying of this 
    communication, or any part thereof, is strictly prohibited and may be 
    unlawful. If you have received this e-mail in error, please return the 
    e-mail and attachments to the sender and delete the e-mail and attachments 
    and any copy from your system. TechPro, Inc. Thank you for your 
    cooperation.</SPAN> </DIV>
    <DIV>&nbsp;</DIV>------------------------ MailScanner list 
    ------------------------ To unsubscribe, email <A 
    href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' 
    in the body of the email.<BR>Before posting, read the MAQ (<A 
    href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
    the archives (<A 
    href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
  </BLOCKQUOTE>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' in 
  the body of the email.<BR>Before posting, read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE></DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo4.gif: 00000001,504a9f79,00000000,00000000

From Jeff.Mills at POCOLD.COM.AU  Thu Oct 14 05:11:41 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3479.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=201350404-14102004><FONT face=Arial color=#0000ff size=2>Try 
this page:</FONT></SPAN></DIV>
<DIV><SPAN class=201350404-14102004><FONT face=Arial color=#0000ff size=2><A 
href="http://www-personal.umich.edu/~malth/gaptuning/postfix/">http://www-personal.umich.edu/~malth/gaptuning/postfix/</A></FONT></SPAN></DIV>
<DIV><SPAN class=201350404-14102004></SPAN>&nbsp;</DIV>
<BLOCKQUOTE 
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid">
  <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma 
  size=2>-----Original Message-----<BR><B>From:</B> MailScanner mailing list 
  [mailto:MAILSCANNER@JISCMAIL.AC.UK]<B>On Behalf Of </B>Brian 
  Berglund<BR><B>Sent:</B> Thursday, 14 October 2004 1:56 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
  Setup<BR><BR></FONT></DIV>
  <DIV id=idOWAReplyText56017 dir=ltr>
  <DIV dir=ltr><FONT face=Arial color=#000000 size=2>yes... exactly. 
  </FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2>That is what i need to do.</FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2>Can you send me a config file?&nbsp; Or a 
  How to to write the main.cf and whatever else i need?</FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2>Thanks,</FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2>I appreciate it 100%</FONT></DIV></DIV>
  <DIV dir=ltr><BR>
  <HR tabIndex=-1>
  <FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list on behalf of 
  Greg Deputy<BR><B>Sent:</B> Wed 10/13/2004 10:49 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
  Setup<BR></FONT><BR></DIV>
  <DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>What 
  exactly are you trying to do?</FONT></SPAN></DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>I am 
  running a linux/postfix/mailscanner box as a gateway to my windows server 
  running imail for a couple hundred domains.&nbsp;&nbsp;I have a batch job that 
  grabs all the recipients from the imail box&nbsp;every 15 minutes so the 
  gateway has a specific list of addresses to accept mail for and hand off to 
  the imail box.&nbsp;&nbsp;Is that close to what you are trying to do?&nbsp; 
  </FONT></SPAN></DIV>
  <BLOCKQUOTE 
  style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
    <DIV></DIV>
    <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
    face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> MailScanner 
    mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Brian 
    Berglund<BR><B>Sent:</B> Wednesday, October 13, 2004 2:20 PM<BR><B>To:</B> 
    MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Postfix Ldap 
    Setup<BR><BR></FONT></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone know 
    exactly how to get Postfix running on a Linux box to connect to an Imail 
    server and Active Directory servers else where?<BR></FONT></SPAN></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem to 
    connect to the local imail box using the ldap connection. 
    </FONT></SPAN></DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial 
    size=2></FONT></SPAN>&nbsp;</DIV>
    <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
    help?<BR></DIV></FONT></SPAN>
    <DIV>&nbsp;</DIV>
    <DIV align=left>
    <TABLE id=Table1 cellPadding=0 width=348 border=0>
      <TBODY>
      <TR>
        <TD>
          <DIV 
          style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
          Berglund</DIV></TD>
        <TD></TD></TR>
      <TR>
        <TD>
          <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
        <TD 
        style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
          href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></DIV>---------------------------------------------------------- 
    <BR>
    <TABLE cellPadding=0 width=348 border=0>
      <TBODY>
      <TR>
        <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
          src="techpro_email_logo.gif" width=110 border=0></A></TD>
        <TD 
        style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
          Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
          Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
          style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
          Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
          Boulevard<BR>Geneva, IL 60134 
    </TD></TR></TBODY></TABLE><BR>---------------------------------------------------------- 
    <BR>
    <TABLE id=Table2 cellPadding=0 width=348 border=0>
      <TBODY>
      <TR>
        <TD align=right colSpan=2><A 
          style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS" 
          href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c 
          o m</A><BR></TD></TR></TBODY></TABLE>
    <DIV 
    style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
    <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
    Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
    e-mail and any accompanying documents is confidential, may be privileged, 
    and is intended solely for the person and/or entity to whom it is addressed 
    (i.e. those identified in the "To" and "Cc" box). They are the property of 
    TechPro, Inc. Unauthorized review, use, disclosure, or copying of this 
    communication, or any part thereof, is strictly prohibited and may be 
    unlawful. If you have received this e-mail in error, please return the 
    e-mail and attachments to the sender and delete the e-mail and attachments 
    and any copy from your system. TechPro, Inc. Thank you for your 
    cooperation.</SPAN> </DIV>
    <DIV>&nbsp;</DIV>------------------------ MailScanner list 
    ------------------------ To unsubscribe, email <A 
    href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' 
    in the body of the email.<BR>Before posting, read the MAQ (<A 
    href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
    the archives (<A 
    href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
  </BLOCKQUOTE></DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' in 
  the body of the email.<BR>Before posting, read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
  ------------------------ MailScanner list ------------------------ To 
  unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>).</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From Jeff.Mills at POCOLD.COM.AU  Thu Oct 14 05:16:58 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:15 2006
Subject: Postfix Ldap Setup
Message-ID: <mailman.3480.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2800.1458" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=191281304-14102004><FONT face=Arial color=#0000ff size=2>I'm 
not sure having LDAP open to the outside from exchange servers is a good idea - 
I only connect to my internal LDAP.</FONT></SPAN></DIV>
<DIV><SPAN class=191281304-14102004><FONT face=Arial color=#0000ff size=2>The 
perl script mentioned on the page I sent has plenty of commenting to explain 
itself.</FONT></SPAN></DIV>
<DIV><SPAN class=191281304-14102004><FONT face=Arial color=#0000ff size=2>The 
problem I had with it, is that it only queries the users container, which was no 
good to me since we move our users to OU's.</FONT></SPAN></DIV>
<DIV><SPAN class=191281304-14102004><FONT face=Arial color=#0000ff size=2>I had 
to modify the script to look into multiple OU's, but it was just a matter of 
adding multiple variables, one for each OU I wanted to 
scour.</FONT></SPAN></DIV>
<BLOCKQUOTE 
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid">
  <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma 
  size=2>-----Original Message-----<BR><B>From:</B> MailScanner mailing list 
  [mailto:MAILSCANNER@JISCMAIL.AC.UK]<B>On Behalf Of </B>Brian 
  Berglund<BR><B>Sent:</B> Thursday, 14 October 2004 2:06 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
  Setup<BR><BR></FONT></DIV>
  <DIV id=idOWAReplyText29077 dir=ltr>
  <DIV dir=ltr><FONT face=Arial color=#000000 size=2>Is this the perl script 
  that is mentioned online?</FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2>My goal is to use the configs that Greg 
  has to query the Imail box for users since we host 300 domains in there as 
  well as use maybe your perl script to access outside exchange servers that we 
  have.&nbsp; </FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2>I am a consultant looking to better 
  provide spam protection for my clients using a central system.&nbsp; 
  </FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2>So Greg, if you can send me a how to or a 
  config to do the imail setup and Jeff a config/how to to do the perl 
  script.&nbsp; You guys would help me out very considerably.</FONT></DIV>
  <DIV dir=ltr><FONT face=Arial size=2></FONT>&nbsp;</DIV>
  <DIV dir=ltr><FONT face=Arial size=2>Thanks</FONT></DIV></DIV>
  <DIV dir=ltr><BR>
  <HR tabIndex=-1>
  <FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list on behalf of 
  Jeff Mills<BR><B>Sent:</B> Wed 10/13/2004 10:53 PM<BR><B>To:</B> 
  MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
  Setup<BR></FONT><BR></DIV>
  <DIV>
  <DIV><SPAN class=750585203-14102004><FONT face=Arial color=#0000ff size=2>I'm 
  doing the same thing here using a perl script to query active directory for a 
  list of recipients and it works just fine.</FONT></SPAN></DIV>
  <DIV><SPAN class=750585203-14102004><FONT face=Arial color=#0000ff 
  size=2>Saves a lot of bandwidth downloading mail for non existant 
  users.</FONT></SPAN></DIV>
  <DIV><SPAN class=750585203-14102004></SPAN>&nbsp;</DIV>
  <BLOCKQUOTE 
  style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid">
    <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma 
    size=2>-----Original Message-----<BR><B>From:</B> MailScanner mailing list 
    [mailto:MAILSCANNER@JISCMAIL.AC.UK]<B>On Behalf Of </B>Greg 
    Deputy<BR><B>Sent:</B> Thursday, 14 October 2004 1:50 PM<BR><B>To:</B> 
    MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Postfix Ldap 
    Setup<BR><BR></FONT></DIV>
    <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
    size=2>What exactly are you trying to do?</FONT></SPAN></DIV>
    <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff 
    size=2></FONT></SPAN>&nbsp;</DIV>
    <DIV><SPAN class=873484703-14102004><FONT face=Arial color=#0000ff size=2>I 
    am running a linux/postfix/mailscanner box as a gateway to my windows server 
    running imail for a couple hundred domains.&nbsp;&nbsp;I have a batch job 
    that grabs all the recipients from the imail box&nbsp;every 15 minutes so 
    the gateway has a specific list of addresses to accept mail for and hand off 
    to the imail box.&nbsp;&nbsp;Is that close to what you are trying to 
    do?&nbsp; </FONT></SPAN></DIV>
    <BLOCKQUOTE 
    style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
      <DIV></DIV>
      <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
      face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> MailScanner 
      mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Brian 
      Berglund<BR><B>Sent:</B> Wednesday, October 13, 2004 2:20 PM<BR><B>To:</B> 
      MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Postfix Ldap 
      Setup<BR><BR></FONT></DIV>
      <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Does anyone 
      know exactly how to get Postfix running on a Linux box to connect to an 
      Imail server and Active Directory servers else 
      where?<BR></FONT></SPAN></DIV>
      <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>I cannot seem 
      to connect to the local imail box using the ldap connection. 
      </FONT></SPAN></DIV>
      <DIV><SPAN class=190191921-13102004><FONT face=Arial 
      size=2></FONT></SPAN>&nbsp;</DIV>
      <DIV><SPAN class=190191921-13102004><FONT face=Arial size=2>Can anyone 
      help?<BR></DIV></FONT></SPAN>
      <DIV>&nbsp;</DIV>
      <DIV align=left>
      <TABLE id=Table1 cellPadding=0 width=348 border=0>
        <TBODY>
        <TR>
          <TD>
            <DIV 
            style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
            Berglund</DIV></TD>
          <TD></TD></TR>
        <TR>
          <TD>
            <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
          <TD 
          style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
            href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></DIV>---------------------------------------------------------- 
      <BR>
      <TABLE cellPadding=0 width=348 border=0>
        <TBODY>
        <TR>
          <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
            src="techpro_email_logo.gif" width=110 border=0></A></TD>
          <TD 
          style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
            style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
            Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
            style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
            Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
            style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
            Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
            Boulevard<BR>Geneva, IL 60134 
      </TD></TR></TBODY></TABLE><BR>---------------------------------------------------------- 
      <BR>
      <TABLE id=Table2 cellPadding=0 width=348 border=0>
        <TBODY>
        <TR>
          <TD align=right colSpan=2><A 
            style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS" 
            href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . 
            c o m</A><BR></TD></TR></TBODY></TABLE>
      <DIV 
      style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
      <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
      Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in 
      this e-mail and any accompanying documents is confidential, may be 
      privileged, and is intended solely for the person and/or entity to whom it 
      is addressed (i.e. those identified in the "To" and "Cc" box). They are 
      the property of TechPro, Inc. Unauthorized review, use, disclosure, or 
      copying of this communication, or any part thereof, is strictly prohibited 
      and may be unlawful. If you have received this e-mail in error, please 
      return the e-mail and attachments to the sender and delete the e-mail and 
      attachments and any copy from your system. TechPro, Inc. Thank you for 
      your cooperation.</SPAN> </DIV>
      <DIV>&nbsp;</DIV>------------------------ MailScanner list 
      ------------------------ To unsubscribe, email <A 
      href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' 
      in the body of the email.<BR>Before posting, read the MAQ (<A 
      href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
      the archives (<A 
      href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
    </BLOCKQUOTE>------------------------ MailScanner list 
    ------------------------ To unsubscribe, email <A 
    href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' 
    in the body of the email.<BR>Before posting, read the MAQ (<A 
    href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
    the archives (<A 
    href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
  </BLOCKQUOTE></DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="">jiscmail@jiscmail.ac.uk</A> with the words:<BR>'leave mailscanner' in 
  the body of the email.<BR>Before posting, read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
  ------------------------ MailScanner list ------------------------ To 
  unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>).</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From alexn at teleserv.ru  Thu Oct 14 08:37:25 2004
From: alexn at teleserv.ru ([Windows-1251] Íîâîæåíèí Àëåêñàíäð Àíäðååâè÷)
Date: Thu Jan 12 21:27:15 2006
Subject: In Start didn't find a C record when I wanted one
Message-ID: <mailman.3481.1137101235.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "Windows-1251" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Çäðàâñòâóéòå, Ugo.

Âû ïèñàëè 12 îêò^?áð^? 2004 ã., 20:39:38:

UB> Íîâîæåíèí Àëåêñàíäð Àíäðååâè÷ wrote:
>> Çäðàâñòâóéòå, MAILSCANNER.
>> 
>> The question to source writers. What`s meen SUBJ in MailScanner.
>> When somebody send me some spam, the daemon of MailScanner is suspend.
>> But sometimes it go on work.

UB> What do you mean by "suspend"?
it mean that mailservice is down!

>> 
>> ---cut here---
>> [root@mail log]# MailScanner -V
>> Running on
>> Linux mail.domain.ru 2.4.22-1.2154.nptl.aspsmp #1 SMP Wed Jan
>> 14 19:48:31 MSK 2004 i686 i686 i386 GNU/Linux
>> This is Fedora Core release 1 (Yarrow)
>> This is Perl version 5.008005 (5.8.5)
>> 
>> This is MailScanner version 4.34.8
>> Module versions are:
>> 1.00    AnyDBM_File
>> 1.13    Archive::Zip
>> 1.03    Carp
>> 1.119   Convert::BinHex
>> 1.00    DirHandle
>> 1.05    Fcntl
>> 2.73    File::Basename
>> 2.08    File::Copy
>> 2.01    FileHandle
>> 1.06    File::Path
>> 0.14    File::Temp
>> 1.27    HTML::Entities
>> 3.36    HTML::Parser
>> 2.28    HTML::TokeParser
>> 1.21    IO
>> 1.10    IO::File
>> 1.123   IO::Pipe
>> 3.03    MIME::Base64
>> 5.414   MIME::Decoder
>> 5.414   MIME::Decoder::UU
>> 5.414   MIME::Head
>> 5.414   MIME::Parser
>> 3.03    MIME::QuotedPrint
>> 5.414   MIME::Tools
>> 0.10    Net::CIDR
>> 1.08    POSIX
>> 1.77    Socket
>> 0.05    Sys::Syslog
>> 1.02    Time::localtime
>> 
>> Optional module versions are:
>> 1.809   DB_File
>> 1.08    Digest
>> 1.01    Digest::HMAC
>> 2.33    Digest::MD5
>> 2.10    Digest::SHA1
>> 0.44    Inline
>> 0.11    Mail::ClamAV
>> 3.000000        Mail::SpamAssassin
>> 1.997   Mail::SPF::Query
>> 0.15    Net::CIDR::Lite
>> 0.48    Net::DNS
>> missing Net::LDAP
>> 1.94    Parse::RecDescent
>> missing SAVI
>> 1.2     Sys::Hostname::Long
>> 2.42    Test::Harness
>> 0.47    Test::Simple
>> 1.95    Text::Balanced
>> 1.33    URI
>> ---cut here---
>> 
>> 
>> 

UB> ------------------------ MailScanner list ------------------------
UB> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
UB> 'leave mailscanner' in the body of the email.
UB> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
UB> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).



-- 
Íîâîæåíèí Àëåêñàíäð Àíäðååâè÷
Ðóêîâîäèòåëü ñåêòîðà òåõíè÷åñêîãî îáñëóæèâàíè^?
Îòäåë òåõíè÷åñêîé ïîääåðæêè.
Äåïàðòàìåíò ñåòåâûõ òåõíîëîãèé.
--
internet: http://support.teleserv.ru
mailto: alexn@teleserv.ru
UIN: 829126

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/PGP-SIGNATURE  194bytes. ]
    [ Unable to print this part. ]


From mailscanner at ecs.soton.ac.uk  Thu Oct 14 08:54:07 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Can't locate MIME/Decoder/BinHex.pm
Message-ID: <mailman.3482.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:09 14/10/2004, you wrote:
> >
> > Try installing the Convert::BinHex module, and see if that
> > resolves your
> > issue.
> >
> > HTH
> > Michael Weiner
>Hi,
>thanks for the reply.
>Convert::BinHex is installed according to the MailScanner --version that I did
>
>1.119   Convert::BinHex
>
>I have tried gentoo's portage version, and also tried installing from
>CPAN, all with no luck.

Install MIME::Base64 and MIME::Decode::BinHex from CPAN (which will
actually install the whole of MIME-tools which is what you want).

Either that or install the latest beta which should have resolved this
problem.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 08:52:13 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Scanning Order
Message-ID: <mailman.3483.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 23:59 13/10/2004, you wrote:
> > Is there a way to have the Virus and Content scanning happen before
> > the Spam scanning?
>
>Join the queue! Now get back to the end of the line
>
>:)
>
>I've been annoying Julian about this on a monthly basis :)

And implementing it still hasn't got any easier :-(
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jrudd at UCSC.EDU  Thu Oct 14 09:19:28 2004
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:27:15 2006
Subject: Scanning Order
Message-ID: <mailman.3484.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
>> > Is there a way to have the Virus and Content scanning happen before
>> > the Spam scanning?

There IS a way to do it (before Julian implements it within the
mailscanner system itself), but it's not real pretty.

Have 2 mailscanner instances (I'm not sure if you can use the multiple
queue system built in to mailscanner or not, but you can do it with 2
mailscanner installations):

a) sendmail (or whatever your MTA is) deposits into
/var/spool/mqueue.in1 for the first mailscanner

b) the first mailscanner does virus and content checks but not spam
checks and then deposits messages into /var/spool/mqueue.in2 for the
2nd mailscanner

c) the 2nd mailscanner does spam checks only, and then puts the
messages into /var/spool/mqueue

d) as usual, the sendmail running as a queue processor handles messages
that are in /var/spool/mqueue

I'm not sure if it would actually reduce load or not, though.


OR, you could do virus checks via the sendmail milter, if you're using
sendmail for your MTA.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 09:31:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3485.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I want your opinion.

When things like scripts and forms are detected in emails, they are just
quietly disarmed without any subject line tagging at all.

Should I do the same with phishing fraud attempts? The warning in the
message will be put in right next to the offending link.

It's just that phishing detection does detect quite a few false positives
due to the stupidity of a lot of newsletter authors who put "fake" links in
their material. I don't want people to become used to seeing "{Dangerous
Content?}" or whatever, and therefore ignoring it.

I have tagged the subject line so far, and I think it is already starting
to cause problems. I am tending towards removing the subject tag.

Any thoughts please?
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Thu Oct 14 09:51:25 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3486.1137101235.24926.mailscanner@lists.mailscanner.info>

Julian

To help us give informed feedback can you please put on this list an
example "phishing" message [perhaps faked so that existing rules will
not tag it!] which has your additional warning text. I need to see what
our users would get in order to judge whether it is enough to alert them
to the possible danger of the message.

It would also be helpful if you could include as well an example false
positive with enough text lines before and after the duff link and
wraning text to give enough context.

There is a balance to be struck here. The warning text needs to be
"intrusive" enough to alert our users, particularly overseas students,
of the dangers of a true phishing message.

On the other hand it will give rise to complaints if it appears too
intrusive in the case of false positives.

Thanks 

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."  

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
>Sent: 14 October 2004 09:32
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Phishing fraud question
>
>I want your opinion.
>
>When things like scripts and forms are detected in emails, 
>they are just
>quietly disarmed without any subject line tagging at all.
>
>Should I do the same with phishing fraud attempts? The warning in the
>message will be put in right next to the offending link.
>
>It's just that phishing detection does detect quite a few 
>false positives
>due to the stupidity of a lot of newsletter authors who put 
>"fake" links in
>their material. I don't want people to become used to seeing 
>"{Dangerous
>Content?}" or whatever, and therefore ignoring it.
>
>I have tagged the subject line so far, and I think it is 
>already starting
>to cause problems. I am tending towards removing the subject tag.
>
>Any thoughts please?
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Thu Oct 14 09:52:10 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3487.1137101235.24926.mailscanner@lists.mailscanner.info>

On Thu, October 14, 2004 9:31, Julian Field said:
> I want your opinion.
>
> When things like scripts and forms are detected in emails, they are just
> quietly disarmed without any subject line tagging at all.
>
> Should I do the same with phishing fraud attempts? The warning in the
> message will be put in right next to the offending link.
>
> It's just that phishing detection does detect quite a few false positives
> due to the stupidity of a lot of newsletter authors who put "fake" links
> in
> their material. I don't want people to become used to seeing "{Dangerous
> Content?}" or whatever, and therefore ignoring it.
>
> I have tagged the subject line so far, and I think it is already starting
> to cause problems. I am tending towards removing the subject tag.
>
I agree. I warning in line just to highlight that this link doesn't go to
where it says will be adequate. After all the message it's self is not
really any danger at all. It's the strange desire to provide every last
item of presonal data including (But not limited to) inside leg
measurements and nocternal habits to complete strangers that is the
dangerous bit.

My 2p anyway.

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 09:59:44 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3488.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html>
<body>
Here's an excerpt from an abbey national phishing scam.<br><br>
<br>
<pre>To log into your account, please visit the online banking
<font face="Courier New, Courier" color="#FF0000"><a href="http://200.153.201.119:16780/">MailScanner
has detected a possible fraud attempt from
http://200.153.201.119:16780/</a></b></font><a href="http://200.153.201.119:16780/"><font color="red"><b>MailScanner has detected a possible fraud attempt from http://200.153.201.119:16780/</b></font> 
http://www.abbey.com</a>

If you have questions about your online statement,
please send us a Bank Mail or call us at 1-800-374-9700&nbsp;

</pre>And a false positive:<br><br>
<br>
since 2001; and Otylia Jedrzejczak of Poland who won a gold medal in
Athens in the 200m butterfly finals and has committed to auctioning her
medal to help raise money for children suffering from leukemia. The
European Heroes were chosen as 'they inspire, create, devote themselves
to others, and even risk their lives...' <br>
<font color="#FF0000"><b><a href="http://www.time.com/time/europe/hero2004/mcarthur.html">MailScanner
has detected a possible fraud attempt from
http://www.time.com/time/europe/hero2004/mcarthur.html</a></b><a href="http://www.time.com/time/europe/hero2004/mcarthur.html"><font color="red"><b>MailScanner has detected a possible fraud attempt from http://www.time.com/time/europe/hero2004/mcarthur.html</b></font> 
www.time.com<br><br>
</a></font>&lt;&lt;B&amp;Q&gt;&gt; UNDERGOES 'ROUND THE WORLD'
REFIT...<br>
Since returning to her French base in Lorient in mid-September, the
75-foot trimaran <br><br>
Sorry for the HTML post, but you need to see it in bold red.<br>
If you don't like the text/style, feel free to suggest
improvements.<br><br>
I just think that flagging the false positive as &quot;banned
content&quot; or &quot;dangerous content&quot; is going too
far.<br><br>
At 09:51 14/10/2004, you wrote:<br>
<blockquote type=cite class=cite cite="">Julian<br><br>
To help us give informed feedback can you please put on this list
an<br>
example &quot;phishing&quot; message [perhaps faked so that existing
rules will<br>
not tag it!] which has your additional warning text. I need to see
what<br>
our users would get in order to judge whether it is enough to alert
them<br>
to the possible danger of the message.<br><br>
It would also be helpful if you could include as well an example
false<br>
positive with enough text lines before and after the duff link and<br>
wraning text to give enough context.<br><br>
There is a balance to be struck here. The warning text needs to be<br>
&quot;intrusive&quot; enough to alert our users, particularly overseas
students,<br>
of the dangers of a true phishing message.<br><br>
On the other hand it will give rise to complaints if it appears too<br>
intrusive in the case of false positives.<br><br>
Thanks <br><br>
Quentin<br>
---<br>
PHONE: +44 191 222 8209&nbsp;&nbsp;&nbsp; Information Systems and
Services (ISS),<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
University of Newcastle,<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Newcastle upon Tyne,<br>
FAX:&nbsp;&nbsp; +44 191 222 8765&nbsp;&nbsp;&nbsp; United Kingdom, NE1
7RU.<br>
------------------------------------------------------------------------<br>
&quot;Any opinion expressed above is mine. The University can get its
own.&quot;&nbsp; <br><br>
&gt;-----Original Message-----<br>
&gt;From: MailScanner mailing list <br>
&gt;[<a href="mailto:MAILSCANNER@JISCMAIL.AC.UK" eudora="autourl">mailto:MAILSCANNER@JISCMAIL.AC.UK</a>]
On Behalf Of Julian Field<br>
&gt;Sent: 14 October 2004 09:32<br>
&gt;To: MAILSCANNER@JISCMAIL.AC.UK<br>
&gt;Subject: Phishing fraud question<br>
&gt;<br>
&gt;I want your opinion.<br>
&gt;<br>
&gt;When things like scripts and forms are detected in emails, <br>
&gt;they are just<br>
&gt;quietly disarmed without any subject line tagging at all.<br>
&gt;<br>
&gt;Should I do the same with phishing fraud attempts? The warning in
the<br>
&gt;message will be put in right next to the offending link.<br>
&gt;<br>
&gt;It's just that phishing detection does detect quite a few <br>
&gt;false positives<br>
&gt;due to the stupidity of a lot of newsletter authors who put <br>
&gt;&quot;fake&quot; links in<br>
&gt;their material. I don't want people to become used to seeing <br>
&gt;&quot;{Dangerous<br>
&gt;Content?}&quot; or whatever, and therefore ignoring it.<br>
&gt;<br>
&gt;I have tagged the subject line so far, and I think it is <br>
&gt;already starting<br>
&gt;to cause problems. I am tending towards removing the subject
tag.<br>
&gt;<br>
&gt;Any thoughts please?<br>
&gt;--<br>
&gt;Julian Field<br>
&gt;<a href="http://www.mailscanner.info/" eudora="autourl">www.MailScanner.info</a><br>
&gt;MailScanner thanks transtec Computers for their support<br>
&gt;Buy the MailScanner book at
<a href="http://www.mailscanner.info/store" eudora="autourl">www.MailScanner.info/store</a><br>
&gt;<br>
&gt;PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415
B654<br>
&gt;<br>
&gt;------------------------ MailScanner list
------------------------<br>
&gt;To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:<br>
&gt;'leave mailscanner' in the body of the email.<br>
&gt;Before posting, read the MAQ
(<a href="http://www.mailscanner.biz/maq/" eudora="autourl">http://www.mailscanner.biz/maq/</a>)
and<br>
&gt;the archives
(<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html" eudora="autourl">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).<br>
&gt;<br>
&gt;<br><br>
------------------------ MailScanner list ------------------------<br>
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ
(<a href="http://www.mailscanner.biz/maq/" eudora="autourl">http://www.mailscanner.biz/maq/</a>)
and<br>
the archives
(<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html" eudora="autourl">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).</blockquote></body>
<br>
<div>-- </div>
<div>Julian Field</div>
<div><a href="http://www.mailscanner.info/" EUDORA=AUTOURL>www.MailScanner.info</a></div>
<div>MailScanner thanks transtec Computers for their support</div>
<div>Buy the MailScanner book at
<a href="http://www.mailscanner.info/store" EUDORA=AUTOURL>www.MailScanner.info/store</a></div>
<br>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct 14 09:55:39 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3489.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian

FP's are bad - this is what moved us to MS from MailSweeper in the first
place, too many FP's and a really s l  o  w   interface to query what
was blocked and release the stuff. Ok so MailSweeper couldn't tag the
email just block it...but same issue.

Like I said a couple of days ago, I see very few phishing attempts
getting through here and wonder why I seem to be trapping them and your
setup isn't..

I'll double check my arhive and try and get some actual numbers on this...

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> I want your opinion.
>
> When things like scripts and forms are detected in emails, they are just
> quietly disarmed without any subject line tagging at all.
>
> Should I do the same with phishing fraud attempts? The warning in the
> message will be put in right next to the offending link.
>
> It's just that phishing detection does detect quite a few false positives
> due to the stupidity of a lot of newsletter authors who put "fake" links in
> their material. I don't want people to become used to seeing "{Dangerous
> Content?}" or whatever, and therefore ignoring it.
>
> I have tagged the subject line so far, and I think it is already starting
> to cause problems. I am tending towards removing the subject tag.
>
> Any thoughts please?
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From john at TRADOC.FR  Thu Oct 14 10:29:09 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3490.1137101235.24926.mailscanner@lists.mailscanner.info>

On Thu, 14 Oct 2004 09:31:35 +0100, Julian Field wrote:
> It's just that phishing detection does detect quite a few false positives
> due to the stupidity of a lot of newsletter authors who put "fake" links in
> their material. I don't want people to become used to seeing "{Dangerous
> Content?}" or whatever, and therefore ignoring it.

Are the majority of the false positives like the example you just sent,
i.e. a different page on the same host? 

If so, perhaps you could decide to flag as dangerous content if and only
if the host is different? After all, if the link is simply going
somewhere else on the same site there is little, if any, real danger. 

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct 14 10:27:46 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3491.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian


looked at the ones that triggered rules etc and they hit rules in
70_sare_spoof.cf from www.rulesemporium.com

It might be useful to contact the maintainer of this ruleset so he can
add in the non-US based phishing emails (like Abbey, Barclays etc) to
this list.

I also note he 'removed SA3.0 rules' earlier this month so I wonder if
3.0 has some of these built-in now???


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300



**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Q.G.Campbell at NEWCASTLE.AC.UK  Thu Oct 14 10:17:39 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3492.1137101235.24926.mailscanner@lists.mailscanner.info>

Julian

Thanks for that. I saw the warnings in BOLD BLUE rather than RED.

Are there situations where the recipients mailer will not render HTML in
messages? If so you may need some plain text border characters around
the inserted warning to make it stand out.
 
Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

 


________________________________

        From: MailScanner mailing list
[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field
        Sent: 14 October 2004 10:00
        To: MAILSCANNER@JISCMAIL.AC.UK
        Subject: Re: Phishing fraud question
	
	
        Here's an excerpt from an abbey national phishing scam.
	
	
	
        To log into your account, please visit the online banking
        MailScanner
        has detected a possible fraud attempt from
        http://200.153.201.119:16780/ <http://200.153.201.119:16780/> 
        http://www.abbey.com <http://200.153.201.119:16780/> 
	
        If you have questions about your online statement,
        please send us a Bank Mail or call us at 1-800-374-9700 
	
	
        And a false positive:
	
	
        since 2001; and Otylia Jedrzejczak of Poland who won a gold
medal in Athens in the 200m butterfly finals and has committed to
auctioning her medal to help raise money for children suffering from
leukemia. The European Heroes were chosen as 'they inspire, create,
devote themselves to others, and even risk their lives...' 
        MailScanner has detected a possible fraud attempt from
http://www.time.com/time/europe/hero2004/mcarthur.html
<http://www.time.com/time/europe/hero2004/mcarthur.html>  www.time.com
	
        <http://www.time.com/time/europe/hero2004/mcarthur.html> <<B&Q>>
UNDERGOES 'ROUND THE WORLD' REFIT...
        Since returning to her French base in Lorient in mid-September,
the 75-foot trimaran 
	
        Sorry for the HTML post, but you need to see it in bold red.
        If you don't like the text/style, feel free to suggest
improvements.
	
        I just think that flagging the false positive as "banned
content" or "dangerous content" is going too far.
	
        At 09:51 14/10/2004, you wrote:
	

                Julian
        	
                To help us give informed feedback can you please put on
this list an
                example "phishing" message [perhaps faked so that
existing rules will
                not tag it!] which has your additional warning text. I
need to see what
                our users would get in order to judge whether it is
enough to alert them
                to the possible danger of the message.
        	
                It would also be helpful if you could include as well an
example false
                positive with enough text lines before and after the
duff link and
                wraning text to give enough context.
        	
                There is a balance to be struck here. The warning text
needs to be
                "intrusive" enough to alert our users, particularly
overseas students,
                of the dangers of a true phishing message.
        	
                On the other hand it will give rise to complaints if it
appears too
                intrusive in the case of false positives.
        	
                Thanks 
        	
                Quentin
                ---
                PHONE: +44 191 222 8209    Information Systems and
Services (ISS),
                                           University of Newcastle,
                                           Newcastle upon Tyne,
                FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
	
------------------------------------------------------------------------
                "Any opinion expressed above is mine. The University can
get its own."  
        	
                >-----Original Message-----
                >From: MailScanner mailing list 
                >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian
Field
                >Sent: 14 October 2004 09:32
                >To: MAILSCANNER@JISCMAIL.AC.UK
                >Subject: Phishing fraud question
                >
                >I want your opinion.
                >
                >When things like scripts and forms are detected in
emails, 
                >they are just
                >quietly disarmed without any subject line tagging at
all.
                >
                >Should I do the same with phishing fraud attempts? The
warning in the
                >message will be put in right next to the offending
link.
                >
                >It's just that phishing detection does detect quite a
few 
                >false positives
                >due to the stupidity of a lot of newsletter authors who
put 
                >"fake" links in
                >their material. I don't want people to become used to
seeing 
                >"{Dangerous
                >Content?}" or whatever, and therefore ignoring it.
                >
                >I have tagged the subject line so far, and I think it
is 
                >already starting
                >to cause problems. I am tending towards removing the
subject tag.
                >
                >Any thoughts please?
                >--
                >Julian Field
                >www.MailScanner.info <http://www.mailscanner.info/> 
                >MailScanner thanks transtec Computers for their support
                >Buy the MailScanner book at www.MailScanner.info/store
                >
                >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947
1415 B654
                >
                >------------------------ MailScanner list
------------------------
                >To unsubscribe, email jiscmail@jiscmail.ac.uk with the
words:
                >'leave mailscanner' in the body of the email.
                >Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and
                >the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).
                >
                >
        	
                ------------------------ MailScanner list
------------------------
                To unsubscribe, email jiscmail@jiscmail.ac.uk with the
words:
                'leave mailscanner' in the body of the email.
                Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and
                the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).


        -- 
        Julian Field
        www.MailScanner.info <http://www.mailscanner.info/> 
        MailScanner thanks transtec Computers for their support
        Buy the MailScanner book at www.MailScanner.info/store

        PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
        'leave mailscanner' in the body of the email.
        Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
        and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html). 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Thu Oct 14 10:53:36 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3493.1137101235.24926.mailscanner@lists.mailscanner.info>

On Thu, October 14, 2004 9:59, Julian Field said:
> Here's an excerpt from an abbey national phishing scam.
>
>
> To log into your account, please visit the online banking
> <http://200.153.201.119:16780/>MailScanner has detected a possible fraud
> attempt from http://200.153.201.119:16780/<http://200.153.201.119:16780/>
> http://www.abbey.com
>
> If you have questions about your online statement,
> please send us a Bank Mail or call us at 1-800-374-9700
>
How easy would it to make that read some thing like
<http://200.153.201.119:16780/>MailScanner has detected a possible fraud
attempt from http://200.153.201.119:16780/<http://200.153.201.119:16780/>
claiming to be http://www.abbey.com

Just thought it might clarify what it is and what it says it is.

Drew



--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at BARENDSE.TO  Thu Oct 14 11:05:05 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3494.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I'm not sure how it works but all phishing mails we seem to get are
blocked by clamav 0.80-rc3 and marked as a virus.

Haven't seen a single false positive yet.

Maybe ppl could try clamav 0.80-rc3 to see what their results are?



On Thu, 14 Oct 2004, Julian Field wrote:

> I want your opinion.
>
> When things like scripts and forms are detected in emails, they are just
> quietly disarmed without any subject line tagging at all.
>
> Should I do the same with phishing fraud attempts? The warning in the
> message will be put in right next to the offending link.
>
> It's just that phishing detection does detect quite a few false positives
> due to the stupidity of a lot of newsletter authors who put "fake" links in
> their material. I don't want people to become used to seeing "{Dangerous
> Content?}" or whatever, and therefore ignoring it.
>
> I have tagged the subject line so far, and I think it is already starting
> to cause problems. I am tending towards removing the subject tag.
>
> Any thoughts please?
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From David.While at UCE.AC.UK  Thu Oct 14 10:29:08 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3495.1137101235.24926.mailscanner@lists.mailscanner.info>

I too haven't detected any phishing attempts getting past - they are tagged as spam and also detected as a virus by ClamAV (reported as HTML.phishing.bank-1)
 
When I next see one I will check to see what SpamAssassin traps are being triggered.
 
David While

	-----Original Message----- 
	From: MailScanner mailing list on behalf of Martin Hepworth 
	Sent: Thu 14/10/2004 09:55 
	To: MAILSCANNER@JISCMAIL.AC.UK 
	Cc: 
	Subject: Re: Phishing fraud question
	
	

	Julian
	
	FP's are bad - this is what moved us to MS from MailSweeper in the first
	place, too many FP's and a really s l  o  w   interface to query what
	was blocked and release the stuff. Ok so MailSweeper couldn't tag the
	email just block it...but same issue.
	
	Like I said a couple of days ago, I see very few phishing attempts
	getting through here and wonder why I seem to be trapping them and your
	setup isn't..
	
	I'll double check my arhive and try and get some actual numbers on this...
	
	--
	Martin Hepworth
	Snr Systems Administrator
	Solid State Logic
	Tel: +44 (0)1865 842300
	
	
	Julian Field wrote:
	> I want your opinion.
	>
	> When things like scripts and forms are detected in emails, they are just
	> quietly disarmed without any subject line tagging at all.
	>
	> Should I do the same with phishing fraud attempts? The warning in the
	> message will be put in right next to the offending link.
	>
	> It's just that phishing detection does detect quite a few false positives
	> due to the stupidity of a lot of newsletter authors who put "fake" links in
	> their material. I don't want people to become used to seeing "{Dangerous
	> Content?}" or whatever, and therefore ignoring it.
	>
	> I have tagged the subject line so far, and I think it is already starting
	> to cause problems. I am tending towards removing the subject tag.
	>
	> Any thoughts please?
	> --
	> Julian Field
	> www.MailScanner.info
	> MailScanner thanks transtec Computers for their support
	> Buy the MailScanner book at www.MailScanner.info/store
	>
	> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
	>
	> ------------------------ MailScanner list ------------------------
	> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
	> 'leave mailscanner' in the body of the email.
	> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
	> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
	
	**********************************************************************
	
	This email and any files transmitted with it are confidential and
	intended solely for the use of the individual or entity to whom they
	are addressed. If you have received this email in error please notify
	the system manager.
	
	This footnote confirms that this email message has been swept
	for the presence of computer viruses and is believed to be clean.
	
	**********************************************************************
	
	------------------------ MailScanner list ------------------------
	To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
	'leave mailscanner' in the body of the email.
	Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
	the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
	
	

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 11:10:27 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3496.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:17 14/10/2004, you wrote:
>Julian
>
>Thanks for that. I saw the warnings in BOLD BLUE rather than RED.
>
>Are there situations where the recipients mailer will not render HTML in
>messages? If so you may need some plain text border characters around
>the inserted warning to make it stand out.

The only time a phishing scam works is with HTML-aware mail clients, so I
don't think this is an issue.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 11:08:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3497.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:29 14/10/2004, you wrote:
>On Thu, 14 Oct 2004 09:31:35 +0100, Julian Field wrote:
> > It's just that phishing detection does detect quite a few false positives
> > due to the stupidity of a lot of newsletter authors who put "fake" links in
> > their material. I don't want people to become used to seeing "{Dangerous
> > Content?}" or whatever, and therefore ignoring it.
>
>Are the majority of the false positives like the example you just sent,
>i.e. a different page on the same host?

Mostly, but not all.

>If so, perhaps you could decide to flag as dangerous content if and only
>if the host is different? After all, if the link is simply going
>somewhere else on the same site there is little, if any, real danger.

Trying to match up any more than I already do is fraught with problems.
People can add in usernames, passwords, all sorts of things to make parsing
the URL very hard. At the moment I only have to look at the "simple" stuff
at the beginning.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 11:37:24 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3498.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Any idea how it's doing it? My approach doesn't use any virus signatures
and works with any virus scanner. Are you getting any false negatives at all?

At 11:05 14/10/2004, you wrote:
>I'm not sure how it works but all phishing mails we seem to get are
>blocked by clamav 0.80-rc3 and marked as a virus.
>
>Haven't seen a single false positive yet.
>
>Maybe ppl could try clamav 0.80-rc3 to see what their results are?
>
>
>
>On Thu, 14 Oct 2004, Julian Field wrote:
>
>>I want your opinion.
>>
>>When things like scripts and forms are detected in emails, they are just
>>quietly disarmed without any subject line tagging at all.
>>
>>Should I do the same with phishing fraud attempts? The warning in the
>>message will be put in right next to the offending link.
>>
>>It's just that phishing detection does detect quite a few false positives
>>due to the stupidity of a lot of newsletter authors who put "fake" links in
>>their material. I don't want people to become used to seeing "{Dangerous
>>Content?}" or whatever, and therefore ignoring it.
>>
>>I have tagged the subject line so far, and I think it is already starting
>>to cause problems. I am tending towards removing the subject tag.
>>
>>Any thoughts please?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 11:09:50 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3499.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:27 14/10/2004, you wrote:
>Julian
>
>
>looked at the ones that triggered rules etc and they hit rules in
>70_sare_spoof.cf from www.rulesemporium.com
>
>It might be useful to contact the maintainer of this ruleset so he can
>add in the non-US based phishing emails (like Abbey, Barclays etc) to
>this list.

We see them change frequently, which is why I wrote it to start with. Also,
just flagging the mail as spam isn't really enough. If the email looks
genuine, people will just tend to think that the spam detector is being
over-zealous and treating a bank's bulk mail as spam. That's why I want to
add more than just a spam tag.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 11:36:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3500.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:53 14/10/2004, you wrote:
>On Thu, October 14, 2004 9:59, Julian Field said:
> > Here's an excerpt from an abbey national phishing scam.
> >
> >
> > To log into your account, please visit the online banking
> > <http://200.153.201.119:16780/>MailScanner has detected a possible fraud
> > attempt from http://200.153.201.119:16780/<http://200.153.201.119:16780/>
> > http://www.abbey.com
> >
> > If you have questions about your online statement,
> > please send us a Bank Mail or call us at 1-800-374-9700
> >
>How easy would it to make that read some thing like
><http://200.153.201.119:16780/>MailScanner has detected a possible fraud
>attempt from http://200.153.201.119:16780/<http://200.153.201.119:16780/>
>claiming to be http://www.abbey.com
>
>Just thought it might clarify what it is and what it says it is.

Fair point, I guess, it's personal preference. You can just edit the text
in languages.conf if you want to do this. I don't want to have to process
another entire set of translations from everyone for this change, so I will
probably leave this one to you if that's okay.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Thu Oct 14 12:29:08 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:15 2006
Subject: Phishing fraud question
Message-ID: <mailman.3501.1137101235.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian

Fair enough.... I guess if the rule maintainer sees enough requests for
chnage he might start doing it another way.

Might be worthwhile contacting him anyway....just a suggestion.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> At 10:27 14/10/2004, you wrote:
>
>> Julian
>>
>>
>> looked at the ones that triggered rules etc and they hit rules in
>> 70_sare_spoof.cf from www.rulesemporium.com
>>
>> It might be useful to contact the maintainer of this ruleset so he can
>> add in the non-US based phishing emails (like Abbey, Barclays etc) to
>> this list.
>
>
> We see them change frequently, which is why I wrote it to start with. Also,
> just flagging the mail as spam isn't really enough. If the email looks
> genuine, people will just tend to think that the spam detector is being
> over-zealous and treating a bank's bulk mail as spam. That's why I want to
> add more than just a spam tag.
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From john at TRADOC.FR  Thu Oct 14 12:25:03 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3502.1137101235.24926.mailscanner@lists.mailscanner.info>

On Thu, 14 Oct 2004 11:08:11 +0100, Julian Field wrote:
> >Are the majority of the false positives like the example you just sent,
> >i.e. a different page on the same host?
> 
> Mostly, but not all.
> 
> >If so, perhaps you could decide to flag as dangerous content if and only
> >if the host is different? After all, if the link is simply going
> >somewhere else on the same site there is little, if any, real danger.
> 
> Trying to match up any more than I already do is fraught with problems.
> People can add in usernames, passwords, all sorts of things to make parsing
> the URL very hard. At the moment I only have to look at the "simple" stuff
> at the beginning.

Huh? Surely just checking the host would involve matching up *less*, not
more. If there's any difference in what's between the http:// and the
first / (or, as was pointed out on sa-users, if there's a difference in
scheme, e.g. http masquerading as https) then flag as dangerous; if the
only difference is after the first single slash then don't. This would
cut down FPs without adding any significant FNs. Or am I missing
something?

John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Thu Oct 14 12:38:35 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3503.1137101236.24926.mailscanner@lists.mailscanner.info>

On Thu, October 14, 2004 11:36, Julian Field said:
<--Snipped-->
>>Just thought it might clarify what it is and what it says it is.
>
> Fair point, I guess, it's personal preference. You can just edit the text
> in languages.conf if you want to do this. I don't want to have to process
> another entire set of translations from everyone for this change, so I
> will
> probably leave this one to you if that's okay.

Not a problem. I can manage to edit one file in English far easier than
you can a dozen or more in a variety of languages, many of which you are
probably not 'native' in :-)

Regards

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at BARENDSE.TO  Thu Oct 14 12:44:53 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3504.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On Thu, 14 Oct 2004, Julian Field wrote:

> Any idea how it's doing it? My approach doesn't use any virus signatures
> and works with any virus scanner. Are you getting any false negatives at all?

No idea at all, and I'm not on the clam list. Googling around a bit it
seems that they are defining the phishy stuff in their datfiles

At the current speed of newly emerging ponds I think their datfiles will
grow rapidly :)

So far I have seen a catch rate of 100% and no FP :)

>
> At 11:05 14/10/2004, you wrote:
>> I'm not sure how it works but all phishing mails we seem to get are
>> blocked by clamav 0.80-rc3 and marked as a virus.
>>
>> Haven't seen a single false positive yet.
>>
>> Maybe ppl could try clamav 0.80-rc3 to see what their results are?
>>
>>
>>
>> On Thu, 14 Oct 2004, Julian Field wrote:
>>
>>> I want your opinion.
>>>
>>> When things like scripts and forms are detected in emails, they are just
>>> quietly disarmed without any subject line tagging at all.
>>>
>>> Should I do the same with phishing fraud attempts? The warning in the
>>> message will be put in right next to the offending link.
>>>
>>> It's just that phishing detection does detect quite a few false positives
>>> due to the stupidity of a lot of newsletter authors who put "fake" links
>>> in
>>> their material. I don't want people to become used to seeing "{Dangerous
>>> Content?}" or whatever, and therefore ignoring it.
>>>
>>> I have tagged the subject line so far, and I think it is already starting
>>> to cause problems. I am tending towards removing the subject tag.
>>>
>>> Any thoughts please?
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alex at SKYNET-SRL.COM  Thu Oct 14 13:34:33 2004
From: alex at SKYNET-SRL.COM (Alessandro Bianchi)
Date: Thu Jan 12 21:27:16 2006
Subject: Advanced scanning rule howto
Message-ID: <mailman.3505.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi everyone

I'm playing with a rule I cant' figure out how to write

I need to avoid scanning messages who passes from a given server.

This is not the origin of the mail, but a routing server.

If I set up a procmail rule it gets applied AFTER MS scanned the
messages

Setting the rules

From:   routing server  no

doesn't work since I guess From is only applied to the original from,
and setting

To:             destination address   no

doesn't work either since the routing server uses sendmail to forward
all the mail from one domain to another doman


looking athe the mail headers I can see something like this:

to faked destination address that I have to usually scan
to original "real" address that gets translated on next (previous) line
<-- sendmail routing rewrite
from original sender
to original recipient

I can't simply blacklist the routing address since it also sends
legitimate mail to allowed users.

Any suggestion is welcome

Best regards

Alessandro Bianchi

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From usergroups at THEARGONCOMPANY.COM  Thu Oct 14 13:43:14 2004
From: usergroups at THEARGONCOMPANY.COM (Boskey)
Date: Thu Jan 12 21:27:16 2006
Subject: mailscanner with queue group
Message-ID: <mailman.3506.1137101236.24926.mailscanner@lists.mailscanner.info>

Hi,

I need to configure sendmail to deliver one message at a time to Mailscanner.
So,wanted to use queue groups on the directory /var/spool/mqueue.in
When i configure sendmail for this directory, with the following options

QUEUE_GROUP(`custom', `P=/var/spool/mqueue.in, r=1, F=f')dnl

i get an error message saying the directory /var/spool/mqueue.in is not a
sub-directory of the QUEUEDIRECTORY /var/spool/mqueue

When i  make a subdirectory called mqueue.in(also change the incoming queue
directory in mailscanner to the same), and restart mailscanner. I get an
error message saing
/var/spool/mqueue/mqueue.in is not a subdirectory of the
QUEUEDIRECTORY /var/spool/mqueue.in.

How do i go about this? Any suggestions.

Regards,

Boskey.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 14:05:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3507.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12:25 14/10/2004, you wrote:
>On Thu, 14 Oct 2004 11:08:11 +0100, Julian Field wrote:
> > >Are the majority of the false positives like the example you just sent,
> > >i.e. a different page on the same host?
> >
> > Mostly, but not all.
> >
> > >If so, perhaps you could decide to flag as dangerous content if and only
> > >if the host is different? After all, if the link is simply going
> > >somewhere else on the same site there is little, if any, real danger.
> >
> > Trying to match up any more than I already do is fraught with problems.
> > People can add in usernames, passwords, all sorts of things to make parsing
> > the URL very hard. At the moment I only have to look at the "simple" stuff
> > at the beginning.
>
>Huh? Surely just checking the host would involve matching up *less*, not
>more. If there's any difference in what's between the http:// and the
>first / (or, as was pointed out on sa-users, if there's a difference in
>scheme, e.g. http masquerading as https) then flag as dangerous; if the
>only difference is after the first single slash then don't. This would
>cut down FPs without adding any significant FNs.

You are absolutely right. I have incorporated the change.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alex at nkpanama.com  Thu Oct 14 14:26:03 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:16 2006
Subject: Scanning Order
Message-ID: <mailman.3508.1137101236.24926.mailscanner@lists.mailscanner.info>

That last thing is what I've had to do. Implement the ClamAV milter. It
*does* help a bit with CPU usage, like RBL's at the MTA level.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of John Rudd
Sent: Thursday, October 14, 2004 3:19 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Scanning Order

>> > Is there a way to have the Virus and Content scanning happen before
>> > the Spam scanning?

There IS a way to do it (before Julian implements it within the mailscanner
system itself), but it's not real pretty.

Have 2 mailscanner instances (I'm not sure if you can use the multiple queue
system built in to mailscanner or not, but you can do it with 2 mailscanner
installations):

a) sendmail (or whatever your MTA is) deposits into
/var/spool/mqueue.in1 for the first mailscanner

b) the first mailscanner does virus and content checks but not spam checks
and then deposits messages into /var/spool/mqueue.in2 for the 2nd
mailscanner

c) the 2nd mailscanner does spam checks only, and then puts the messages
into /var/spool/mqueue

d) as usual, the sendmail running as a queue processor handles messages that
are in /var/spool/mqueue

I'm not sure if it would actually reduce load or not, though.


OR, you could do virus checks via the sendmail milter, if you're using
sendmail for your MTA.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Thu Oct 14 14:29:00 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:16 2006
Subject: Release From Quarantine
Message-ID: <mailman.3509.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Justin Sharp wrote:
> This may be a daft question, but I have trawled the archives and
> documentation with no result.
>
> I am trying to release a message from quarantine that was blocked due to
> double extension filename (using sendmail -toi bloke@domain.com < message).
> But on release, it just gets scanned and blocked again. How can I bypass
> filename checking when releasing messages?

You must use rulesets so that your mailscanner doesn't scan e-mail
coming from 127.0.0.1 or your web server user.

Read the beginning of rthe MAQ page (url below) for hints.

>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Thu Oct 14 14:38:55 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:16 2006
Subject: What is going on? Totally bizzare
Message-ID: <mailman.3510.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Dave wrote:
> I'm in the process of setting up a box with MS. I think I have everything
> set correctly and it's filtering emails,
> BUT it seems to work 100% when I'm in debug mode!!

What do you mean? 100% CPU usage when used in debug mode?

>
> The system is a 700Mhz with almost 400 megs memory.
> I am currently testing it with fetchmail.(Long story), but it works fine.
>
> So when I run MS with debug set to YES(also SA debug on), the system load is
> under 2(using uptime/top),
> I placed 150 spam messages into the pop account I'm fetching mail from.(I
> have a pop account with over 1000 spam
> emails). MS starts to process the messages about 30 at a time, I keep
> reloading the MS service and it continues
> to process the emails. All is well...



>
> So I figure everything is working fine, turn off the debug and reload MS.
> NOW the load on the system is up to 5+
> nothing in the logs to show it's processing anything.
> And if something does show up on the logs, it's timeout messages either from
> SA or RBL's

How many processes you've got?  Is the system swapping?

Btw, 150 messages is a lot to process at one time.

>
> Am I doing something stupid? OR am I missing something here?
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From G.Pentland at soton.ac.uk  Thu Oct 14 15:23:57 2004
From: G.Pentland at soton.ac.uk (Pentland G.)
Date: Thu Jan 12 21:27:16 2006
Subject: mailscanner with queue group
Message-ID: <mailman.3511.1137101236.24926.mailscanner@lists.mailscanner.info>

Hi,

The easiest way to do this is to have separate sendmail configs for the
listener and the queue runner.

The queue runner use the old one without the queue group stuff.

The listener, as you had it first time but start it with..

/usr/lib/sendmail -bd -ODeliveryMode=queueonly
-OQueueDirectory=/var/spool

then /var/spool/mqueue.in is a subdirectory of /var/spool and Sendmail
will be happy.  As long as all of your mail goes into that queue group
then all mail will be queued in mqueue.in.

hope that helps,

Gary

Boskey wrote:
> Hi,
> 
> I need to configure sendmail to deliver one message at a time to
> Mailscanner. So,wanted to use queue groups on the directory
> /var/spool/mqueue.in When i configure sendmail for this directory,
> with the following options   
> 
> QUEUE_GROUP(`custom', `P=/var/spool/mqueue.in, r=1, F=f')dnl
> 
> i get an error message saying the directory /var/spool/mqueue.in is
> not a sub-directory of the QUEUEDIRECTORY /var/spool/mqueue 
> 
> When i  make a subdirectory called mqueue.in(also change the incoming
> queue directory in mailscanner to the same), and restart mailscanner.
> I get an error message saing /var/spool/mqueue/mqueue.in is not a
> subdirectory of the QUEUEDIRECTORY /var/spool/mqueue.in.   
> 
> How do i go about this? Any suggestions.
> 
> Regards,
> 
> Boskey.
> 
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave
> mailscanner' in the body of the email. Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).    

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jase at SENSIS.COM  Thu Oct 14 15:36:33 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:16 2006
Subject: Scanning Order
Message-ID: <mailman.3512.1137101236.24926.mailscanner@lists.mailscanner.info>

Brendan Chard wrote:
> Is there a way to have the Virus and Content scanning happen before
> the Spam scanning?
>
> I've just got MailWatch installed so now I have my low scoring spam
> going to quarantine.  Problem is, some virus messages are getting
> quarantined as spam before they get nailed and deleted as a virus.
> This throws off my mail stats (%ham %spam %virus) and also puts
> messages that are really viruses into quarantine.

If you're concerned with spam messages not being checked for viruses, you
could always modify your (high|non) spam actions.  For actions that you do
not deliver on, forward to a dummy address.  This will cause MailScanner to
also scan it for viruses, and MailWatch would show it as a virus too.

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dustin.baer at IHS.COM  Thu Oct 14 16:29:12 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:16 2006
Subject: Russian text and /etc/magic
Message-ID: <mailman.3513.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian,

You once mentioned modifying /etc/magic in order to get around certain
output from `file` when doing filetype checking.

In the past, I've had a problem with Russian text being reported as an
executable.  The output from `file` on the quarantined attachments
(msg-xxx.txt) is:

# file msg-22359-130.txt
msg-22359-130.txt:      DOS executable (COM)

I've changed /etc/magic:

< 0     byte            0xe9            DOS executable (COM)
---
 > 0     byte            0xe9            DOS executable (COM) RUSSIAN
TEXT MAILSCANNER

And then added an "allow" rule in filetype.rules.conf.  This all works
as I would like.

My question is how safe is this?  I have gone through every file I have
in quarantine and only see the "DOS executable (COM)" output for those
with Russian text.  Other executables report as "... (EXE)"

If anyone is bored, would you mind running `file` on all of your files
in quarantine and let me know if any of them show "DOS executable (COM)"
as the output?  Here are the commands I used (for Sendmail users):

$ cd /var/spool/MailScanner/quarantine
$ find 2004*/i* -ls | grep -v [dq]f | grep [a-zA-Z]$ | awk '{print $11}'
| while read i ; do file $i; done | grep COM

Thanks,

Dustin
--
Dustin Baer
Transport Extranet Network Services
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Thu Oct 14 16:11:16 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:16 2006
Subject: Scanning Order
Message-ID: <mailman.3514.1137101236.24926.mailscanner@lists.mailscanner.info>

> If you're concerned with spam messages not being checked for
> viruses, you could always modify your (high|non) spam
> actions.  For actions that you do not deliver on, forward to
> a dummy address.  This will cause MailScanner to also scan it
> for viruses, and MailWatch would show it as a virus too.
>

Although that may work it will change the headers of the email so it would
cause issues for people scanning multiple domains etc.


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Thu Oct 14 15:09:35 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:16 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3515.1137101236.24926.mailscanner@lists.mailscanner.info>

Good day:

We have an application where we would need to have the following to occur:

>From *@domain.com ,
Copy that entire SMTP message to /anypath/MESSAGEREF.inc
Put a file to /anypath/MESSAGEREF.add which contains each recipient of the
message on a separate line.

Is there any way that MailScanner can be set up to do this?

Thanks for any assistance.

Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Thu Oct 14 15:47:49 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:16 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3516.1137101236.24926.mailscanner@lists.mailscanner.info>

Hi there,

ok..the subject is a bit strange, but i´ve got a problem.

One of my users does not want his mails scanned for Viruses nor for spam.
So i had made a rule, which is as followed:

To:     user@domain         no

and put these into virus.scanner.rules and to spam.scanner.rules..

the default for action is then yes

Ok..everythings works fine..as long as this user is the only one in the
TO-Field.

For example..

A mail containing a virus is getting in.. The To-Field contains 2 Users:
The Person, who does not want his mails to be scanned, and me.

The Mail slippes trhough unscanned for both persons..

In both mails i do find the following:

X-irc-addicts.de-MailScanner:   Not scanned: please contact your Internet
E-Mail Service Provider for details

To find this in the mail to the person, who does not want his mails to be
scanned is ok..but to see this within the mail to myself..is a bit
strange, as my mails should be scanned..

The same problem does happen with the use of spamassassin via procmail.
This user is in the config with getting all spam..and voila..all persons
in the to-field get unscanned..

Is there a workaround for this behaviour?

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martelm at QUARK.VSC.EDU  Thu Oct 14 16:28:34 2004
From: martelm at QUARK.VSC.EDU (Michael H. Martel)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3517.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
--On Thursday, October 14, 2004 9:31 AM +0100 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> I have tagged the subject line so far, and I think it is already starting
> to cause problems. I am tending towards removing the subject tag.
>
> Any thoughts please?

Obviously I would want it configurable, but I would vote for no subject
line modifications, and no change to the body of the message except to
remove the link.




Michael

--

  --------------------------------o---------------------------------
   Michael H. Martel              | Systems Administrator
   martelm@quark.vsc.edu          | Vermont State Colleges
   http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From alex at nkpanama.com  Thu Oct 14 18:58:28 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3518.1137101236.24926.mailscanner@lists.mailscanner.info>

Which can already be done using the "disarm" type rules, at least for HTML
forms. The "phishing detection" could/would apply the same principle to
probable phishing scams as well - and/or provide the option of redirecting
e-mails to a standard page, administered by the MailScanner administrator,
that explains what's happening.

Example:

somebloke@mycompany.com gets an e-mail saying "fill this form out and update
your bank info". Since it's a form, and MS is set to disarm web forms except
from known places (using rulesets to allow by IP, and not by spoofable
domains), the user can't use the form.

Later that day, samebloke@mycompany.com receives an HTML e-mail with a link,
purporting to be existingbank.com, but actually going to
http-colon-slash-slash-someother.ip.address.somewhere-else/phishingpagedotht
ml, but MS catches it and disarms it, turning the link into
http://mycompany.com/redirectinfo?page=someother.ip.address.somewhere-else/p
hishingpage.html and samebloke gets a page saying "Hey, someone tried to
redirect you to existingbank.com using a link that actually goes to
someother.ip.address, if you want to continue (at your own risk) click
<here> and face the consequences. If this is a FP then I apologize, call the
MS admin and tell him to put this domain/ip in a whitelist or ruleset or
something".

What do you think? At least the option to do this would be nice, since most
of my MS servers already have apache/mysql/php built in in order to use
things like webmail, mailscanner-mrtg, mailwatch, etc.


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Michael H. Martel
Sent: Thursday, October 14, 2004 10:29 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Phishing fraud question

--On Thursday, October 14, 2004 9:31 AM +0100 Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

> I have tagged the subject line so far, and I think it is already
> starting to cause problems. I am tending towards removing the subject tag.
>
> Any thoughts please?

Obviously I would want it configurable, but I would vote for no subject line
modifications, and no change to the body of the message except to remove the
link.




Michael

--

  --------------------------------o---------------------------------
   Michael H. Martel              | Systems Administrator
   martelm@quark.vsc.edu          | Vermont State Colleges
   http://probe.vsc.edu/~michael  | PH:802-241-2544 FX:802-241-3363

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Thu Oct 14 18:45:29 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:16 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3519.1137101236.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Marcel Blenkers
> Sent: Thursday, October 14, 2004 10:48 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: No Scanning if one is in To
> 
> Hi there,
> 
> ok..the subject is a bit strange, but i´ve got a problem.
> 
> One of my users does not want his mails scanned for Viruses nor for spam.
> So i had made a rule, which is as followed:
> 
> To:     user@domain         no
> 
> and put these into virus.scanner.rules and to spam.scanner.rules..
> 
> the default for action is then yes
> 
> Ok..everythings works fine..as long as this user is the only one in the
> TO-Field.
> 
> For example..
> 
> A mail containing a virus is getting in.. The To-Field contains 2 Users:
> The Person, who does not want his mails to be scanned, and me.
> 
> The Mail slippes trhough unscanned for both persons..
> 
> In both mails i do find the following:
> 
> X-irc-addicts.de-MailScanner:   Not scanned: please contact your Internet
> E-Mail Service Provider for details
> 
> To find this in the mail to the person, who does not want his mails to be
> scanned is ok..but to see this within the mail to myself..is a bit
> strange, as my mails should be scanned..
> 
> The same problem does happen with the use of spamassassin via procmail.
> This user is in the config with getting all spam..and voila..all persons
> in the to-field get unscanned..
> 
> Is there a workaround for this behaviour?
> 
> 
You'll need to have the MTA split emails to multiple users into individual
messages, one for each recipient. There has been a lot of traffic on how to
do this recently. 

The quick and dirty for sendmail:
-----------------------------------------------------------
Create a backup copy of your sendmail.mc file:

       cp /etc/mail/sendmail.mc /etc/mail/sendmail_in.mc

   Edit /etc/mail/sendmail_in.mc. Add after the last "FEATURE"

       QUEUE_GROUP(`mqueue', `P=/var/spool/mqueue.in, F=f, r=1, R=8, I=2m')

   Add at the very end of the file:

      LOCAL_RULESETS
      # LOCAL_RULESETS
      Squeuegroup R$* @ $* $# mqueue R$* $# mqueue

   Create the sendmail_in.cf file

      cd /etc/mail
      m4 sendmail_in.mc > sendmail_in.cf

   Edit /etc/init.d/MailScanner to use the new sendmail_in.cf file.
   Change the lines:

                       -OPidFile=$INPID
        touch /var/run/sm-client.pid

   To read:

                       -OPidFile=$INPID \
                      -C/etc/mail/sendmail_in.cf
        touch /var/run/sm-client.pid

  Restart MailScanner.


For Exim I'm including a email I saved a while back
------------------------------------------------------------------
Mike Bacher [mikeb@tulsaconnect.com] sent me the directions below:
-----------------------------------

FYI, a potential solution to the white/blacklist problem with MailScanner
when using exim as the MTA:

[I wont have time to test this myself for a week or two]

-------- Original Message --------
Return-Path: <ph10@cus.cam.ac.uk>
Date: Fri, 16 Jul 2004 11:09:59 +0100 (BST)
From: Philip Hazel <ph10@cus.cam.ac.uk>
Reply-To: exim-users@exim.org
To: Mike Bacher <isp-list@tulsaconnect.com>

On Fri, 16 Jul 2004, Mike Bacher wrote:

> Well, I only care that a message with multiple recipients gets broken
> up into 1 message per recipient and placed into the queue for outbound
> delivery,

You can do this with an "incestuous" call to exim. Make this your first
router:

split:
   driver = accept
   domains = the.domains.you.want.to.do.this.for
   condition = ${if eq {$received_protocol}{split}{no}{yes}}
   transport = send_to_self
   no_verify

Add this transport:

send_to_self:
   driver = pipe
   batch_max = 1
   use_bsmtp
   command = /usr/sbin/exim -oMr split -bS
   user = exim

Untested. YMMV. You logs will get bigger, of course...

--
Philip Hazel            University of Cambridge Computing Service,
ph10@cus.cam.ac.uk      Cambridge, England. Phone: +44 1223 334714.
Get the Exim 4 book:    http://www.uit.co.uk/exim-book
--------------------------------------------------------------------------

I don't believe that postfix can be configured to split an email to multiple
recipients into individual messages so if you're using postfix you may have
to change MTAs

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 19:04:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3520.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:28 14/10/2004, you wrote:
>--On Thursday, October 14, 2004 9:31 AM +0100 Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>>I have tagged the subject line so far, and I think it is already starting
>>to cause problems. I am tending towards removing the subject tag.
>>
>>Any thoughts please?
>
>Obviously I would want it configurable, but I would vote for no subject
>line modifications, and no change to the body of the message except to
>remove the link.

I don't want to remove the link as it may well be a false positive. Users
will be really annoyed if their newsletters break just because I didn't
like the look of a link that was actually safe. This occurs in emails from
Egg (UK internet bank) for example.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 14 19:03:26 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:16 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3521.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 15:47 14/10/2004, you wrote:
>Hi there,
>
>ok..the subject is a bit strange, but i´ve got a problem.
>
>One of my users does not want his mails scanned for Viruses nor for spam.
>So i had made a rule, which is as followed:
>
>To:     user@domain         no
>
>and put these into virus.scanner.rules and to spam.scanner.rules..
>
>the default for action is then yes
>
>Ok..everythings works fine..as long as this user is the only one in the
>TO-Field.
>
>For example..
>
>A mail containing a virus is getting in.. The To-Field contains 2 Users:
>The Person, who does not want his mails to be scanned, and me.
>
>The Mail slippes trhough unscanned for both persons..
>
>In both mails i do find the following:
>
>X-irc-addicts.de-MailScanner:   Not scanned: please contact your Internet
>E-Mail Service Provider for details
>
>To find this in the mail to the person, who does not want his mails to be
>scanned is ok..but to see this within the mail to myself..is a bit
>strange, as my mails should be scanned..
>
>The same problem does happen with the use of spamassassin via procmail.
>This user is in the config with getting all spam..and voila..all persons
>in the to-field get unscanned..
>
>Is there a workaround for this behaviour?

I have moved it from being a first match to an all match which makes more 
sense for this option. Very few people allow users to selectively choose 
virus scanning, so it's never come up before. It will change in the next 
release.
-- 
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From jase at SENSIS.COM  Thu Oct 14 20:04:23 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:16 2006
Subject: Scanning Order
Message-ID: <mailman.3522.1137101236.24926.mailscanner@lists.mailscanner.info>

Michele Neylon :: Blacknight Solutions wrote:
>> If you're concerned with spam messages not being checked for
>> viruses, you could always modify your (high|non) spam
>> actions.  For actions that you do not deliver on, forward to
>> a dummy address.  This will cause MailScanner to also scan it
>> for viruses, and MailWatch would show it as a virus too.
>>
>
> Although that may work it will change the headers of the email so it
> would cause issues for people scanning multiple domains etc.

I'm not sure I understand how.  If for example the message were spam, and
the spam actions were originally set to store the file and not deliver it,
then forwarding it to a dummy address that would just drop the message would
not change any headers.  The end user would not be getting the message
anyways.  And forwarding the message would cause it to be scanned for
viruses too, and appropriately labeled as a virus message in MailWatch.

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ELKNET.NET  Thu Oct 14 19:10:24 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:16 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3523.1137101236.24926.mailscanner@lists.mailscanner.info>

On Wed, 13 Oct 2004 16:37:35 -0400, Matt Kettler <mkettler@EVI-INC.COM> wrote:

>Hmm.. question for you.. Can you run a message through spamassassin -D?
>
>Specifically I'm looking for "cannot trust envelope-from" debug messages.
>
>After doing some digging, SA 3.0 only applies this test to "envelope" type
>headers... X-Sender,X-Envelope-From, Return-Path, Envelope-Sender.

Yep, I had just read the same thing regarding SA3. I had gone and read the
change log on that bugzilla entry when I read this:
"- changes NO_DNS_FOR_FROM to use envelope sender instead of From: header"

That tipped me off right away as to what might have happened.

I have run a spam through spamassassin manually that I know should have a
hit on NO_DNS_FOR_FROM. I think these are the relavant log entries you are
looking for: (just to explain my configuration, all incoming mail is
recieved by my smtp server named 'lyta.elknet.net' who has an external ip of
216.114.28.6 This smtp server in turn uses its internal interface
(64.83.161.4 known as lyta2.elknet.met) to hand off email to be scanned to
my MS server, bester.elknet.net with an ip of 64.83.161.26. So, once
reaching my network, the headers should show it received by lyta, then given
to bester by lyta2. Lyta, lyta2, and bester are all internal trusted servers
on my network.

debug: received-header: parsed as [ ip=64.83.161.26 rdns=unverified
helo=bester.elknet.net by=mail.elknet.net ident= envfrom= intl=0
id=B0113994204@mail.elknet.net ]
debug: dns_available set to yes in config file, skipping test
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: looking up PTR record for '64.83.161.4'
debug: PTR for '64.83.161.4': 'lyta2.elknet.net'
debug: received-header: parsed as [ ip=64.83.161.4 rdns=lyta2.elknet.net
helo=lyta.elknet.net by=bester.elknet.net ident= envfrom= intl=0
id=1CHn5W-0008Iu-Dk ]
debug: received-header: parsed as [ ip=221.92.189.45 rdns=unverified
helo=YahooBB221092189045.bbtec.net by=lyta ident= envfrom= intl=0
id=B0015887826@lyta ]
debug: IP is reserved, not looking up PTR: 240.192.228.234
debug: received-header: parsed as [ ip=240.192.228.234 rdns=
helo=%RECEIVED.poiuy.net by=221.92.189.45 ident= envfrom= intl=0 id= ]
debug: looking up A records for 'mail.elknet.net'
debug: A records for 'mail.elknet.net': 64.83.161.25
debug: received-header: 'from' 64.83.161.26 is near to first 'by'
debug: received-header: relay 64.83.161.26 trusted? yes internal? no
debug: received-header: 'from' 64.83.161.4 is near to first 'by'
debug: received-header: relay 64.83.161.4 trusted? yes internal? no
debug: looking up A records for 'lyta'
debug: A records for 'lyta':
debug: received-header: relay 221.92.189.45 trusted? no internal? no
debug: received-header: relay 240.192.228.234 trusted? no internal? no
debug: metadata: X-Spam-Relays-Trusted: [ ip=64.83.161.26 rdns=unverified
helo=bester.elknet.net by=mail.elknet.net ident= envfrom= intl=0
id=B0113994204@mail.elknet.net ] [ ip=64.83.161.4 rdns=lyta2.elknet.net
helo=lyta.elknet.net by=bester.elknet.net ident= envfrom= intl=0
id=1CHn5W-0008Iu-Dk ]
debug: metadata: X-Spam-Relays-Untrusted: [ ip=221.92.189.45 rdns=unverified
helo=YahooBB221092189045.bbtec.net by=lyta ident= envfrom= intl=0
id=B0015887826@lyta ] [ ip=240.192.228.234 rdns= helo=%RECEIVED.poiuy.net
by=221.92.189.45 ident= envfrom= intl=0 id= ]


>
>
>One thing you might consider changing, providing you don't depend on the
>header, is in MailScanner.conf:
>
>         #Envelope From Header = X-MailScanner-From:
>         Envelope From Header = X-Envelope-From:
>
>SA doesn't recognize the default setting, but does recognize X-Envelope-From.
>
>Optionally you could try patching PerMsgStatus.pm to recognize
>X-MailScanner-From, but that's a bit silly.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ELKNET.NET  Thu Oct 14 19:25:58 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:16 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3524.1137101236.24926.mailscanner@lists.mailscanner.info>

On Wed, 13 Oct 2004 16:37:35 -0400, Matt Kettler <mkettler@EVI-INC.COM> wrote:

>Specifically I'm looking for "cannot trust envelope-from" debug messages.

I've run a few emails through spamassassin -D manually, never saw any of
those debug messages.

>One thing you might consider changing, providing you don't depend on the
>header, is in MailScanner.conf:
>
>         #Envelope From Header = X-MailScanner-From:
>         Envelope From Header = X-Envelope-From:
>
>SA doesn't recognize the default setting, but does recognize X-Envelope-From.

I made that change, but still no NO_DNS_FOR_FROM rule hits...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From leduc at CTS.COM  Thu Oct 14 18:58:53 2004
From: leduc at CTS.COM (Gene LeDuc)
Date: Thu Jan 12 21:27:16 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3525.1137101236.24926.mailscanner@lists.mailscanner.info>

I think that your problem boils down to the fact that only 1 message is being 
delivered to your server and processed by MS.  MS gets a rules match and 
doesn't scan it.  Your MTA then gets it back and delivers it to multiple 
recipients.

MS is not processing 2 messages, just 1 with 2 recipients.

In order to get around this behavior, MS would have to generate a new message 
for each of the other recipients and then scan them and put them into the MTA 
queue.  I think that having MS create new messages like this might open a 
brand new Can 'O Worms.

On Thursday 14 October 2004 07:47 am, Marcel Blenkers wrote:
> Hi there,
>
> ok..the subject is a bit strange, but i´ve got a problem.
>
> One of my users does not want his mails scanned for Viruses nor for spam.
> So i had made a rule, which is as followed:
>
> To:     user@domain         no
>
> and put these into virus.scanner.rules and to spam.scanner.rules..
>
> the default for action is then yes
>
> Ok..everythings works fine..as long as this user is the only one in the
> TO-Field.
>
> For example..
>
> A mail containing a virus is getting in.. The To-Field contains 2 Users:
> The Person, who does not want his mails to be scanned, and me.
>
> The Mail slippes trhough unscanned for both persons..
>
> In both mails i do find the following:
>
> X-irc-addicts.de-MailScanner:   Not scanned: please contact your Internet
> E-Mail Service Provider for details
>
> To find this in the mail to the person, who does not want his mails to be
> scanned is ok..but to see this within the mail to myself..is a bit
> strange, as my mails should be scanned..
>
> The same problem does happen with the use of spamassassin via procmail.
> This user is in the config with getting all spam..and voila..all persons
> in the to-field get unscanned..
>
> Is there a workaround for this behaviour?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ssilva at SGVWATER.COM  Thu Oct 14 19:24:41 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3526.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Michael H. Martel wrote:
| --On Thursday, October 14, 2004 9:31 AM +0100 Julian Field
| <mailscanner@ECS.SOTON.AC.UK> wrote:
|
|> I have tagged the subject line so far, and I think it is already starting
|> to cause problems. I am tending towards removing the subject tag.
|>
|> Any thoughts please?
|
|
| Obviously I would want it configurable, but I would vote for no subject
| line modifications, and no change to the body of the message except to
| remove the link.
|
Or maybe disarm the link instead of remove it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBbsRpRADw9lziUqQRApBzAKCDWWvaUyuHNurcOIqgffoRDx9IOwCdHxYn
3PUEbgToDqliKL9Fjesp9fw=
=z71y
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Thu Oct 14 18:37:01 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:16 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3527.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Marcel Blenkers wrote:
> Hi there,
> 
> ok..the subject is a bit strange, but i´ve got a problem.
> 
> One of my users does not want his mails scanned for Viruses nor for spam.
> So i had made a rule, which is as followed:
> 
> To:     user@domain         no
> 
> and put these into virus.scanner.rules and to spam.scanner.rules..

You cannot have rules for virus scanning.  It scans everything or nothing.

> 
> the default for action is then yes
> 
> Ok..everythings works fine..as long as this user is the only one in the
> TO-Field.
> 
> For example..
> 
> A mail containing a virus is getting in.. The To-Field contains 2 Users:
> The Person, who does not want his mails to be scanned, and me.
> 
> The Mail slippes trhough unscanned for both persons..
> 
> In both mails i do find the following:
> 
> X-irc-addicts.de-MailScanner:   Not scanned: please contact your Internet
> E-Mail Service Provider for details
> 
> To find this in the mail to the person, who does not want his mails to be
> scanned is ok..but to see this within the mail to myself..is a bit
> strange, as my mails should be scanned..
> 
> The same problem does happen with the use of spamassassin via procmail.
> This user is in the config with getting all spam..and voila..all persons
> in the to-field get unscanned..
> 
> Is there a workaround for this behaviour?

I know it's been discussed on this list.  Did you search the archive?

- You should not hijack a thread.  When you want to post, create a new 
message, don't just reply to one.

> 
> Greetings
> 
> Marcel
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mkettler at EVI-INC.COM  Thu Oct 14 21:12:02 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:16 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3528.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:10 PM 10/14/2004, Alan wrote:
> >Hmm.. question for you.. Can you run a message through spamassassin -D?
> >
> >Specifically I'm looking for "cannot trust envelope-from" debug messages.
> >
> >After doing some digging, SA 3.0 only applies this test to "envelope" type
> >headers... X-Sender,X-Envelope-From, Return-Path, Envelope-Sender.
>
>Yep, I had just read the same thing regarding SA3. I had gone and read the
>change log on that bugzilla entry when I read this:
>"- changes NO_DNS_FOR_FROM to use envelope sender instead of From: header"
>
>That tipped me off right away as to what might have happened.
>
>I have run a spam through spamassassin manually that I know should have a
>hit on NO_DNS_FOR_FROM. I think these are the relavant log entries you are
>looking for:

No, those are definitely not the line's I'm looking for.... That's the
Received: path parsing.. I don't care about the Received: header path and
what servers are trusted, this is something completely different. That's
got to do with trusted_networks, DNSBLs, whitelist_from_rcvd, ALL_TRUSTED,
etc. It has little or nothing to do with the envelope from trust.

I'm explicitly looking for a line that ends with "cannot trust
envelope-from". That text is a verbatim quote from the SA code. Here's the
full lines it might output:

       dbg ("X-Sender and fetchmail signatures found, cannot trust
envelope-from");
       dbg ("X-Envelope-From header found after 1 or more Received lines,
cannot trust envelope-from");
       dbg ("Envelope-Sender header found after 1 or more Received lines,
cannot trust envelope-from");
       dbg ("Return-Path header found after 1 or more Received lines,
cannot trust envelope-from");

> >One thing you might consider changing, providing you don't depend on the
> >header, is in MailScanner.conf:
> >
> >         #Envelope From Header = X-MailScanner-From:
> >         Envelope From Header = X-Envelope-From:
> >

I'm going to re-suggest trying the X-Envelope-From trick.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Thu Oct 14 22:55:35 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:16 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3529.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 05:19 PM 10/14/2004, Alan wrote:
>On Thu, 14 Oct 2004 16:12:02 -0400, Matt Kettler <mkettler@EVI-INC.COM> wrote:
>
>Thanks for the continued help. Here is some more info.
>
> >I'm going to re-suggest trying the X-Envelope-From trick.
> >
>
>Did that, saw no difference. Below is the complete debug log after I
>manually ran a spam through spamassassin. You may note the header:
>X-Envelope-From: thanmuko@poiuy.net
>
>I did find one of the debug messages you were hoping to see:
>"debug: X-Envelope-From header found after 1 or more Received lines, cannot
>trust envelope-from"

Yem, there's the no-trust statement. Grrr..

The Mailscanner hack doesn't help, unfortunately, because MailScanner
inserts it at the end of the headers, so SA won't trust it. Go ahead and
undo that MailScanner.conf change.

I did some digging in the SA code, a bit deeper this time. It looks like
you have one of two options:

Option 1 - Making SA recognize X-MailScaner-From:
-----------------------------------------

First change the mailscanner from header back in MailScanner.conf.
         Envelope From Header = X-MailScanner-From:


Next make SA honor it in either local.cf or spam.assassin.prefs.conf:
         envelope_sender_header  X-MailScanner-From

Option 2 - Adding Return-Path headers via exim
------------------------------------------

It's a bit of a hack to do so on a relaying server, but it looks like your
NT box SMTP server software (EMWAC) is RFC unaware and doesn't add them
anyway, so that should be OK.

http://www.exim.org/exim-html-3.10/doc/html/spec_14.html#SEC385

SA should honor Return-Path headers added by exim, because they should be
at the top.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From grupos at DAIBERT.NET  Fri Oct 15 03:06:40 2004
From: grupos at DAIBERT.NET (Marcelo Daibert - Grupos)
Date: Thu Jan 12 21:27:16 2006
Subject: YahooGroups Mail - VIRUS
Message-ID: <mailman.3530.1137101236.24926.mailscanner@lists.mailscanner.info>

Hello all, 
 
My server has MailScanner instaled, but at a time behind, most of the
emails of the yahoogroups is being classified as tends virus.  
 
Anyone with the same problem? 
 
Thanks all, 
------------------------------------
Marcelo Daibert - Grupos
[icon_email.gif] grupos@daibert.net [icon_icq_add.gif] 349906
[icon_tel.gif] +55(0xx32)3213-0497 [icon_msnm.gif] msn@daibert.net
[icon_fax.gif] +55(0xx32)3213-0497 [icon_yim.gif] MSDaibert
[icon_cel.gif] +55(0xx32)8812-4631 [icon_aim.gif] MSDaibert
[icon_www.gif] http://daibert.net    
       
 
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Image/GIF  2KB. ]
    [ Unable to print this part. ]


    [ Part 3, Image/GIF  1.9KB. ]
    [ Unable to print this part. ]


    [ Part 4, Image/GIF  1.8KB. ]
    [ Unable to print this part. ]


    [ Part 5, Image/GIF  1.9KB. ]
    [ Unable to print this part. ]


    [ Part 6, Image/GIF  1.8KB. ]
    [ Unable to print this part. ]


    [ Part 7, Image/GIF  2KB. ]
    [ Unable to print this part. ]


    [ Part 8, Image/GIF  1.8KB. ]
    [ Unable to print this part. ]


    [ Part 9, Image/GIF  1.9KB. ]
    [ Unable to print this part. ]


    [ Part 10, Image/GIF  1.9KB. ]
    [ Unable to print this part. ]


    [ Part 11, Image/GIF  2.8KB. ]
    [ Unable to print this part. ]


From john at TRADOC.FR  Fri Oct 15 07:35:30 2004
From: john at TRADOC.FR (John Wilcock)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3531.1137101236.24926.mailscanner@lists.mailscanner.info>

On Thu, 14 Oct 2004 19:04:45 +0100, Julian Field wrote:
> I don't want to remove the link as it may well be a false positive. Users
> will be really annoyed if their newsletters break just because I didn't
> like the look of a link that was actually safe. This occurs in emails from
> Egg (UK internet bank) for example.

Have you considered adding a whitelist, i.e. domains known to generate
false positives? Or can this be achieved with a ruleset on the option
that configures whether or not this behaviour is enabled?


John.

-- 
-- Over 2500 webcams from ski resorts around the world - www.snoweye.com
-- Translate your technical documents and web pages    - www.tradoc.fr

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 09:07:06 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:16 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3532.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 22:55 14/10/2004, you wrote:
>At 05:19 PM 10/14/2004, Alan wrote:
>>On Thu, 14 Oct 2004 16:12:02 -0400, Matt Kettler <mkettler@EVI-INC.COM>
>>wrote:
>>
>>Thanks for the continued help. Here is some more info.
>>
>> >I'm going to re-suggest trying the X-Envelope-From trick.
>> >
>>
>>Did that, saw no difference. Below is the complete debug log after I
>>manually ran a spam through spamassassin. You may note the header:
>>X-Envelope-From: thanmuko@poiuy.net
>>
>>I did find one of the debug messages you were hoping to see:
>>"debug: X-Envelope-From header found after 1 or more Received lines, cannot
>>trust envelope-from"
>
>Yem, there's the no-trust statement. Grrr..
>
>The Mailscanner hack doesn't help, unfortunately, because MailScanner
>inserts it at the end of the headers, so SA won't trust it. Go ahead and
>undo that MailScanner.conf change.

Do you need me to add the header for SA right at the top? It's an easy
enough change to make.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 09:05:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:16 2006
Subject: Phishing fraud question
Message-ID: <mailman.3533.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 07:35 15/10/2004, you wrote:
>On Thu, 14 Oct 2004 19:04:45 +0100, Julian Field wrote:
> > I don't want to remove the link as it may well be a false positive. Users
> > will be really annoyed if their newsletters break just because I didn't
> > like the look of a link that was actually safe. This occurs in emails from
> > Egg (UK internet bank) for example.
>
>Have you considered adding a whitelist, i.e. domains known to generate
>false positives? Or can this be achieved with a ruleset on the option
>that configures whether or not this behaviour is enabled?

Precisely, just use a ruleset.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 09:15:12 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:16 2006
Subject: YahooGroups Mail - VIRUS
Message-ID: <mailman.3534.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi

what operating system, version of MailScanner and version of Trend?
Have you added another antivirus like ClamAV to see what it makes of them?

Does Trend alos mark the email as viruses if you run Trend from the
command lind against the email?


also no html email please - alot of people have trouble with them

and yes I'm top posting which alot of people hate, so I'm not perfect
either:-)


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Marcelo Daibert - Grupos wrote:
> Hello all,
>
> My server has MailScanner instaled, but at a time behind, most of the
> emails of the yahoogroups is being classified as tends virus.
>
> Anyone with the same problem?
>
> Thanks all,
> *------------------------------------*
> *Marcelo Daibert - Grupos *
> <mailto:grupos@daibert.net>   *grupos@daibert.net
> <mailto:grupos@daibert.net>*
> <http://wwp.icq.com/scripts/search.dll?to=349906>     *349906*
>       *+55(0xx32)3213-0497*           *msn@daibert.net*
>       *+55(0xx32)3213-0497*
> <http://edit.yahoo.com/config/send_webmesg?.target=msdaibert&.src=pg>
> *MSDaibert*
>       *+55(0xx32)8812-4631*
> <aim:goim?screenname=MSDaibert&message=Hello%2BAre%2Byou%2Bthere?>
> *MSDaibert*
>       *http://daibert.net* <http://daibert.net/>
>
>
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ricardo.canavate at nozar.es  Fri Oct 15 09:28:19 2004
From: ricardo.canavate at nozar.es (Ricardo Luis CaXavate)
Date: Thu Jan 12 21:27:16 2006
Subject: Why the messages virus are not stopped by MailScanner?
Message-ID: <mailman.3535.1137101236.24926.mailscanner@lists.mailscanner.info>

Hi friends!!

Since one month more or less i does not scan virusses in messages. Some
users tell me that they are receiving virus and i do not believe them.

Looking for scanning messages in the maillog i see this:


THE MESSAGE ARE SCAN AND THE VIRUS FOUND IT!!.

But then I receive the message and the messages are signing as clean in
MailWatch .

In this last month i do not remember what i have installed.

Thanks in advanced.


Ricardo Luis Cañavate García
Dpto. Informática
NOZAR Grupo Inmobiliario
Tel: 91 758 96 30 | Fax: 91 559 85 82
www.nozar.es


=========================================================================
Usted recibe este mensaje porque su dirección e-mail se encuentra en 
nuestra base de datos al haber tenido contactos anteriores con nosotros, 
por lo que entendemos que contamos con su autorización para enviarle 
información profesional. No obstante, si no desea seguir recibiéndola 
basta con hacérnoslo saber.
Este mensaje se dirige exclusivamente a su destinatario y puede contener 
información privilegiada o confidencial. Si no es vd. el destinatario 
indicado, queda notificado de que la utilización, divulgación y/o copia 
sin autorización está prohibida en virtud de la legislación vigente. 
Si ha recibido este mensaje por error, le rogamos que nos lo comunique 
inmediatamente por esta misma vía y proceda a su destrucción.


You are receiving this message because your e-mail address is listed in 
our database due to previous communications with us, 
so we have assumed that we have your permission to send you professional 
information. However, if you do not wish to continue to receive such 
information then please let us know.
This message is intended exclusively for its addressee and may contain 
information that is CONFIDENTIAL and protected by professional privilege. 
If you are not the intended recipient you are hereby notified that any 
dissemination, copy or disclosure of this communication is strictly 
prohibited by law. If this message has been received in error, please 
immediately notify us via e-mail and delete it.
=======================================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From gercke at HNM.DE  Fri Oct 15 09:34:30 2004
From: gercke at HNM.DE (Daniel Gercke)
Date: Thu Jan 12 21:27:16 2006
Subject: sometimes Re: to Virus Document getting throught
Message-ID: <mailman.3536.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi all,

since 2 days we receive returned mail form t-online.de Mailer-Daemon,
where original Mail was a Virus. Norton Antivirus found Netsky.X but
none of the Virus Scanner in Mailscanner found these Virus.

Virusscanner running (Norman,f-prot,clamav)

Any ideas?
--

Daniel Gercke


--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
.
--
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 09:42:31 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:16 2006
Subject: sometimes Re: to Virus Document getting throught
Message-ID: <mailman.3537.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi

Netsky-x has been around since April so the AV should pick it.

Is this email a 'bounce' or an original email?

Also what version of MailScanner?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Daniel Gercke wrote:
> Hi all,
>
> since 2 days we receive returned mail form t-online.de Mailer-Daemon,
> where original Mail was a Virus. Norton Antivirus found Netsky.X but
> none of the Virus Scanner in Mailscanner found these Virus.
>
> Virusscanner running (Norman,f-prot,clamav)
>
> Any ideas?
> --
>
> Daniel Gercke
>
>
> --
> haus neuer medien GmbH . agentur fuer neuen antrieb
> .
> Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
> Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
> AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
> .
> --
> [Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
> Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder
> Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ricardo.canavate at nozar.es  Fri Oct 15 09:55:28 2004
From: ricardo.canavate at nozar.es (Ricardo Luis CaXavate)
Date: Thu Jan 12 21:27:16 2006
Subject: Why the messages virus are not stopped by MailScanner?
Message-ID: <mailman.3538.1137101236.24926.mailscanner@lists.mailscanner.info>

Hi friends!!

Since one month more or less i does not scan virusses in messages. Some
users tell me that they are receiving virus and i do not believe them.

Looking for scanning messages in the maillog i see this:

Oct 15 09:47:37 servnozar sendmail[9419]: i9F7laxR009419:
from=<r_canavate@terra.es>, size=49430, class=0, nrcpts=1,
msgid=<HGELIJHMDHKAIELLJFMMMEDIDJAA.r_canavate@terra.es>, proto=ESMTP,
daemon=Daemon0, relay=smtp.terra.es [213.4.129.129]
Oct 15 09:47:48 servnozar MailScanner[9034]: Expanding TNEF archive at
/var/spool/MailScanner/incoming/9034/i9F7laxR009419/winmail.dat
Oct 15 09:47:49 servnozar MailScanner[9034]:
/home/spool.mailscanner/incoming/9034/i9F7laxR009419/winmail.dat/letter43.zi
p        Found the W32/Netsky.p@MM!zip virus !!!
Oct 15 09:47:49 servnozar MailScanner[9034]:
/home/spool.mailscanner/incoming/9034/i9F7laxR009419/letter43.zip
Found the W32/Netsky.p@MM!zip virus !!!
Oct 15 09:47:50 servnozar sendmail[9447]: i9F7laxR009419:
to=<informatica@nozar.es>, delay=00:00:13, xdelay=00:00:00, mailer=local,
pri=120811, dsn=2.0.0, stat=Sent

THE MESSAGE ARE SCAN AND THE VIRUS FOUND IT!!.

But then I receive the message and the messages are signing as clean in
MailWatch .

5/10/04 09:47:49        r_canavate@terra.es     informatica@nozar.es    RV: I love
you!    48.7Kb          5.86    Clean

From:   r_canavate@terra.es
To:     informatica@nozar.es
Subject:        RV: I love you!
Size:   48.7Kb
Virus:   N
Blocked File:    N
Other Infection:         N
Report:
Spam:    N   Action(s): deliver
High Scoring Spam:       N
Listed in RBL:   N
Whitelisted:     N
Blacklisted:     N
SpamAssassin Spam:       N
SpamAssassin Score:     5.86
Spam Report:
        Score   Matching Rule   Description2.25 AWL
-1.52   BAYES_01
1.33    SARE_FREE_WEBM_EsTerra
3.81    USERPASS
Archive:


In this last month i do not remember what i have installed.

Thanks in advanced.


Ricardo Luis Cañavate García
Dpto. Informática
NOZAR Grupo Inmobiliario
Tel: 91 758 96 30 | Fax: 91 559 85 82
www.nozar.es


=========================================================================
Usted recibe este mensaje porque su dirección e-mail se encuentra en 
nuestra base de datos al haber tenido contactos anteriores con nosotros, 
por lo que entendemos que contamos con su autorización para enviarle 
información profesional. No obstante, si no desea seguir recibiéndola 
basta con hacérnoslo saber.
Este mensaje se dirige exclusivamente a su destinatario y puede contener 
información privilegiada o confidencial. Si no es vd. el destinatario 
indicado, queda notificado de que la utilización, divulgación y/o copia 
sin autorización está prohibida en virtud de la legislación vigente. 
Si ha recibido este mensaje por error, le rogamos que nos lo comunique 
inmediatamente por esta misma vía y proceda a su destrucción.


You are receiving this message because your e-mail address is listed in 
our database due to previous communications with us, 
so we have assumed that we have your permission to send you professional 
information. However, if you do not wish to continue to receive such 
information then please let us know.
This message is intended exclusively for its addressee and may contain 
information that is CONFIDENTIAL and protected by professional privilege. 
If you are not the intended recipient you are hereby notified that any 
dissemination, copy or disclosure of this communication is strictly 
prohibited by law. If this message has been received in error, please 
immediately notify us via e-mail and delete it.
=======================================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From pg at NEWHONEST.COM  Fri Oct 15 10:08:11 2004
From: pg at NEWHONEST.COM (Jason)
Date: Thu Jan 12 21:27:16 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3539.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

    I'm running an email server to serve only our own employee. So I would
like to make some special treatment for emails coming to or going out from
users of our server. The treatment I want to make includes spam checking,
email splitting, and attachment filename checking.

    I know rules are designed to do the job. But will MailScanner fight
against fake email addresses? If not, people can fake our email address and
get thru.

Jason

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 10:19:27 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:16 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3540.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi

never trust the 'from' address, use ip-addresses use with the rules.

I have an s separate email gateway machine.

I set mine so email from the server (or LAN) ip-address gets virus
checked, NOT spam checked but a standard signature attached.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Jason wrote:
> Hi,
>
>    I'm running an email server to serve only our own employee. So I would
> like to make some special treatment for emails coming to or going out from
> users of our server. The treatment I want to make includes spam checking,
> email splitting, and attachment filename checking.
>
>    I know rules are designed to do the job. But will MailScanner fight
> against fake email addresses? If not, people can fake our email address and
> get thru.
>
> Jason
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 10:28:19 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:17 2006
Subject: Why the messages virus are not stopped by MailScanner?
Message-ID: <mailman.3541.1137101236.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ricardo
OK both your MailScanner and Spamassassin are quite old, I'd suggest you
uprgade your MailScanner first (what out for having to reinstall the
MailWatch as well), then the SpamAssassin to 4.34 and 2.64 respectively.

I seem to remember sometime in the last few months changed to MS so as
to fix issues with virus scanning especially on 'bounced' emails. If I'm
wrong on this I'm sure I'll be corrected.....:-)

-- 
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Ricardo Luis Cañavate wrote:
> 
>> I am using McAfee and I think are the last version
>>
>> [root@servnozar root]# uvscan --version --dat
>> /usr/local/uvscan/datfiles/current/
>> Virus Scan for Linux v4.32.0
>> Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights
>> reserved.
>> (408) 988-3832  LICENSED COPY - Nov 27 2003
>>
>> Scan engine v4.3.20 for Linux.
>> Virus data file v4399 created Oct 14 2004
>> Scanning for 103750 viruses, trojans and variants.
>>
>> [root@servnozar root]#
>>
>> And works well
>>
>> [root@servnozar root]# ls
>> eicar.com  lista
>> [root@servnozar root]# uvscan / *.* --dat
>> /usr/local/uvscan/datfiles/current/
>> /root/eicar.com
>>         Found: EICAR test file NOT a virus.
>> [root@servnozar root]#
>>
>>
>> This is the maillog
>>
>> Oct 15 09:47:37 servnozar sendmail[9419]: i9F7laxR009419:
>> from=<r_canavate@terra.es>, size=49430, class=0, nrcpts=1,
>> msgid=<HGELIJHMDHKAIELLJFMMMEDIDJAA.r_canavate@terra.es>, proto=ESMTP,
>> daemon=Daemon0, relay=smtp.terra.es [213.4.129.129]
>> Oct 15 09:47:48 servnozar MailScanner[9034]: Expanding TNEF archive at
>> /var/spool/MailScanner/incoming/9034/i9F7laxR009419/winmail.dat
>> Oct 15 09:47:49 servnozar MailScanner[9034]:
>> /home/spool.mailscanner/incoming/9034/i9F7laxR009419/winmail.dat/letter43.zi 
>>
>> p        Found the W32/Netsky.p@MM!zip virus !!!
>> Oct 15 09:47:49 servnozar MailScanner[9034]:
>> /home/spool.mailscanner/incoming/9034/i9F7laxR009419/letter43.zip
>> Found the W32/Netsky.p@MM!zip virus !!!
>> Oct 15 09:47:50 servnozar sendmail[9447]: i9F7laxR009419:
>> to=<informatica@nozar.es>, delay=00:00:13, xdelay=00:00:00, mailer=local,
>> pri=120811, dsn=2.0.0, stat=Sent
>>
>> MailScanner version are ...
>>
>> Oct 15 09:43:04 servnozar MailScanner[9034]: MailScanner E-Mail Virus
>> Scanner version 4.25-14 starting...
>> Oct 15 09:43:05 servnozar MailScanner[9034]: Config: calling custom init
>> function MailWatchLogging
>> Oct 15 09:43:05 servnozar MailScanner[9034]: Initialising database
>> connection
>> Oct 15 09:43:06 servnozar MailScanner[9034]: Finished initialising 
>> database
>> connection
>>
>> With SpamAssasin 2.60 and i use too, DCC, razor y pyzor.
>>
>> Linux OS are RedHat 9.0
>>
>> I rememeber the last change was update clamav to 0.80 but was two days 
>> ago,
>> because sometimes I use both.
>> Before, I do some change in mcafee-wrapper, some about the problem with
>> libc.6 or something similar, but with this change the autoupdate don't 
>> work
>> and I return to the first configuration also with mcafee-autoupdate to
>> delete old dats files.
>>
>> -----Mensaje original-----
>> De: Martin Hepworth [mailto:martinh@solid-state-logic.com]
>> Enviado el: viernes, 15 de octubre de 2004 10:40
>> Para: ricardo.canavate@nozar.es
>> Asunto: Re: [MAILSCANNER] Why the messages virus are not stopped by
>> MailScanner?
>>
>>
>> Hi
>>
>> we need more information
>>
>> what virus scanner, and what version?
>> Is the scanner still working - try it from the command line.
>> Are the virus definitions upto date?
>>
>> Does the message in the maillog relate to the actual message the user
>> says has a virus in it, and what scanner are they using?
>>
>> What version of MailScanner?
>>
>> What operating system is the MailScanner system running on.
>>
>>
>> -- 
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Ricardo Luis Cañavate wrote:
>>
>>> Hi friends!!
>>>
>>> Since one month more or less i does not scan virusses in messages. Some
>>> users tell me that they are receiving virus and i do not believe them.
>>>
>>> Looking for scanning messages in the maillog i see this:
>>>
>>>
>>> THE MESSAGE ARE SCAN AND THE VIRUS FOUND IT!!.
>>>
>>> But then I receive the message and the messages are signing as clean in
>>> MailWatch .
>>>
>>> In this last month i do not remember what i have installed.
>>>
>>> Thanks in advanced.
>>>
>>>
>>> Ricardo Luis Cañavate García
>>> Dpto. Informática
>>> NOZAR Grupo Inmobiliario
>>> Tel: 91 758 96 30 | Fax: 91 559 85 82
>>> www.nozar.es
>>>
>>>
>>> ========================================================================= 
>>>
>>> Usted recibe este mensaje porque su dirección e-mail se encuentra en
>>> nuestra base de datos al haber tenido contactos anteriores con nosotros,
>>> por lo que entendemos que contamos con su autorización para enviarle
>>> información profesional. No obstante, si no desea seguir recibiéndola
>>> basta con hacérnoslo saber.
>>> Este mensaje se dirige exclusivamente a su destinatario y puede contener
>>> información privilegiada o confidencial. Si no es vd. el destinatario
>>> indicado, queda notificado de que la utilización, divulgación y/o copia
>>> sin autorización está prohibida en virtud de la legislación vigente.
>>> Si ha recibido este mensaje por error, le rogamos que nos lo comunique
>>> inmediatamente por esta misma vía y proceda a su destrucción.
>>>
>>>
>>> You are receiving this message because your e-mail address is listed in
>>> our database due to previous communications with us,
>>> so we have assumed that we have your permission to send you professional
>>> information. However, if you do not wish to continue to receive such
>>> information then please let us know.
>>> This message is intended exclusively for its addressee and may contain
>>> information that is CONFIDENTIAL and protected by professional 
>>> privilege.
>>> If you are not the intended recipient you are hereby notified that any
>>> dissemination, copy or disclosure of this communication is strictly
>>> prohibited by law. If this message has been received in error, please
>>> immediately notify us via e-mail and delete it.
>>> =======================================================================
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>>
>> =========================================================================
>> Usted recibe este mensaje porque su dirección e-mail se encuentra en 
>> nuestra base de datos al haber tenido contactos anteriores con 
>> nosotros, por lo que entendemos que contamos con su autorización para 
>> enviarle información profesional. No obstante, si no desea seguir 
>> recibiéndola basta con hacérnoslo saber.
>> Este mensaje se dirige exclusivamente a su destinatario y puede 
>> contener información privilegiada o confidencial. Si no es vd. el 
>> destinatario indicado, queda notificado de que la utilización, 
>> divulgación y/o copia sin autorización está prohibida en virtud de la 
>> legislación vigente. Si ha recibido este mensaje por error, le rogamos 
>> que nos lo comunique inmediatamente por esta misma vía y proceda a su 
>> destrucción.
>>
>>
>> You are receiving this message because your e-mail address is listed 
>> in our database due to previous communications with us, so we have 
>> assumed that we have your permission to send you professional 
>> information. However, if you do not wish to continue to receive such 
>> information then please let us know.
>> This message is intended exclusively for its addressee and may contain 
>> information that is CONFIDENTIAL and protected by professional 
>> privilege. If you are not the intended recipient you are hereby 
>> notified that any dissemination, copy or disclosure of this 
>> communication is strictly prohibited by law. If this message has been 
>> received in error, please immediately notify us via e-mail and delete it.
>> =======================================================================
>>
> 

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From pg at NEWHONEST.COM  Fri Oct 15 10:46:29 2004
From: pg at NEWHONEST.COM (Jason)
Date: Thu Jan 12 21:27:17 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3542.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

    Does that mean, putting the following rule on the white list ?

From: 127.0.0.1

Jason

----- Original Message -----
From: "Martin Hepworth" <martinh@SOLID-STATE-LOGIC.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, October 15, 2004 5:19 PM
Subject: Re: how to fight fake email addresss?


> Hi
>
> never trust the 'from' address, use ip-addresses use with the rules.
>
> I have an s separate email gateway machine.
>
> I set mine so email from the server (or LAN) ip-address gets virus
> checked, NOT spam checked but a standard signature attached.
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Jason wrote:
>> Hi,
>>
>>    I'm running an email server to serve only our own employee. So I would
>> like to make some special treatment for emails coming to or going out
>> from
>> users of our server. The treatment I want to make includes spam checking,
>> email splitting, and attachment filename checking.
>>
>>    I know rules are designed to do the job. But will MailScanner fight
>> against fake email addresses? If not, people can fake our email address
>> and
>> get thru.
>>
>> Jason
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 10:57:17 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:17 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3543.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Jason

well sort of..

I use MailScanner rules on the spam and signature options, rather than
whitelisting which I believe will also stop virus scanning....



--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Jason wrote:
> Hi,
>
>    Does that mean, putting the following rule on the white list ?
>
> From: 127.0.0.1
>
> Jason
>
> ----- Original Message -----
> From: "Martin Hepworth" <martinh@SOLID-STATE-LOGIC.COM>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Friday, October 15, 2004 5:19 PM
> Subject: Re: how to fight fake email addresss?
>
>
>> Hi
>>
>> never trust the 'from' address, use ip-addresses use with the rules.
>>
>> I have an s separate email gateway machine.
>>
>> I set mine so email from the server (or LAN) ip-address gets virus
>> checked, NOT spam checked but a standard signature attached.
>>
>> --
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Jason wrote:
>>
>>> Hi,
>>>
>>>    I'm running an email server to serve only our own employee. So I
>>> would
>>> like to make some special treatment for emails coming to or going out
>>> from
>>> users of our server. The treatment I want to make includes spam
>>> checking,
>>> email splitting, and attachment filename checking.
>>>
>>>    I know rules are designed to do the job. But will MailScanner fight
>>> against fake email addresses? If not, people can fake our email address
>>> and
>>> get thru.
>>>
>>> Jason
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 10:33:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner: new Beta release
Message-ID: <mailman.3544.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have just posted the new beta release of MailScanner version 4.35.4.

The main additions this time are the phishing fraud detector and support
for installing on Mandrake Linux systems (developed on Mandrake 10).

Download as usual from www.mailscanner.info.

Please let me know how you get on.

The full ChangeLog is this:

* New Features and Improvements *
- SpamAssassin 3 SPF checks are now better supported.
- Added Disposition-Notification-To and Return-Receipt-To to the list of
   headers I advise you to remove.
- Added "Log Silent Viruses" configuration option.
- Mandrake Linux 10 is now supported by the RPM installation script.
- Added new configuration option "Find Phishing Fraud". This will scan HTML
   messages for links which don't link to the site they appear to. This
   should catch most "phishing" fraud attacks. It uses new text in the
   languages.conf file, so you will need to add the extra lines to yours.
- Added support for F-Secure 4.6x.
- Removed pre-built tnef programs from bin directory of distribution.
- Moved "virusscan" from "First" to "All".

* Fixes *
- Fixed bug where filetype checks that matched no rules were not logged
   properly.
- Fixed problems with MIME::Base64 dependencies.
- Fixed bug with @INC path reversal when loading MIME::Base64 and
   MIME::QuotedPrint.
- Fixed bug where MCP files were quarantined with the wrong owner.
- Fixed bug where MCP files were incorrectly logged if they were also spam.
- Fixed issue where Postfix insisted (quite correctly) on having a space
   after "Subject:" in the headers.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Fri Oct 15 11:10:45 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:17 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3545.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Martin Hepworth wrote:
> Jason
>
> well sort of..
>
> I use MailScanner rules on the spam and signature options, rather than
> whitelisting which I believe will also stop virus scanning....

No, it doesn't stop virus scanning, it just prevent spamassassin from
tagging it as spam.  It does all the SA tests, though, so you're better
off disabling spamassassin/RBL through rulesets instead.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Fri Oct 15 11:14:07 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:17 2006
Subject: YahooGroups Mail - VIRUS
Message-ID: <mailman.3546.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Martin Hepworth wrote:
> Hi
>
> what operating system, version of MailScanner and version of Trend?
> Have you added another antivirus like ClamAV to see what it makes of them?
>
> Does Trend alos mark the email as viruses if you run Trend from the
> command lind against the email?
>
>
> also no html email please - alot of people have trouble with them
>
> and yes I'm top posting which alot of people hate, so I'm not perfect
> either:-)
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Marcelo Daibert - Grupos wrote:
>
>> Hello all,
>>
>> My server has MailScanner instaled, but at a time behind, most of the
>> emails of the yahoogroups is being classified as tends virus.
>>
>> Anyone with the same problem?


It's not considered as a virus, it is considered as dangerous content
because of form HTML tags.  Look for the HTML section of
MailScanner.conf and build rulesets to disable those checks for yahoo
mails, or just use disarm as parameter.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From pg at NEWHONEST.COM  Fri Oct 15 11:50:33 2004
From: pg at NEWHONEST.COM (Jason)
Date: Thu Jan 12 21:27:17 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3547.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

    I'm curious to know whether MailScanner will do a DNS lookup to make
sure the sender's domain matches its ip.

Jason

----- Original Message -----
From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, October 15, 2004 6:10 PM
Subject: Re: how to fight fake email addresss?


> Martin Hepworth wrote:
>> Jason
>>
>> well sort of..
>>
>> I use MailScanner rules on the spam and signature options, rather than
>> whitelisting which I believe will also stop virus scanning....
>
> No, it doesn't stop virus scanning, it just prevent spamassassin from
> tagging it as spam.  It does all the SA tests, though, so you're better
> off disabling spamassassin/RBL through rulesets instead.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 11:34:46 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:17 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3548.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ugo

OK.

I guess it depends where the 'whitelist' is done:

1) in the spam.assassin.prefs.conf file

2) or as the "Is definitely not spam" parameter in MailScanner.conf.

I used a ruleset as part of 2).

Getting confused about where whitelisting occurs etc etc - bad week:-)

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Ugo Bellavance wrote:
> Martin Hepworth wrote:
>
>> Jason
>>
>> well sort of..
>>
>> I use MailScanner rules on the spam and signature options, rather than
>> whitelisting which I believe will also stop virus scanning....
>
>
> No, it doesn't stop virus scanning, it just prevent spamassassin from
> tagging it as spam.  It does all the SA tests, though, so you're better
> off disabling spamassassin/RBL through rulesets instead.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 12:33:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner: new Beta release
Message-ID: <mailman.3549.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
One other thing, I really hope that this time I have cracked the
MIME::Base64 and MIME-tools incompatibility problems. And yes, I know I've
said that before, just no-one's downloading it :-(

At 10:33 15/10/2004, you wrote:
>I have just posted the new beta release of MailScanner version 4.35.4.
>
>The main additions this time are the phishing fraud detector and support
>for installing on Mandrake Linux systems (developed on Mandrake 10).
>
>Download as usual from www.mailscanner.info.
>
>Please let me know how you get on.
>
>The full ChangeLog is this:
>
>* New Features and Improvements *
>- SpamAssassin 3 SPF checks are now better supported.
>- Added Disposition-Notification-To and Return-Receipt-To to the list of
>   headers I advise you to remove.
>- Added "Log Silent Viruses" configuration option.
>- Mandrake Linux 10 is now supported by the RPM installation script.
>- Added new configuration option "Find Phishing Fraud". This will scan HTML
>   messages for links which don't link to the site they appear to. This
>   should catch most "phishing" fraud attacks. It uses new text in the
>   languages.conf file, so you will need to add the extra lines to yours.
>- Added support for F-Secure 4.6x.
>- Removed pre-built tnef programs from bin directory of distribution.
>- Moved "virusscan" from "First" to "All".
>
>* Fixes *
>- Fixed bug where filetype checks that matched no rules were not logged
>   properly.
>- Fixed problems with MIME::Base64 dependencies.
>- Fixed bug with @INC path reversal when loading MIME::Base64 and
>   MIME::QuotedPrint.
>- Fixed bug where MCP files were quarantined with the wrong owner.
>- Fixed bug where MCP files were incorrectly logged if they were also spam.
>- Fixed issue where Postfix insisted (quite correctly) on having a space
>   after "Subject:" in the headers.
>--
>Julian Field
>www.MailScanner.info
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Fri Oct 15 13:29:22 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:17 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3550.1137101237.24926.mailscanner@lists.mailscanner.info>

Hi there,


[...]
>
> I have moved it from being a first match to an all match which makes more
> sense for this option. Very few people allow users to selectively choose
> virus scanning, so it's never come up before. It will change in the next
> release.
thanks to Julian for this..

i could try the change of my sendmail.cf, but i would like not to do so,
as everythings is working fine for now..

maybe i should point out, that my system is a private one with only up to
10 mail-users..
and one of them is a bit strange, who thinks that his virus-scanner on his
desktop seems to be enough for him and every change within the mails would
be against his "legal rights"..

he is some kind of an oddball ;)

always thinking of some kind of conspiracy and so on..

So..thanks for the answers..and everyone supporting :)

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Fri Oct 15 13:32:13 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:17 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3551.1137101237.24926.mailscanner@lists.mailscanner.info>

Hi there,

> >
> > and put these into virus.scanner.rules and to spam.scanner.rules..
>
> You cannot have rules for virus scanning.  It scans everything or nothing.

i think you are wrong there:
See in the config-file:



# Do you want to scan email for viruses?
# This can also be the filename of a ruleset.

You are right, if you think of the virus-scanners to use..

# Which Virus Scanning package to use:
# This *cannot* be the filename of a ruleset.


But..who should change this anyway? ;)

>
> I know it's been discussed on this list.  Did you search the archive?
no..i haven´t..sorry for that..



Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Q.G.Campbell at NEWCASTLE.AC.UK  Fri Oct 15 13:33:12 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:17 2006
Subject: Re. Phishing fraud question
Message-ID: <mailman.3552.1137101237.24926.mailscanner@lists.mailscanner.info>

Julian

I take it that your new phishing code would tackle some of the problems
identified in the latest AUSCERT warning. See
http://www.auscert.org.au/render.html?it=4474?

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own." 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 13:44:06 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:17 2006
Subject: Why the messages virus are not stopped by MailScanner?
Message-ID: <mailman.3553.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ricardo

Ok

Mailwatch will only take the information from MS. As to the virus 
message it depends on what virus regex it's looking for.

There are some alternatives it needs to look for, check the archives of 
the mailwatch-users list.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Ricardo Luis Cañavate wrote:
> I have just finished upgrade MailScanner to 4.38.8, now the message are not
> received this is the log.
> 
> Oct 15 13:32:06 servnozar sendmail[23662]: i9FBW5Br023662:
> from=<r_canavate@terra.es>, size=39427, class=0, nrcpts=2,
> msgid=<HGELIJHMDHKAIELLJFMMCEDPDJAA.r_canavate@terra.es>, proto=ESMTP,
> daemon=Daemon0, relay=smtp.terra.es [213.4.129.129]
> Oct 15 13:32:12 servnozar MailScanner[22928]: Expanding TNEF archive at
> /var/spool/MailScanner/incoming/22928/i9FBW5Br023662/winmail.dat
> Oct 15 13:32:14 servnozar MailScanner[22928]:
> /home/spool.mailscanner/incoming/22928/i9FBW5Br023662/winmail.dat/Part-2.zip
> Found the W32/Netsky.z@MM!zip virus !!!
> Oct 15 13:32:14 servnozar MailScanner[22928]:
> /home/spool.mailscanner/incoming/22928/i9FBW5Br023662/Part-2.zip
> Found the W32/Netsky.z@MM!zip virus !!!
> Oct 15 13:32:14 servnozar MailScanner[22928]:
> /home/spool.mailscanner/incoming/22928/i9FBW5Br023662/Part-2.txt    .exe
> Found the W32/Netsky.z@MM virus !!!
> Oct 15 13:32:15 servnozar MailScanner[22928]:
> /home/spool.mailscanner/incoming/22928/./i9FBW5Br023662/winmail.dat:
> Worm.SomeFool.Z FOUND
> Oct 15 13:32:15 servnozar MailScanner[22928]:
> /home/spool.mailscanner/incoming/22928/./i9FBW5Br023662/Part-2.zip:
> Worm.SomeFool.Z FOUND
> Oct 15 13:32:15 servnozar MailScanner[22928]:
> /home/spool.mailscanner/incoming/22928/./i9FBW5Br023662/Part-2.txt    .exe:
> Worm.SomeFool.Z FOUND
> Oct 15 13:32:16 servnozar MailScanner[22928]: Filename Checks: Windows/DOS
> Executable (i9FBW5Br023662 Part-2.txt
> .exe)
> Oct 15 13:32:16 servnozar MailScanner[22928]: Filetype Checks: No
> executables (i9FBW5Br023662 Part-2.txt
> .exe)
> Oct 15 13:32:16 servnozar MailScanner[22928]: Saved entire message to
> /var/spool/MailScanner/quarantine/20041015/i9FBW5Br023662
> Oct 15 13:32:16 servnozar MailScanner[22928]: Saved infected "Part-2.txt
> .exe" to /var/spool/MailScanner/quarantine/20041015/i9FBW5Br023662
> 
> 
> It's possible that MailWatch not sign as Virus for the Filetype check?
> 
> Thanks
> 
> -----Mensaje original-----
> De: Martin Hepworth [mailto:martinh@solid-state-logic.com]
> Enviado el: viernes, 15 de octubre de 2004 11:25
> Para: ricardo.canavate@nozar.es
> Asunto: Re: [MAILSCANNER] Why the messages virus are not stopped by
> MailScanner?
> 
> 
> Ricardo
> 
> OK both your MailScanner and Spamassassin are quite old, I'd suggest you
> uprgade your MailScanner first (what out for having to reinstall the
> MailWatch as well), then the SpamAssassin to 4.34 and 2.64 respectively.
> 
> I seem to remember sometime in the last few months changed to MS so as
> to fix issues with virus scanning especially on 'bounced' emails. If I'm
> wrong on this I'm sure I'll be corrected.....:-)
> 
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> 
> Ricardo Luis Cañavate wrote:
> 
>>I am using McAfee and I think are the last version
>>
>>[root@servnozar root]# uvscan --version --dat
>>/usr/local/uvscan/datfiles/current/
>>Virus Scan for Linux v4.32.0
>>Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights
>>reserved.
>>(408) 988-3832  LICENSED COPY - Nov 27 2003
>>
>>Scan engine v4.3.20 for Linux.
>>Virus data file v4399 created Oct 14 2004
>>Scanning for 103750 viruses, trojans and variants.
>>
>>[root@servnozar root]#
>>
>>And works well
>>
>>[root@servnozar root]# ls
>>eicar.com  lista
>>[root@servnozar root]# uvscan / *.* --dat
>>/usr/local/uvscan/datfiles/current/
>>/root/eicar.com
>>        Found: EICAR test file NOT a virus.
>>[root@servnozar root]#
>>
>>
>>This is the maillog
>>
>>Oct 15 09:47:37 servnozar sendmail[9419]: i9F7laxR009419:
>>from=<r_canavate@terra.es>, size=49430, class=0, nrcpts=1,
>>msgid=<HGELIJHMDHKAIELLJFMMMEDIDJAA.r_canavate@terra.es>, proto=ESMTP,
>>daemon=Daemon0, relay=smtp.terra.es [213.4.129.129]
>>Oct 15 09:47:48 servnozar MailScanner[9034]: Expanding TNEF archive at
>>/var/spool/MailScanner/incoming/9034/i9F7laxR009419/winmail.dat
>>Oct 15 09:47:49 servnozar MailScanner[9034]:
>>
> 
> /home/spool.mailscanner/incoming/9034/i9F7laxR009419/winmail.dat/letter43.zi
> 
>>p        Found the W32/Netsky.p@MM!zip virus !!!
>>Oct 15 09:47:49 servnozar MailScanner[9034]:
>>/home/spool.mailscanner/incoming/9034/i9F7laxR009419/letter43.zip
>>Found the W32/Netsky.p@MM!zip virus !!!
>>Oct 15 09:47:50 servnozar sendmail[9447]: i9F7laxR009419:
>>to=<informatica@nozar.es>, delay=00:00:13, xdelay=00:00:00, mailer=local,
>>pri=120811, dsn=2.0.0, stat=Sent
>>
>>MailScanner version are ...
>>
>>Oct 15 09:43:04 servnozar MailScanner[9034]: MailScanner E-Mail Virus
>>Scanner version 4.25-14 starting...
>>Oct 15 09:43:05 servnozar MailScanner[9034]: Config: calling custom init
>>function MailWatchLogging
>>Oct 15 09:43:05 servnozar MailScanner[9034]: Initialising database
>>connection
>>Oct 15 09:43:06 servnozar MailScanner[9034]: Finished initialising
> 
> database
> 
>>connection
>>
>>With SpamAssasin 2.60 and i use too, DCC, razor y pyzor.
>>
>>Linux OS are RedHat 9.0
>>
>>I rememeber the last change was update clamav to 0.80 but was two days
> 
> ago,
> 
>>because sometimes I use both.
>>Before, I do some change in mcafee-wrapper, some about the problem with
>>libc.6 or something similar, but with this change the autoupdate don't
> 
> work
> 
>>and I return to the first configuration also with mcafee-autoupdate to
>>delete old dats files.
>>
>>-----Mensaje original-----
>>De: Martin Hepworth [mailto:martinh@solid-state-logic.com]
>>Enviado el: viernes, 15 de octubre de 2004 10:40
>>Para: ricardo.canavate@nozar.es
>>Asunto: Re: [MAILSCANNER] Why the messages virus are not stopped by
>>MailScanner?
>>
>>
>>Hi
>>
>>we need more information
>>
>>what virus scanner, and what version?
>>Is the scanner still working - try it from the command line.
>>Are the virus definitions upto date?
>>
>>Does the message in the maillog relate to the actual message the user
>>says has a virus in it, and what scanner are they using?
>>
>>What version of MailScanner?
>>
>>What operating system is the MailScanner system running on.
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>Ricardo Luis Cañavate wrote:
>>
>>
>>>Hi friends!!
>>>
>>>Since one month more or less i does not scan virusses in messages. Some
>>>users tell me that they are receiving virus and i do not believe them.
>>>
>>>Looking for scanning messages in the maillog i see this:
>>>
>>>
>>>THE MESSAGE ARE SCAN AND THE VIRUS FOUND IT!!.
>>>
>>>But then I receive the message and the messages are signing as clean in
>>>MailWatch .
>>>
>>>In this last month i do not remember what i have installed.
>>>
>>>Thanks in advanced.
>>>
>>>
>>>Ricardo Luis Cañavate García
>>>Dpto. Informática
>>>NOZAR Grupo Inmobiliario
>>>Tel: 91 758 96 30 | Fax: 91 559 85 82
>>>www.nozar.es
>>>
>>>
>>>=========================================================================
>>>Usted recibe este mensaje porque su dirección e-mail se encuentra en
>>>nuestra base de datos al haber tenido contactos anteriores con nosotros,
>>>por lo que entendemos que contamos con su autorización para enviarle
>>>información profesional. No obstante, si no desea seguir recibiéndola
>>>basta con hacérnoslo saber.
>>>Este mensaje se dirige exclusivamente a su destinatario y puede contener
>>>información privilegiada o confidencial. Si no es vd. el destinatario
>>>indicado, queda notificado de que la utilización, divulgación y/o copia
>>>sin autorización está prohibida en virtud de la legislación vigente.
>>>Si ha recibido este mensaje por error, le rogamos que nos lo comunique
>>>inmediatamente por esta misma vía y proceda a su destrucción.
>>>
>>>
>>>You are receiving this message because your e-mail address is listed in
>>>our database due to previous communications with us,
>>>so we have assumed that we have your permission to send you professional
>>>information. However, if you do not wish to continue to receive such
>>>information then please let us know.
>>>This message is intended exclusively for its addressee and may contain
>>>information that is CONFIDENTIAL and protected by professional privilege.
>>>If you are not the intended recipient you are hereby notified that any
>>>dissemination, copy or disclosure of this communication is strictly
>>>prohibited by law. If this message has been received in error, please
>>>immediately notify us via e-mail and delete it.
>>>=======================================================================
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>
>>=========================================================================
>>Usted recibe este mensaje porque su dirección e-mail se encuentra en
>>nuestra base de datos al haber tenido contactos anteriores con nosotros,
>>por lo que entendemos que contamos con su autorización para enviarle
>>información profesional. No obstante, si no desea seguir recibiéndola
>>basta con hacérnoslo saber.
>>Este mensaje se dirige exclusivamente a su destinatario y puede contener
>>información privilegiada o confidencial. Si no es vd. el destinatario
>>indicado, queda notificado de que la utilización, divulgación y/o copia
>>sin autorización está prohibida en virtud de la legislación vigente.
>>Si ha recibido este mensaje por error, le rogamos que nos lo comunique
>>inmediatamente por esta misma vía y proceda a su destrucción.
>>
>>
>>You are receiving this message because your e-mail address is listed in
>>our database due to previous communications with us,
>>so we have assumed that we have your permission to send you professional
>>information. However, if you do not wish to continue to receive such
>>information then please let us know.
>>This message is intended exclusively for its addressee and may contain
>>information that is CONFIDENTIAL and protected by professional privilege.
>>If you are not the intended recipient you are hereby notified that any
>>dissemination, copy or disclosure of this communication is strictly
>>prohibited by law. If this message has been received in error, please
>>immediately notify us via e-mail and delete it.
>>=======================================================================
>>
> 
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
> 
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
> 
> **********************************************************************
> 
> 
> =========================================================================
> Usted recibe este mensaje porque su dirección e-mail se encuentra en 
> nuestra base de datos al haber tenido contactos anteriores con nosotros, 
> por lo que entendemos que contamos con su autorización para enviarle 
> información profesional. No obstante, si no desea seguir recibiéndola 
> basta con hacérnoslo saber.
> Este mensaje se dirige exclusivamente a su destinatario y puede contener 
> información privilegiada o confidencial. Si no es vd. el destinatario 
> indicado, queda notificado de que la utilización, divulgación y/o copia 
> sin autorización está prohibida en virtud de la legislación vigente. 
> Si ha recibido este mensaje por error, le rogamos que nos lo comunique 
> inmediatamente por esta misma vía y proceda a su destrucción.
> 
> 
> You are receiving this message because your e-mail address is listed in 
> our database due to previous communications with us, 
> so we have assumed that we have your permission to send you professional 
> information. However, if you do not wish to continue to receive such 
> information then please let us know.
> This message is intended exclusively for its addressee and may contain 
> information that is CONFIDENTIAL and protected by professional privilege. 
> If you are not the intended recipient you are hereby notified that any 
> dissemination, copy or disclosure of this communication is strictly 
> prohibited by law. If this message has been received in error, please 
> immediately notify us via e-mail and delete it.
> =======================================================================
> 

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From gercke at HNM.DE  Fri Oct 15 14:18:42 2004
From: gercke at HNM.DE (Daniel Gercke)
Date: Thu Jan 12 21:27:17 2006
Subject: sometimes Re: to Virus Document getting throught
Message-ID: <mailman.3554.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
it is a bounce email, and i´m using an older version of mailscanner 
(4.28.5).

all other emails which contains these netsky variant will be catched, 
only from mailerdaemon@t-online.de will getting throught. If you want, i 
can send a zip file including a saved copie in mbox format

Daniel Gercke

programmierung . system managements


Martin Hepworth schrieb:
> Hi
> 
> Netsky-x has been around since April so the AV should pick it.
> 
> Is this email a 'bounce' or an original email?
> 
> Also what version of MailScanner?
> 
> -- 
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
> 
> 
> Daniel Gercke wrote:
> 
>> Hi all,
>>
>> since 2 days we receive returned mail form t-online.de Mailer-Daemon,
>> where original Mail was a Virus. Norton Antivirus found Netsky.X but
>> none of the Virus Scanner in Mailscanner found these Virus.
>>
>> Virusscanner running (Norman,f-prot,clamav)
>>
>> Any ideas?
>> -- 
>>
>> Daniel Gercke
>>
>>
>> -- 
>> haus neuer medien GmbH . agentur fuer neuen antrieb
>> .
>> Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
>> Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
>> AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
>> .
>> -- 
>> [Diese Nachricht gilt als frei von Viren und gefaehrlichen 
>> Dateianhaengen.
>> Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder
>> Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> 
> **********************************************************************
> 
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
> 
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
> 
> **********************************************************************
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 


--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
.
-- 
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 14:12:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: Re. Phishing fraud question
Message-ID: <mailman.3555.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Yes, it certainly should. There are a large number of these scams, and they
are on the increase very rapidly. My phishing code requires no "signatures"
or updates of any kind, it just looks for links that don't go where they
say they will.

At 13:33 15/10/2004, you wrote:
>Julian
>
>I take it that your new phishing code would tackle some of the problems
>identified in the latest AUSCERT warning. See
>http://www.auscert.org.au/render.html?it=4474?
>
>Quentin

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Fri Oct 15 14:54:23 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:17 2006
Subject: Re. Phishing fraud question
Message-ID: <mailman.3556.1137101237.24926.mailscanner@lists.mailscanner.info>

Hi there,


> Yes, it certainly should. There are a large number of these scams, and they
> are on the increase very rapidly. My phishing code requires no "signatures"
> or updates of any kind, it just looks for links that don't go where they
> say they will.
>
maybe i am wrong here, but i guess this works that way:

MailScanner checks the HTMl-Mail for the a href-tag and the text which is
the link displayed in the mail,right?
something like -a href="somewhere.com"-nothere.com-/a-  (sorry..but i do
not want to use html-tags ;)

but some phishingmails do use images with the so called content and they
do contain image-maps, which are behind the so called "text", but do link
somewhere else..

or maybe i am completly wrong here??

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dustin.baer at IHS.COM  Fri Oct 15 14:38:19 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:17 2006
Subject: sometimes Re: to Virus Document getting through
Message-ID: <mailman.3557.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Daniel Gercke wrote:

> it is a bounce email, and i´m using an older version of mailscanner 
> (4.28.5).


Since it is a bounce, it is just the virus spoofing the sender's 
address.  When the receiving email server rejects it, it goes to the 
"sender," which in your case is someone at your organization.  The other 
mail server has probably already removed the virus.

More of a nuisance than anything.

Thankfully, MailScanner can be configured to not send virus 
notifications to "senders" of viruses.

Dustin
-- 
Dustin Baer
Transport Extranet Network Services
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 15 14:44:23 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:17 2006
Subject: sometimes Re: to Virus Document getting throught
Message-ID: <mailman.3558.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Daniel

had a look in http://www.sng.ecs.soton.ac.uk/mailscanner/ChangeLog and 
couldn't spot anything in the fixes that mentioned anything like this.

You don't mention what your MTA is, but there are quite a few fixes in 
later versions for postfix...and the mailserver on mail.hnm.de is being 
quiet about what it's running;-)

Might be worthwhile upgrading to 4.34, seeing if the problem still exists.


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Daniel Gercke wrote:
> it is a bounce email, and i´m using an older version of mailscanner 
> (4.28.5).
> 
> all other emails which contains these netsky variant will be catched, 
> only from mailerdaemon@t-online.de will getting throught. If you want, i 
> can send a zip file including a saved copie in mbox format
> 
> Daniel Gercke
> 
> programmierung . system managements
> 
> 
> Martin Hepworth schrieb:
> 
>> Hi
>>
>> Netsky-x has been around since April so the AV should pick it.
>>
>> Is this email a 'bounce' or an original email?
>>
>> Also what version of MailScanner?
>>
>> -- 
>> Martin Hepworth
>> Snr Systems Administrator
>> Solid State Logic
>> Tel: +44 (0)1865 842300
>>
>>
>> Daniel Gercke wrote:
>>
>>> Hi all,
>>>
>>> since 2 days we receive returned mail form t-online.de Mailer-Daemon,
>>> where original Mail was a Virus. Norton Antivirus found Netsky.X but
>>> none of the Virus Scanner in Mailscanner found these Virus.
>>>
>>> Virusscanner running (Norman,f-prot,clamav)
>>>
>>> Any ideas?
>>> -- 
>>>
>>> Daniel Gercke
>>>
>>>
>>> -- 
>>> haus neuer medien GmbH . agentur fuer neuen antrieb
>>> .
>>> Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
>>> Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
>>> AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
>>> .
>>> -- 
>>> [Diese Nachricht gilt als frei von Viren und gefaehrlichen 
>>> Dateianhaengen.
>>> Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder
>>> Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>
>> **********************************************************************
>>
>> This email and any files transmitted with it are confidential and
>> intended solely for the use of the individual or entity to whom they
>> are addressed. If you have received this email in error please notify
>> the system manager.
>>
>> This footnote confirms that this email message has been swept
>> for the presence of computer viruses and is believed to be clean.
>>
>> **********************************************************************
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
> 
> 
> -- 
> haus neuer medien GmbH . agentur fuer neuen antrieb
> .
> Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
> Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
> AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
> .

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 15:09:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: Re. Phishing fraud question
Message-ID: <mailman.3559.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:54 15/10/2004, you wrote:
>Hi there,
>
>
> > Yes, it certainly should. There are a large number of these scams, and they
> > are on the increase very rapidly. My phishing code requires no "signatures"
> > or updates of any kind, it just looks for links that don't go where they
> > say they will.
> >
>maybe i am wrong here, but i guess this works that way:
>
>MailScanner checks the HTMl-Mail for the a href-tag and the text which is
>the link displayed in the mail,right?
>something like -a href="somewhere.com"-nothere.com-/a-  (sorry..but i do
>not want to use html-tags ;)

Yes.

>but some phishingmails do use images with the so called content and they
>do contain image-maps, which are behind the so called "text", but do link
>somewhere else..

There's not a lot I can do about that. I'm not about to write an entire OCR
system :-)
Most of that sort of mail will get picked up as spam by SpamAssassin, so it
shouldn't be a big problem.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From David.While at UCE.AC.UK  Fri Oct 15 14:41:59 2004
From: David.While at UCE.AC.UK (David While)
Date: Thu Jan 12 21:27:17 2006
Subject: Re. Phishing fraud question
Message-ID: <mailman.3560.1137101237.24926.mailscanner@lists.mailscanner.info>

Interestingly I have received a number of the Postcard emails - all were
tagged as spam. When I investigated them the links were split to reveal
the actual url and the specified URL. I think this must have been the
email client doing this since I don't have the version of MailScanner
running which does this. I use Outlook 2003 on XP SP2. 
--------------------------------------------
David While BSc CEng MBCS CITP
Technical Development Manager
School of Computing & Information
University of Central England
Tel: 0121 331 6211
--------------------------------------------

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: 15 October 2004 14:13
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Re. Phishing fraud question

Yes, it certainly should. There are a large number of these scams, and
they
are on the increase very rapidly. My phishing code requires no
"signatures"
or updates of any kind, it just looks for links that don't go where they
say they will.

At 13:33 15/10/2004, you wrote:
>Julian
>
>I take it that your new phishing code would tackle some of the problems
>identified in the latest AUSCERT warning. See
>http://www.auscert.org.au/render.html?it=4474?
>
>Quentin

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ELKNET.NET  Fri Oct 15 15:35:01 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:17 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3561.1137101237.24926.mailscanner@lists.mailscanner.info>

On Fri, 15 Oct 2004 09:07:06 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

That would be great, thanks!

-Alan

>Do you need me to add the header for SA right at the top? It's an easy
>enough change to make.
>--
>Julian Field

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From gib at TMISNET.COM  Fri Oct 15 15:48:31 2004
From: gib at TMISNET.COM (Gib Gilbertson Jr.)
Date: Thu Jan 12 21:27:17 2006
Subject: Bayes_seen size
Message-ID: <mailman.3562.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi.

Just wondering if it's normal for the bayes_seen file to get so large?

-rw-------   1 root  wheel  158302208 Oct 15 06:13 bayes_seen
-rw-------   1 root  wheel    4898816 Oct 15 06:13 bayes_toks

Thanks

gib


--

      Gib Gilbertson Jr.
     Tierramiga Info Systems
      619-287-8647 Support
      http://www.tmisnet.com
      San Diego's "Friendly ISP"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wright at CYBERVALE.COM  Fri Oct 15 14:46:55 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:17 2006
Subject: RH9 issue with Clam+SA package
Message-ID: <mailman.3563.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Has anybody else come across this problem while 
installing the Clam+SA package&nbsp;on RH9</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><A 
href="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=121969">https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=121969</A></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>&lt;snip&gt;</FONT></DIV>
<DIV><PRE>I also noticed, that Fedora Core 2 hasn't this warning at rebuilding time -
then I found, that Fedora Core 2 delivers Digest/base.pm while Red Hat Linux 9,
Red Hat Enterprise Linux 3 and Fedore Core 1 don't. I simply copied that file
into my RHEL3 system and did a rebuild of perl-Digest-SHA1...</PRE><PRE>&lt;snip&gt;</PRE><PRE>Would someone mind assisting me with this, maybe offlist or something.</PRE><PRE>Thanks</PRE></DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From jstevens at ATHENSDISTRIBUTING.COM  Fri Oct 15 15:59:57 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:17 2006
Subject: RH9 issue with Clam+SA package
Message-ID: <mailman.3564.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=893435614-15102004><FONT face=Arial 
color=#0000ff size=2>I remember haing a few issue but not around the perl 
package. I have found that CPAN i a more stable way to install modues and 
dependencies.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=893435614-15102004><FONT face=Arial 
color=#0000ff size=2>My box sits with perl-5.8.0-88.3 . I built the box with the 
RPM on RH9 CD and used Up2Date for the latest version. Then CPAN for all modules 
and dependencies.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=893435614-15102004><FONT face=Arial 
color=#0000ff size=2></FONT></SPAN>&nbsp;</DIV>
<DIV dir=ltr align=left><SPAN class=893435614-15102004><FONT face=Arial 
color=#0000ff size=2>Also, I used ClamAV tarball, not RPM.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=893435614-15102004><FONT face=Arial 
color=#0000ff size=2></FONT></SPAN>&nbsp;</DIV>
<DIV dir=ltr align=left><SPAN class=893435614-15102004><FONT face=Arial 
color=#0000ff size=2>Hope that helps..</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Terran Wright 
[mailto:wright@CYBERVALE.COM] <BR><B>Sent:</B> Friday, October 15, 2004 8:47 
AM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> RH9 issue with 
Clam+SA package<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2>Has anybody else come across this problem while 
installing the Clam+SA package&nbsp;on RH9</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><A 
href="https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=121969">https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=121969</A></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>&lt;snip&gt;</FONT></DIV>
<DIV><PRE>I also noticed, that Fedora Core 2 hasn't this warning at rebuilding time -
then I found, that Fedora Core 2 delivers Digest/base.pm while Red Hat Linux 9,
Red Hat Enterprise Linux 3 and Fedore Core 1 don't. I simply copied that file
into my RHEL3 system and did a rebuild of perl-Digest-SHA1...</PRE><PRE>&lt;snip&gt;</PRE><PRE>Would someone mind assisting me with this, maybe offlist or something.</PRE><PRE>Thanks</PRE></DIV><BR>-- <BR>This message has been scanned for viruses and 
<BR>dangerous content by <A href="http://www.athensdistributing.com/"></B><B>Athens 
Hyperion Scanner</A>, and is <BR>believed to be clean. 
------------------------ MailScanner list ------------------------ To 
unsubscribe, email <A href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> 
with the words:<BR>'leave mailscanner' in the body of the email.<BR>Before 
posting, read the MAQ (<A 
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
the archives (<A 
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BODY><br />-- 
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.athensdistributing.com/"></b><b>Athens Hyperion Scanner</a>, and is
<br />believed to be clean.
</HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mkettler at EVI-INC.COM  Fri Oct 15 16:11:16 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:17 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3565.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:07 AM 10/15/2004, Julian Field wrote:
> >The Mailscanner hack doesn't help, unfortunately, because MailScanner
> >inserts it at the end of the headers, so SA won't trust it. Go ahead and
> >undo that MailScanner.conf change.
>
>Do you need me to add the header for SA right at the top? It's an easy
>enough change to make.

Really I think using the spam.assassin.prefs.conf trick should work fine
                  Envelope From Header = X-MailScanner-From:

As best I can tell when you user-configure an Envelope From Header, SA
bypasses all of it's header-location checks.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Fri Oct 15 15:59:43 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:17 2006
Subject: No Scanning if one is in To
Message-ID: <mailman.3566.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Marcel Blenkers wrote:
> Hi there,
> 
> 
>>>and put these into virus.scanner.rules and to spam.scanner.rules..
>>
>>You cannot have rules for virus scanning.  It scans everything or nothing.
> 
> 
> i think you are wrong there:

No I'm not...

> See in the config-file:
> 
> 
> 
> # Do you want to scan email for viruses?
> # This can also be the filename of a ruleset.

This setting is for security/vulnerabilities checks, maybe it shoud be 
renamed.

MailScanner loads all virus scanners once per batch, and it is more 
efficient to scan everything than to check which one should be scanned.

> 
> You are right, if you think of the virus-scanners to use..
> 
> # Which Virus Scanning package to use:
> # This *cannot* be the filename of a ruleset.
> 
> 
> But..who should change this anyway? ;)

Some people who would be offering diffent packages for virus and spam 
filtering.

> 
> 
>>I know it's been discussed on this list.  Did you search the archive?
> 
> no..i haven´t..sorry for that..

Please see the footer of every message on this list...

> 
> 
> 
> Greetings
> 
> Marcel
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From ugob at CAMO-ROUTE.COM  Fri Oct 15 15:53:48 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:17 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3567.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Jason wrote:
> Hi,
>
>    I'm curious to know whether MailScanner will do a DNS lookup to make
> sure the sender's domain matches its ip.

What do you mean exactly?  Check that the domain exists?  That's the
MTA's job.  Check that the smtp server used is the good one?  That is
SPF and there are SPF rules in SpamAssassin.

>
> Jason

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Fri Oct 15 16:18:30 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:17 2006
Subject: Bayes_seen size
Message-ID: <mailman.3568.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:48 AM 10/15/2004, Gib Gilbertson Jr. wrote:
>Hi.
>
>Just wondering if it's normal for the bayes_seen file to get so large?
>
>-rw-------   1 root  wheel  158302208 Oct 15 06:13 bayes_seen
>-rw-------   1 root  wheel    4898816 Oct 15 06:13 bayes_toks

Yes, it's normal, but not healthy... SA's expire mechanism doesn't hit
bayes_seen, just bayes_toks.

Mine's not quite as bad as yours, but my bayes_seen is 10x the size of my
_toks.

There's currently a bug slated for 3.1.0 to add expiry to bayes_seen.

http://bugzilla.spamassassin.org/show_bug.cgi?id=2975

Also of note, the AWL database never expires either.. That too is slated
for 3.1.0

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 16:41:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3569.1137101237.24926.mailscanner@lists.mailscanner.info>

Attached are small patches for MCP.pm and SA.pm to effect this change.

At 15:35 15/10/2004, you wrote:
>On Fri, 15 Oct 2004 09:07:06 +0100, Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>That would be great, thanks!
>
>-Alan
>
> >Do you need me to add the header for SA right at the top? It's an easy
> >enough change to make.
> >--
> >Julian Field

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: "MCP.pm.patch")  1.4KB. ]
    [ Unable to print this part. ]


    [ Part 3, Application/OCTET-STREAM (Name: "SA.pm.patch")  1.9KB. ]
    [ Unable to print this part. ]


    [ Part 4: "Attached Text" ]

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From mailscanner at ELKNET.NET  Fri Oct 15 16:40:18 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:17 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3570.1137101237.24926.mailscanner@lists.mailscanner.info>

On Thu, 14 Oct 2004 17:55:35 -0400, Matt Kettler <mkettler@EVI-INC.COM> wrote:

Okay, I changed spam.assassin.prefs.conf as instructed, and then I manually
edited my test message to change the header that MS had inserted at the
bottom to look like 'X-MailScanner-From:', and then manually ran the test
message through spamassassin. It worked great, and reported the hit on
NO_DNS_FOR_FROM.

So, time to go live. I edited MailScanner.conf to use 'Envelope From Header
= X-MailScanner-From:' and restarted MS. Ran a test message through, but no
hit on NO_DNS_FOR_FROM. I examined a message that had made it all the way
through, and verified the bottom header: 'X-MailScanner-From:
arffer@poiuy.net' had been inserted. But SA did not flag it.

So, setting the spam.assassin.prefs.conf fixes messages manually run through
SA, but messages sent to SA via MS still don't work.

-Alan

>I did some digging in the SA code, a bit deeper this time. It looks like
>you have one of two options:
>
>Option 1 - Making SA recognize X-MailScaner-From:
>-----------------------------------------
>
>First change the mailscanner from header back in MailScanner.conf.
>         Envelope From Header = X-MailScanner-From:
>
>
>Next make SA honor it in either local.cf or spam.assassin.prefs.conf:
>         envelope_sender_header  X-MailScanner-From

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From derek at CSOLVE.NET  Fri Oct 15 17:03:15 2004
From: derek at CSOLVE.NET (Derek Buttineau | Compu-SOLVE)
Date: Thu Jan 12 21:27:17 2006
Subject: Filename/Filetype Rules
Message-ID: <mailman.3571.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Kind of a quirky question here.

I'm wondering if it's possible in the current version of MailScanner or
perhaps a future one to add the ability to define per user
filename/filetype rules instead of just system wide ones?  IE on a
rather extreme example, user 1 wishes to receive jpg files and user 2
does not.  Does or can there be an option available to define a user
based filename list to allow/deny this for only one user?

I've taken a quick look through the configuration/code/mailling list and
I don't see any mention of a per user configuration, so thought I'd ask.

Anyway just curious as it's one of the features my superiors would like
to see.

Thanks

--
Regards,

Derek Buttineau
Internet Systems Developer
Compu-SOLVE Internet Services
Compu-SOLVE Technologies Inc.

705.725.1212 x255

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 17:06:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3572.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
And with my patches?

At 16:40 15/10/2004, you wrote:
>On Thu, 14 Oct 2004 17:55:35 -0400, Matt Kettler <mkettler@EVI-INC.COM> wrote:
>
>Okay, I changed spam.assassin.prefs.conf as instructed, and then I manually
>edited my test message to change the header that MS had inserted at the
>bottom to look like 'X-MailScanner-From:', and then manually ran the test
>message through spamassassin. It worked great, and reported the hit on
>NO_DNS_FOR_FROM.
>
>So, time to go live. I edited MailScanner.conf to use 'Envelope From Header
>= X-MailScanner-From:' and restarted MS. Ran a test message through, but no
>hit on NO_DNS_FOR_FROM. I examined a message that had made it all the way
>through, and verified the bottom header: 'X-MailScanner-From:
>arffer@poiuy.net' had been inserted. But SA did not flag it.
>
>So, setting the spam.assassin.prefs.conf fixes messages manually run through
>SA, but messages sent to SA via MS still don't work.
>
>-Alan
>
> >I did some digging in the SA code, a bit deeper this time. It looks like
> >you have one of two options:
> >
> >Option 1 - Making SA recognize X-MailScaner-From:
> >-----------------------------------------
> >
> >First change the mailscanner from header back in MailScanner.conf.
> >         Envelope From Header = X-MailScanner-From:
> >
> >
> >Next make SA honor it in either local.cf or spam.assassin.prefs.conf:
> >         envelope_sender_header  X-MailScanner-From

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sconway at WLNET.COM  Fri Oct 15 17:07:14 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3573.1137101237.24926.mailscanner@lists.mailscanner.info>

Good day:

I had sent previously but missed the reply, if any.

We have an application where we would need to have the following to occur:

>From *@domain.com ,
Copy that entire SMTP message to /anypath/MESSAGEREF.inc
Put a file to /anypath/MESSAGEREF.add which contains each recipient of the
message on a separate line.

Also, the message should stop there, i.e. not be sent out, as the processing
we have on those messages, will anylize then send those.

Is there any way that MailScanner can be set up to do this?

Thanks for any assistance.

Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Fri Oct 15 17:12:49 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:17 2006
Subject: Filename/Filetype Rules
Message-ID: <mailman.3574.1137101237.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Derek Buttineau|Compu-SOLVE
> Sent: Friday, October 15, 2004 12:03 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Filename/Filetype Rules
>
> Kind of a quirky question here.
>
> I'm wondering if it's possible in the current version of MailScanner or
> perhaps a future one to add the ability to define per user
> filename/filetype rules instead of just system wide ones?  IE on a
> rather extreme example, user 1 wishes to receive jpg files and user 2
> does not.  Does or can there be an option available to define a user
> based filename list to allow/deny this for only one user?
>
> I've taken a quick look through the configuration/code/mailling list and
> I don't see any mention of a per user configuration, so thought I'd ask.
>
> Anyway just curious as it's one of the features my superiors would like
> to see.
>

You can do this now. It's been covered many times. Please search the list
archives for "filename rules". It's also in the FAQ:

http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/233.html

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 17:20:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: Filename/Filetype Rules
Message-ID: <mailman.3575.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
You can use a ruleset to point different users at different
filename.rules.conf (or filetype.rules.conf) files. You set one up with an
allow-jpeg-images line and one with a deny-jpeg-images line. Then create a
ruleset so that some users get one, and others get the other. You can even
put a filename in the rule instead of just a single address, and it will be
used for a whole bunch of people.

1. For example, set
Filetype Rules = %rules-dir%/filetype.rules
in MailScanner.conf.

2. Then in %rules-dir%/filetype.rules put a couple of lines like this:

To: /etc/MailScanner/people.who.want.jpegs
/etc/MailScanner/filetype.allow.jpegs.conf
To: /etc/MailScanner/people.who.dontwant.jpegs
/etc/MailScanner/filetype.deny.jpegs.conf

(Sorry if that gets wrapped, it is supposed to be just 2 lines)

3. In /etc/MailScanner/filetype.allow.jpegs.conf you make sure you have a
line that says
allow   JPEG    -       -
(with the 4 words separated by tabs).

4. In /etc/MailScanner/filetype.deny.jpegs.conf you make sure you have a
line that says
deny   JPEG    No JPEG images       No JPEG images allowed
(with the 4 phrases separated by tabs).

5. In /etc/MailScanner/people.who.want.jpegs you list (one per line) all
the email addresses and/or  domains of people who want jpeg images.

6. In /etc/MailScanner/people.who.dontwant.jpegs you list (one per line)
all the email addresses and/or  domains of people who dont want jpeg images.

And then you can just add people to either the people.who.want.jpegs file
or the people.who.dontwant.jpegs file as appropriate.

I admit this example is a bit deficient as you could just say that everyone
who isn't in one list is automatically in the other (using a default entry
in the filetype.rules file), but it's the principle I am trying to demonstrate.

That's nearly as complicated as ruleset systems can get, there's only 1
option I haven't used: you can say "To: user@example.com and From:
joe@company.com yes" and the rule will only fire if both the conditions
around the "and" are satisfied.

At 17:03 15/10/2004, you wrote:
>Kind of a quirky question here.
>
>I'm wondering if it's possible in the current version of MailScanner or
>perhaps a future one to add the ability to define per user
>filename/filetype rules instead of just system wide ones?  IE on a
>rather extreme example, user 1 wishes to receive jpg files and user 2
>does not.  Does or can there be an option available to define a user
>based filename list to allow/deny this for only one user?
>
>I've taken a quick look through the configuration/code/mailling list and
>I don't see any mention of a per user configuration, so thought I'd ask.
>
>Anyway just curious as it's one of the features my superiors would like
>to see.
>
>Thanks
>
>--
>Regards,
>
>Derek Buttineau
>Internet Systems Developer
>Compu-SOLVE Internet Services
>Compu-SOLVE Technologies Inc.
>
>705.725.1212 x255
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Steve.Swaney at FSL.COM  Fri Oct 15 17:17:34 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3576.1137101237.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Stephen Conway
> Sent: Friday, October 15, 2004 12:07 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: MailScanner Text File Creation
>
> Good day:
>
> I had sent previously but missed the reply, if any.
>
> We have an application where we would need to have the following to occur:
>
> From *@domain.com ,
> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> Put a file to /anypath/MESSAGEREF.add which contains each recipient of the
> message on a separate line.
>
> Also, the message should stop there, i.e. not be sent out, as the
> processing
> we have on those messages, will anylize then send those.
>
> Is there any way that MailScanner can be set up to do this?
>

1. Use your MTA to split single emails to multiple recipients into
individual messages for each recipient.

2. Then you can use MailScanner's delivery or archive functions with
rulesets to forward or archive the individual messages.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct 15 17:23:54 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3577.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:07 15/10/2004, you wrote:
>Good day:
>
>I had sent previously but missed the reply, if any.
>
>We have an application where we would need to have the following to occur:
>
> >From *@domain.com ,
>Copy that entire SMTP message to /anypath/MESSAGEREF.inc
>Put a file to /anypath/MESSAGEREF.add which contains each recipient of the
>message on a separate line.
>
>Also, the message should stop there, i.e. not be sent out, as the processing
>we have on those messages, will anylize then send those.
>
>Is there any way that MailScanner can be set up to do this?

You would probably need to write a Custom Function to do this, and probably
attach it to the "non-spam actions" configuration option. This could test
for the *@domain.com and write out the message in the files you want.

The alternative would be to archive mail using "Archive Mail" and a
ruleset, then have a cron job that ran every 5 or 10 minutes and processed
the archive entries to generate the processed data you want, then deleted
the original archive files so it didn't process the same mail twice.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ELKNET.NET  Fri Oct 15 20:48:01 2004
From: mailscanner at ELKNET.NET (Alan)
Date: Thu Jan 12 21:27:17 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3578.1137101237.24926.mailscanner@lists.mailscanner.info>

On Fri, 15 Oct 2004 17:06:53 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>And with my patches?

Julian,
I got these errors:
[root@bester MailScanner]# patch < SA.pm.patch
patching file SA.pm
Hunk #1 FAILED at 320.
1 out of 1 hunk FAILED -- saving rejects to file SA.pm.rej
[root@bester MailScanner]# patch < MCP.pm.patch
patching file MCP.pm
Hunk #1 FAILED at 221.
1 out of 1 hunk FAILED -- saving rejects to file MCP.pm.rej

Do you want me to post the the .rej files?

If it matters, I'm running MailScanner 4.34.8

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sajjad at IINIX.COM  Fri Oct 15 17:35:31 2004
From: sajjad at IINIX.COM (A. Sajjad Zaidi)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner notifies recipients even with Sender Notify off
Message-ID: <mailman.3579.1137101237.24926.mailscanner@lists.mailscanner.info>

Hi all,

I've recently installed MailScanner (4.34.8) on a Solaris system with
ClamAV 0.80r3 and two processes of Exim 4.43, as per instructions. Exim
is currently running on port 26 until the setup is ready to replace the
old Sendmail configuration.

Everything seems to be working fine; legitimate messages get delivered,
viruses and attachments with bad extensions are stopped, but in case of
the latter, a notice is always sent to the recipient.

It's understandable if it goes to the sender when 'Notify Senders' is
on, which it does, but it doesn't make sense to notify the recipient as
well. The notice gets sent regardless of what 'Notify Senders' or the
other notification settings are set to.

I have looked through the MailScanner configuration, but couldn't find
any other setting that may be causing this to happen.

Hope someone here has a simple solution to this.

Best regards,
--
A. Sajjad Zaidi                      http://www.sajjadzaidi.com/
GnuPG Key ID: 0xD7AD0E13

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From derek at CSOLVE.NET  Fri Oct 15 17:53:32 2004
From: derek at CSOLVE.NET (Derek Buttineau | Compu-SOLVE)
Date: Thu Jan 12 21:27:17 2006
Subject: Filename/Filetype Rules
Message-ID: <mailman.3580.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Thanks Julian,

One thing I forgot to mention in the original question in addition was
whether it is possible to handle this functionality with a custom
function instead of using flat files. Currently I have a datasource in
CDB of what filenames/filetypes with user preferences.  From the
description though it sounds like this might be a little difficult (if
even possible) to handle with a custom function.  I guess for now I
could work around this by just regenerating the configuration files
periodicially.

Thanks again.

Regards,

Derek Buttineau
Internet Systems Developer
Compu-SOLVE Internet Services
Compu-SOLVE Technologies Inc.

705.725.1212 x255



Julian Field wrote:

> You can use a ruleset to point different users at different
> filename.rules.conf (or filetype.rules.conf) files. You set one up
> with an
> allow-jpeg-images line and one with a deny-jpeg-images line. Then
> create a
> ruleset so that some users get one, and others get the other. You can
> even
> put a filename in the rule instead of just a single address, and it
> will be
> used for a whole bunch of people.
>
> 1. For example, set
> Filetype Rules = %rules-dir%/filetype.rules
> in MailScanner.conf.
>
> 2. Then in %rules-dir%/filetype.rules put a couple of lines like this:
>
> To: /etc/MailScanner/people.who.want.jpegs
> /etc/MailScanner/filetype.allow.jpegs.conf
> To: /etc/MailScanner/people.who.dontwant.jpegs
> /etc/MailScanner/filetype.deny.jpegs.conf
>
> (Sorry if that gets wrapped, it is supposed to be just 2 lines)
>
> 3. In /etc/MailScanner/filetype.allow.jpegs.conf you make sure you have a
> line that says
> allow   JPEG    -       -
> (with the 4 words separated by tabs).
>
> 4. In /etc/MailScanner/filetype.deny.jpegs.conf you make sure you have a
> line that says
> deny   JPEG    No JPEG images       No JPEG images allowed
> (with the 4 phrases separated by tabs).
>
> 5. In /etc/MailScanner/people.who.want.jpegs you list (one per line) all
> the email addresses and/or  domains of people who want jpeg images.
>
> 6. In /etc/MailScanner/people.who.dontwant.jpegs you list (one per line)
> all the email addresses and/or  domains of people who dont want jpeg
> images.
>
> And then you can just add people to either the people.who.want.jpegs file
> or the people.who.dontwant.jpegs file as appropriate.
>
> I admit this example is a bit deficient as you could just say that
> everyone
> who isn't in one list is automatically in the other (using a default
> entry
> in the filetype.rules file), but it's the principle I am trying to
> demonstrate.
>
> That's nearly as complicated as ruleset systems can get, there's only 1
> option I haven't used: you can say "To: user@example.com and From:
> joe@company.com yes" and the rule will only fire if both the conditions
> around the "and" are satisfied.
>
> At 17:03 15/10/2004, you wrote:
>
>> Kind of a quirky question here.
>>
>> I'm wondering if it's possible in the current version of MailScanner or
>> perhaps a future one to add the ability to define per user
>> filename/filetype rules instead of just system wide ones?  IE on a
>> rather extreme example, user 1 wishes to receive jpg files and user 2
>> does not.  Does or can there be an option available to define a user
>> based filename list to allow/deny this for only one user?
>>
>> I've taken a quick look through the configuration/code/mailling list and
>> I don't see any mention of a per user configuration, so thought I'd ask.
>>
>> Anyway just curious as it's one of the features my superiors would like
>> to see.
>>
>> Thanks
>>
>> --
>> Regards,
>>
>> Derek Buttineau
>> Internet Systems Developer
>> Compu-SOLVE Internet Services
>> Compu-SOLVE Technologies Inc.
>>
>> 705.725.1212 x255
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Fri Oct 15 18:07:20 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:17 2006
Subject: MailScanner notifies recipients even with Sender Notify off
Message-ID: <mailman.3581.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 12:35 PM 10/15/2004, A. Sajjad Zaidi wrote:
>It's understandable if it goes to the sender when 'Notify Senders' is
>on, which it does, but it doesn't make sense to notify the recipient as
>well. The notice gets sent regardless of what 'Notify Senders' or the
>other notification settings are set to.

Why does it not make sense to notify the Recipient? At least then the
recipient has a chance to review if it's really something they expected.
Besides, there may be valuable parts of the message that MS did not quarantine.

Look at the Silent Viruses option in mailscanner.conf if you want to
silence all notices. You'll also need to turn off "Still Deliver Silent
Viruses".

Quite frankly, it *ONLY* makes sense to notify the Recipient if you suspect
a virus, as the sender is likely a forgery.

IMHO it is actually a malicious misconfiguration of a server to even try to
notify the sender with a post-delivery return unless you have reason to
believe it's not forged. As a matter of policy I outright blacklist SMTP
servers sending more than 2 broken virus notices in the same week to my
network. Some viruses don't forge, and for those few, it's fine, but if I
get 3 notices claiming mkettxxx@evi-inc.com sent you a netsky virus, a
notice is sent to postmaster and the server gets blacklisted. I tend to
remove those blacklists when they become quiet with no messages from the
server for at least 1 month.

I handle broken list-post bounces, and broken vacation rules the same way,
although I clear vacation blockades after 2 weeks.

It's a harsh policy, but I need to protect my network from risk of being
flooded with thousands of broken virus notices from one of these servers.
Broken notices are as bad as spam, if not worse, and they waste resources
here on my network.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vboulytchev at COINFOTECH.COM  Fri Oct 15 19:36:32 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:17 2006
Subject: Speed Monitoring
Message-ID: <mailman.3582.1137101237.24926.mailscanner@lists.mailscanner.info>


Ladies and Gents,
        After turning on Speed Logging in MailScanner.conf, I see lines
such as:

 Batch completed at 4648 bytes per second (1859342 / 400)


I am translating this as :

Batch completed at x bytes per second ( totalbytes / totalseconds)

Am I correct to say that the entire batch was 1859342 bytes and it took
400 seconds to scan it?




Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  6KB. ]
    [ Unable to print this part. ]


From BBerglund at TECHPRO.COM  Fri Oct 15 19:57:06 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:17 2006
Subject: Transport file
Message-ID: <mailman.3583.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.3790.186" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Can the transport 
file of postfix be setup to read from a mysql database?<BR>Like if the database 
has a table with </FONT></SPAN></DIV>
<DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>domain name and 
relay server</FONT></SPAN></DIV>
<DIV><SPAN class=769465518-15102004><FONT face=Arial 
size=2>whatever.com,172.26.2.1</FONT></SPAN></DIV>
<DIV><SPAN class=769465518-15102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Then the transport 
would read from that and relay to the appropriate 
server?<BR></FONT></SPAN></DIV>
<DIV>&nbsp;</DIV>
<DIV align=left>
<MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=3 direction=right behavior=slide loop=1 border="0">
<TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD>
      <DIV 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
      Berglund</DIV></TD>
    <TD></TD></TR>
  <TR>
    <TD>
      <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
      href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
<BR>
<MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=5 behavior=slide loop=1 border="2">
<TABLE cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
      src="cid:769465518@15102004-1971" width=110 border=0></A></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
      Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
      Boulevard<BR>Geneva, IL 60134 
</TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
<BR>
<TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD align=right colSpan=2><A 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
      href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
      m</A><BR></TD></TR></TBODY></TABLE>
<DIV style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
<DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
e-mail and any accompanying documents is confidential, may be privileged, and is 
intended solely for the person and/or entity to whom it is addressed (i.e. those 
identified in the "To" and "Cc" box). They are the property of TechPro, Inc. 
Unauthorized review, use, disclosure, or copying of this communication, or any 
part thereof, is strictly prohibited and may be unlawful. If you have received 
this e-mail in error, please return the e-mail and attachments to the sender and 
delete the e-mail and attachments and any copy from your system. TechPro, Inc. 
Thank you for your cooperation.</SPAN> </DIV>
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo6.gif: 00000001,2bcd2264,00000000,00000000

From mkettler at EVI-INC.COM  Fri Oct 15 20:14:08 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:17 2006
Subject: Speed Monitoring
Message-ID: <mailman.3584.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:36 PM 10/15/2004, Boulytchev, Vasiliy wrote:
>Ladies and Gents,
>         After turning on Speed Logging in MailScanner.conf, I see lines
> such as:
>
>  Batch completed at 4648 bytes per second (1859342 / 400)
>
>I am translating this as :
>
>Batch completed at x bytes per second ( totalbytes / totalseconds)
>
>Am I correct to say that the entire batch was 1859342 bytes and it took
>400 seconds to scan it?

Yes, although IMO, that statistic is largely useless if SA is involved.

SA's scan time is much more a function of message count than of message
size, particularly if DNSBLs are enabled. Although it's actual timing is
really quite widely scattered it's certainly more correlated to the number
of messages in a batch than the size of the batch. Large body sizes
increase SA's scan time a bit, but that's usualy drown out by the time it
takes to do DNSBLs.

Also, bear in mind that the timing is done in whole-second increments and
the rounding makes for some hefty errors. (ie: if a batch is 5k in size,
even if it takes .1ms to scan it, it will be reported as 1 second and 5k/sec.)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rob at THEHOSTMASTERS.COM  Fri Oct 15 21:12:47 2004
From: rob at THEHOSTMASTERS.COM (Rob)
Date: Thu Jan 12 21:27:17 2006
Subject: Transport file
Message-ID: <mailman.3585.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2180" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>A quick question off topic.... </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Hey Brian how did you get that cool signature to 
work?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR>Rob....</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR>&nbsp;</DIV>
<BLOCKQUOTE 
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV 
  style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B> 
  <A title=BBerglund@TECHPRO.COM href="mailto:BBerglund@TECHPRO.COM">Brian 
  Berglund</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK 
  href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, October 15, 2004 2:57 
  PM</DIV>
  <DIV style="FONT: 10pt arial"><B>Subject:</B> Transport file</DIV>
  <DIV><BR></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Can the transport 
  file of postfix be setup to read from a mysql database?<BR>Like if the 
  database has a table with </FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>domain name and 
  relay server</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2>whatever.com,172.26.2.1</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Then the transport 
  would read from that and relay to the appropriate 
  server?<BR></FONT></SPAN></DIV>
  <DIV>&nbsp;</DIV>
  <DIV align=left>
  <MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=3 direction=right behavior=slide loop=1 border="0">
  <TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD>
        <DIV 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
        Berglund</DIV></TD>
      <TD></TD></TR>
    <TR>
      <TD>
        <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
        href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
  <BR>
  <MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=5 behavior=slide loop=1 border="2">
  <TABLE cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
        src="cid:010b01c4b2f3$56a22340$6400a8c0@flex.com" width=110 
      border=0></A></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
        Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
        Boulevard<BR>Geneva, IL 60134 
  </TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
  <BR>
  <TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD align=right colSpan=2><A 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
        href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
        m</A><BR></TD></TR></TBODY></TABLE>
  <DIV 
style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
  <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
  Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
  e-mail and any accompanying documents is confidential, may be privileged, and 
  is intended solely for the person and/or entity to whom it is addressed (i.e. 
  those identified in the "To" and "Cc" box). They are the property of TechPro, 
  Inc. Unauthorized review, use, disclosure, or copying of this communication, 
  or any part thereof, is strictly prohibited and may be unlawful. If you have 
  received this e-mail in error, please return the e-mail and attachments to the 
  sender and delete the e-mail and attachments and any copy from your system. 
  TechPro, Inc. Thank you for your cooperation.</SPAN> </DIV>
  <DIV>&nbsp;</DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo7.gif: 00000001,04f44e24,00000000,00000000

From BBerglund at TECHPRO.COM  Fri Oct 15 21:33:14 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:17 2006
Subject: Transport file
Message-ID: <mailman.3586.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.3790.186" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=176483220-15102004><FONT face=Arial 
color=#0000ff size=2>It is a web based htm file... </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=176483220-15102004><FONT face=Arial 
color=#0000ff size=2>You should be able to right click and view source and get a 
copy. </FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list 
[mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Rob<BR><B>Sent:</B> 
Friday, October 15, 2004 3:13 PM<BR><B>To:</B> 
MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Transport 
file<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2>A quick question off topic.... </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Hey Brian how did you get that cool signature to 
work?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR>Rob....</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR>&nbsp;</DIV>
<BLOCKQUOTE 
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV 
  style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B> 
  <A title=BBerglund@TECHPRO.COM href="mailto:BBerglund@TECHPRO.COM">Brian 
  Berglund</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK 
  href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, October 15, 2004 2:57 
  PM</DIV>
  <DIV style="FONT: 10pt arial"><B>Subject:</B> Transport file</DIV>
  <DIV><BR></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Can the transport 
  file of postfix be setup to read from a mysql database?<BR>Like if the 
  database has a table with </FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>domain name and 
  relay server</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2>whatever.com,172.26.2.1</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Then the transport 
  would read from that and relay to the appropriate 
  server?<BR></FONT></SPAN></DIV>
  <DIV>&nbsp;</DIV>
  <DIV align=left>
  <MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=3 direction=right behavior=slide loop=1 border="0">
  <TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD>
        <DIV 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
        Berglund</DIV></TD>
      <TD></TD></TR>
    <TR>
      <TD>
        <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
        href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
  <BR>
  <MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=5 behavior=slide loop=1 border="2">
  <TABLE cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
        src="cid:176483220@15102004-197F" width=110 border=0></A></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
        Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
        Boulevard<BR>Geneva, IL 60134 
  </TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
  <BR>
  <TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD align=right colSpan=2><A 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
        href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
        m</A><BR></TD></TR></TBODY></TABLE>
  <DIV 
style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
  <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
  Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
  e-mail and any accompanying documents is confidential, may be privileged, and 
  is intended solely for the person and/or entity to whom it is addressed (i.e. 
  those identified in the "To" and "Cc" box). They are the property of TechPro, 
  Inc. Unauthorized review, use, disclosure, or copying of this communication, 
  or any part thereof, is strictly prohibited and may be unlawful. If you have 
  received this e-mail in error, please return the e-mail and attachments to the 
  sender and delete the e-mail and attachments and any copy from your system. 
  TechPro, Inc. Thank you for your cooperation.</SPAN> </DIV>
  <DIV>&nbsp;</DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE>------------------------ MailScanner list ------------------------ 
To unsubscribe, email <A 
href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, read 
the MAQ (<A 
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
the archives (<A 
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo8.gif: 00000001,2bc4ca4a,00000000,00000000

From BBerglund at TECHPRO.COM  Fri Oct 15 21:33:55 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:17 2006
Subject: Transport file
Message-ID: <mailman.3587.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.3790.186" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=019313320-15102004><FONT face=Arial 
color=#0000ff size=2>What is the best virus scanning software to use with 
Mailscanner?<BR></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=019313320-15102004><FONT face=Arial 
color=#0000ff size=2>I am going to try ClamVS,&nbsp; any other 
suggestions?<BR></DIV></FONT></SPAN><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list 
[mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Rob<BR><B>Sent:</B> 
Friday, October 15, 2004 3:13 PM<BR><B>To:</B> 
MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Transport 
file<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2>A quick question off topic.... </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Hey Brian how did you get that cool signature to 
work?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR>Rob....</DIV>
<DIV>&nbsp;</DIV>
<DIV><BR>&nbsp;</DIV>
<BLOCKQUOTE 
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
  <DIV 
  style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B> 
  <A title=BBerglund@TECHPRO.COM href="mailto:BBerglund@TECHPRO.COM">Brian 
  Berglund</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>To:</B> <A title=MAILSCANNER@JISCMAIL.AC.UK 
  href="mailto:MAILSCANNER@JISCMAIL.AC.UK">MAILSCANNER@JISCMAIL.AC.UK</A> </DIV>
  <DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, October 15, 2004 2:57 
  PM</DIV>
  <DIV style="FONT: 10pt arial"><B>Subject:</B> Transport file</DIV>
  <DIV><BR></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Can the transport 
  file of postfix be setup to read from a mysql database?<BR>Like if the 
  database has a table with </FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>domain name and 
  relay server</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2>whatever.com,172.26.2.1</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2></FONT></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Then the transport 
  would read from that and relay to the appropriate 
  server?<BR></FONT></SPAN></DIV>
  <DIV>&nbsp;</DIV>
  <DIV align=left>
  <MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=3 direction=right behavior=slide loop=1 border="0">
  <TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD>
        <DIV 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
        Berglund</DIV></TD>
      <TD></TD></TR>
    <TR>
      <TD>
        <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
        href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
  <BR>
  <MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
  scrollDelay=5 behavior=slide loop=1 border="2">
  <TABLE cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
        src="cid:019313320@15102004-1986" width=110 border=0></A></TD>
      <TD 
      style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
        Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
        style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
        Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
        Boulevard<BR>Geneva, IL 60134 
  </TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
  <BR>
  <TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
    <TBODY>
    <TR>
      <TD align=right colSpan=2><A 
        style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
        href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
        m</A><BR></TD></TR></TBODY></TABLE>
  <DIV 
style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
  <DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
  Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
  e-mail and any accompanying documents is confidential, may be privileged, and 
  is intended solely for the person and/or entity to whom it is addressed (i.e. 
  those identified in the "To" and "Cc" box). They are the property of TechPro, 
  Inc. Unauthorized review, use, disclosure, or copying of this communication, 
  or any part thereof, is strictly prohibited and may be unlawful. If you have 
  received this e-mail in error, please return the e-mail and attachments to the 
  sender and delete the e-mail and attachments and any copy from your system. 
  TechPro, Inc. Thank you for your cooperation.</SPAN> </DIV>
  <DIV>&nbsp;</DIV>------------------------ MailScanner list 
  ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BLOCKQUOTE>------------------------ MailScanner list ------------------------ 
To unsubscribe, email <A 
href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, read 
the MAQ (<A 
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
the archives (<A 
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo9.gif: 00000001,1407e3ac,00000000,00000000

From vboulytchev at COINFOTECH.COM  Fri Oct 15 21:47:39 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:17 2006
Subject: Speed Monitoring
Message-ID: <mailman.3588.1137101237.24926.mailscanner@lists.mailscanner.info>

NICE!  Great, thank you very much


Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Matt Kettler
Sent: Friday, October 15, 2004 1:14 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Speed Monitoring


At 02:36 PM 10/15/2004, Boulytchev, Vasiliy wrote:
>Ladies and Gents,
>         After turning on Speed Logging in MailScanner.conf, I see
>lines  such as:
>
>  Batch completed at 4648 bytes per second (1859342 / 400)
>
>I am translating this as :
>
>Batch completed at x bytes per second ( totalbytes / totalseconds)
>
>Am I correct to say that the entire batch was 1859342 bytes and it took
>400 seconds to scan it?

Yes, although IMO, that statistic is largely useless if SA is involved.

SA's scan time is much more a function of message count than of message
size, particularly if DNSBLs are enabled. Although it's actual timing is
really quite widely scattered it's certainly more correlated to the number
of messages in a batch than the size of the batch. Large body sizes increase
SA's scan time a bit, but that's usualy drown out by the time it takes to do
DNSBLs.

Also, bear in mind that the timing is done in whole-second increments and
the rounding makes for some hefty errors. (ie: if a batch is 5k in size,
even if it takes .1ms to scan it, it will be reported as 1 second and
5k/sec.)

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  5.9KB. ]
    [ Unable to print this part. ]


From vboulytchev at COINFOTECH.COM  Fri Oct 15 21:46:29 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:17 2006
Subject: Performance for Baysian.  Sql vs local
Message-ID: <mailman.3589.1137101237.24926.mailscanner@lists.mailscanner.info>


Ladies and Gents,
        Has anyone have any stats regarding performance improvements for
Baysian db running locally or on a sql server?

Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  6KB. ]
    [ Unable to print this part. ]


From mkettler at EVI-INC.COM  Fri Oct 15 22:18:16 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:17 2006
Subject: Best AV
Message-ID: <mailman.3590.1137101237.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:33 PM 10/15/2004, Brian Berglund wrote:
>What is the best virus scanning software to use with Mailscanner?
>I am going to try ClamVS,  any other suggestions?

Changed the subject since this no longer has anything to do with "Transport
File"

"best" is a bit of a relative term.

Clam is certainly best price/performance. It works fairly well, is
constantly getting better, and costs nothing.

Sophos seems to have the best support and commercial signature generation,
but they are also one of the more expensive tools.

F-prot seems to be a decent low-priced commercial AV.

For real statistics, I use ClamAV and Command AV (repackaging of f-prot).
And here's some bits on how they stack up.

Note that ClamAV includes phish-mail signatures, so I have one set that
ignores those:

ClamAV: 2149                            That command missed: 304
ClamAV, minus Phishes: 2038             That command missed: 193 (9.47%)
Command: 1847                   That Clam missed: 2 (both HTML/ObjData@exp)

Important note of bias: Test data covers all viruses received here since
8/1. ClamAV gets updated much more frequently than Command does.

I used to update Command's signatures twice daily, but on 9/28 I shifted to
6 times a day. Clam gets updated hourly via mailscanner's scripts. Thus,
clam is still updated much more frequently than clam.

Only counting since 9/28:
ClamAV: 650                     That command missed: 192
ClamAV, minus Phishes: 538      That command missed: 80 (14.86%)
Command: 458            That Clam missed: 0

 From that it's hard to conclude more updates would help Command, but
command is effectively free for me since we have a site-license that
packages in the mailserver use.

Also Clam has been charging ahead and it's code is greatly improved itself
over the past few months. I'm currently using ClamAV 0.80rc*. Command
hasn't released an updated package for the main the engine for their Linux
version in a long while, only deffiles.

I also just noticed command released a new code version, I was on
csav-4.90.2, the newest available as of 9/1/2004 when I last checked.
However, they now have 4.92.1 up.. it's a shame it won't install on it's
own. It claims it can't install on my i386 arch, because it was designed
for i?86... Nice eh? :)



(When I shifted to 6 updates a day, I also stopped using the inefficient
method of using rpm's ftp ability, and made a little wget-based script
which downloads the file only when it changes.)

#!/bin/sh
cd /usr/share/csav-update
wget -nv -N
http://user:password@download.commandsoftware.com/csav/deffiles/deflinux.rpm
rpm -U --quiet deflinux.rpm

Quite handy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From yoloits at YCOE.ORG  Fri Oct 15 23:22:35 2004
From: yoloits at YCOE.ORG (yoloits)
Date: Thu Jan 12 21:27:17 2006
Subject: Malformed MIME problem
Message-ID: <mailman.3591.1137101237.24926.mailscanner@lists.mailscanner.info>

My firewall accepts smtp connections and redirects the public IP traffic to
my inside mail server with a private IP address.  The inside mail server
accepts delivers for all inside domains and then forwards them to the
distenation mail server after running the email through MailScanner which is
using Sendmail, ClamAV and SpamAssassin.  The logs show the mail is
accepted, clean and sent on its way.



I have a site with an Exchange mail server running Symantec AntiVirus for
SMTP gateways.  When the gateway receives the email it kicks it back to the
sender because of Malformed MIME file.



Here is the email message that the sender gets back:



Reporting-MTA: Symantec_AntiVirus_for_SMTP_Gateways@winters.org

Final-Recipient: rfc822;druz@winters.org

Action: failed

Status: 5.1.1

Diagnostic-Code: X-Notes; Cannot route mail to user (druz@winters.org).

--- The message cannot be delivered to the following address. ---

druz@winters.org Local processing error while delivering message.



Here is the message the SAV for SMTP Gateways has in it's logs:



12-Oct-2004 07:10:41 Action: Message Accepted Client: 172.27.4.244 From:
jrhart@pacbell.net

To: druz@winters.org Subject: Test, reply to EOCY email address Size: 1550

SMTP ID: M2004101207104006000 Connection ID: 5972

12-Oct-2004 07:10:41 Action: Scan Error From: jrhart@pacbell.net To:
druz@winters.org

Subject: Test, reply to EOCY email address Size: 1550 SMTP ID:
M2004101207104006000

Info: Message could not be scanned completely. Scan Status: 56 - Malformed
MIME file.

12-Oct-2004 07:10:41 Action: Message Bounced Client: 172.27.4.244 From:
jrhart@pacbell.net

To: druz@winters.org Subject: Test, reply to EOCY email address SMTP ID:
M2004101207104006000

Info: Local processing error while delivering message.

12-Oct-2004 07:10:41 Action: Message Processing Completed Client:
172.27.4.244 From: jrhart@pacbell.net

To: druz@winters.org Subject: Test, reply to EOCY email address SMTP ID:
M2004101207104006000





Is Mailscanner or maybe SpamAssassin adding something to the header that is
causing the rejection?   Removing the mail server and allowing the mail to
be delivered without going throught the server works.

How can I make this work so I can get the benefits of MailScanner?



Jay

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Fri Oct 15 23:35:38 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:17 2006
Subject: Malformed MIME problem
Message-ID: <mailman.3592.1137101237.24926.mailscanner@lists.mailscanner.info>

What is the MailScanner server called?


--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From yoloits at YCOE.ORG  Fri Oct 15 23:40:56 2004
From: yoloits at YCOE.ORG (yoloits)
Date: Thu Jan 12 21:27:18 2006
Subject: Malformed MIME problem
Message-ID: <mailman.3593.1137101237.24926.mailscanner@lists.mailscanner.info>

free.ycoe.net


----- Original Message -----
From: "Michele Neylon : Blacknight Solutions"
<michele@BLACKNIGHTSOLUTIONS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, October 15, 2004 3:35 PM
Subject: Re: Malformed MIME problem


> What is the MailScanner server called?
>
>
> --
> Mr Michele Neylon
> Blacknight Solutions
> http://www.blacknight.ie
> 059 9137101
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Fri Oct 15 23:49:27 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon : Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Malformed MIME problem
Message-ID: <mailman.3594.1137101238.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-10-15 at 15:40 -0700, yoloits wrote:
> free.ycoe.net
>
Which is what I thought :

You should not use "." in the MailScanner name. Some products do not
like it. Try using "-" instead

This is documented in MailScanner.conf

Rename it and try again

--
Mr Michele Neylon
Blacknight Solutions
http://www.blacknight.ie
059 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Sat Oct 16 00:03:39 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:18 2006
Subject: Transport file
Message-ID: <mailman.3595.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Brian Berglund wrote:
<blockquote
 cite="mid2E09A52C9852E24A9A084352AB68F2C51958CC@w2k3-tp.techpro.local"
 type="cite">
  <meta http-equiv="Content-Type" content="text/html; ">
  <meta content="MSHTML 6.00.3790.186" name="GENERATOR">
  <div><span class="769465518-15102004"><font face="Arial" size="2">Can
the transport file of postfix be setup to read from a mysql database?<br>
  </font></span></div>
</blockquote>
Yes transport_map = mysql:/path/to/database/file<br>
with the database file containing the arguments for connection etc to
the database.<br>
<blockquote
 cite="mid2E09A52C9852E24A9A084352AB68F2C51958CC@w2k3-tp.techpro.local"
 type="cite">
  <div><span class="769465518-15102004"><font face="Arial" size="2">Like
if the database has a table with </font></span></div>
  <div><span class="769465518-15102004"><font face="Arial" size="2">domain
name and relay server</font></span></div>
  <div><span class="769465518-15102004"><font face="Arial" size="2">whatever.com,172.26.2.1</font></span></div>
  <div><span class="769465518-15102004"></span>&nbsp;</div>
  <div><span class="769465518-15102004"><font face="Arial" size="2">Then
the transport would read from that and relay to the appropriate server?<br>
  </font></span></div>
</blockquote>
Yup!<br>
<br>
See <a class="moz-txt-link-freetext" href="http://www.gentoo.org/doc/en/virt-mail-howto.xml">http://www.gentoo.org/doc/en/virt-mail-howto.xml</a> for examples (It's
not bad but written for Gentoo Linux) or for Postgre
<a class="moz-txt-link-freetext" href="http://www.postfix.org/PGSQL_README.html">http://www.postfix.org/PGSQL_README.html</a>. There are others, Google is
your friend! <br>
<br>
HTH<br>
<br>
Drew<br>
</body>
<br />--
<br />In line with our <a href="http://www.themarshalls.co.uk/policy">policy</a>, this message has been scanned for
<br />viruses and dangerous content by
<a href="http://www.mailscanner.info/">MailScanner</a>, and is
<br />believed to be clean.
</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mike at CAMAROSS.NET  Sat Oct 16 04:51:39 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:18 2006
Subject: Inaccurate Queue Amount?
Message-ID: <mailman.3596.1137101238.24926.mailscanner@lists.mailscanner.info>

I started noticing in the past few days that the number of messages in the
incoming queue is not correct for some reason.  My logs show this:

Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Found 14 messages
waiting
Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Scanning 1 messages,
1252 bytes
Oct 15 22:43:08 avwall2 MailScanner[2760]: Spam Checks: Starting
Oct 15 22:43:08 avwall2 MailScanner[2760]: Virus and Content Scanning:
Starting
Oct 15 22:43:08 avwall2 MailScanner[2760]: Uninfected: Delivered 1 messages

But there aren't 14 messages in the queue:

[root@avwall2 /etc/MailScanner] #ls -al /var/spool/MailScanner/incoming/
total 4
drwxrwxrwt   12 root     root          240 Oct 15 22:44 .
drwxr-xr-x    4 root     root         4096 May 20 19:37 ..
drwx------    2 root     root           40 Oct 15 22:42 2754
drwx------    2 root     root           40 Oct 15 22:43 2760
drwx------    2 root     root           40 Oct 15 22:43 2769
drwx------    2 root     root           40 Oct 15 22:43 2775
drwx------    2 root     root           40 Oct 15 22:43 2785
drwx------    2 root     root           40 Oct 15 22:43 2792
drwx------    2 root     root           40 Oct 15 22:44 2799
drwx------    2 root     root           40 Oct 15 22:44 2821
drwx------    2 root     root           40 Oct 15 22:44 2826
drwx------    2 root     root           40 Oct 15 22:44 2829

If I stop MailScanner, the /var/spool/MailScanner/incoming directory becomes
empty.  Start the service again, and I have 14 messages waiting again.  I
even tried a reboot...same result.  Am I missing something somewhere?

I've also started getting a few messages in my Inbox that have:

<<< No Message Collected >>>

in the body...nothing else.  Related?


Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From pg at NEWHONEST.COM  Sat Oct 16 07:49:53 2004
From: pg at NEWHONEST.COM (Jason)
Date: Thu Jan 12 21:27:18 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3597.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

    For example an email is sent from someone@somehost.com. To make sure it
is not from a fake domain, check up someone.com to see whether it has the
same ip as the ip this email is sending from. Although it is still possible
that someother@somehonst.com faking someone@somehost.com, but at least the
email is coming from somehost.com

Jason

----- Original Message -----
From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, October 15, 2004 10:53 PM
Subject: Re: how to fight fake email addresss?


> Jason wrote:
>> Hi,
>>
>>    I'm curious to know whether MailScanner will do a DNS lookup to make
>> sure the sender's domain matches its ip.
>
> What do you mean exactly?  Check that the domain exists?  That's the
> MTA's job.  Check that the smtp server used is the good one?  That is
> SPF and there are SPF rules in SpamAssassin.
>
>>
>> Jason
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sajjad at IINIX.COM  Sat Oct 16 08:17:15 2004
From: sajjad at IINIX.COM (A. Sajjad Zaidi)
Date: Thu Jan 12 21:27:18 2006
Subject: MailScanner notifies recipients even with Sender Notify off
Message-ID: <mailman.3598.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi,

On Fri, Oct 15, 2004 at 01:07:20PM -0400, Matt Kettler wrote:
>
> Why does it not make sense to notify the Recipient? At least then the
> recipient has a chance to review if it's really something they expected.
> Besides, there may be valuable parts of the message that MS did not
> quarantine.

True, but a lot of people get annoyed by it. When it isn't annoying, it
confuses them and we have to waste time explaining why they received the
message.

> Look at the Silent Viruses option in mailscanner.conf if you want to
> silence all notices. You'll also need to turn off "Still Deliver Silent
> Viruses".

This is what I currently have:

Silent Viruses = HTML-IFrame All-Viruses
Still Deliver Silent Viruses = no

Should I also add the other options for "Silent Viruses" (i.e.
HTML-Codebase, HTML-Script, HTML-Form)?

> Quite frankly, it *ONLY* makes sense to notify the Recipient if you suspect
> a virus, as the sender is likely a forgery.

Well if the sender is likely a forgery, the message is probably also
useless to the recipient. I think it makes sense to notify either party
if the virus isn't one that forges addresses. If it is, then no notice
should be sent to anyone.

> IMHO it is actually a malicious misconfiguration of a server to even try to
> notify the sender with a post-delivery return unless you have reason to
>
<snip>
>
> It's a harsh policy, but I need to protect my network from risk of being
> flooded with thousands of broken virus notices from one of these servers.
> Broken notices are as bad as spam, if not worse, and they waste resources
> here on my network.

Agreed. And it's a lot less harsh than permanently blocking the
offending network/ip/domain.

--
A. Sajjad Zaidi                      http://www.sajjadzaidi.com/
GnuPG Key ID: 0xD7AD0E13

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct 16 12:23:48 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: NO_DNS_FOR_FROM
Message-ID: <mailman.3599.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
In which case you are going to have to apply the patches by hand. Open up
each patch file and try to find the bit of code that matches in your
particular versions of these files. Patch files are easy to understand.

At 20:48 15/10/2004, you wrote:
>On Fri, 15 Oct 2004 17:06:53 +0100, Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
> >And with my patches?
>
>Julian,
>I got these errors:
>[root@bester MailScanner]# patch < SA.pm.patch
>patching file SA.pm
>Hunk #1 FAILED at 320.
>1 out of 1 hunk FAILED -- saving rejects to file SA.pm.rej
>[root@bester MailScanner]# patch < MCP.pm.patch
>patching file MCP.pm
>Hunk #1 FAILED at 221.
>1 out of 1 hunk FAILED -- saving rejects to file MCP.pm.rej

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 16 12:38:38 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Inaccurate Queue Amount?
Message-ID: <mailman.3600.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:51 16/10/2004, you wrote:
>I started noticing in the past few days that the number of messages in the
>incoming queue is not correct for some reason.  My logs show this:
>
>Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Found 14 messages
>waiting
>Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Scanning 1 messages,
>1252 bytes
>Oct 15 22:43:08 avwall2 MailScanner[2760]: Spam Checks: Starting
>Oct 15 22:43:08 avwall2 MailScanner[2760]: Virus and Content Scanning:
>Starting
>Oct 15 22:43:08 avwall2 MailScanner[2760]: Uninfected: Delivered 1 messages
>
>But there aren't 14 messages in the queue:
>
>[root@avwall2 /etc/MailScanner] #ls -al /var/spool/MailScanner/incoming/
>total 4
>drwxrwxrwt   12 root     root          240 Oct 15 22:44 .
>drwxr-xr-x    4 root     root         4096 May 20 19:37 ..
>drwx------    2 root     root           40 Oct 15 22:42 2754
>drwx------    2 root     root           40 Oct 15 22:43 2760
>drwx------    2 root     root           40 Oct 15 22:43 2769
>drwx------    2 root     root           40 Oct 15 22:43 2775
>drwx------    2 root     root           40 Oct 15 22:43 2785
>drwx------    2 root     root           40 Oct 15 22:43 2792
>drwx------    2 root     root           40 Oct 15 22:44 2799
>drwx------    2 root     root           40 Oct 15 22:44 2821
>drwx------    2 root     root           40 Oct 15 22:44 2826
>drwx------    2 root     root           40 Oct 15 22:44 2829

That's not the queue. That's the list of working directories for each of
the MailScanner children. You should have as many of those as you have set
in "Max Children".

>If I stop MailScanner, the /var/spool/MailScanner/incoming directory becomes
>empty.  Start the service again, and I have 14 messages waiting again.  I
>even tried a reboot...same result.  Am I missing something somewhere?

What MTA are you using? You may have "half-messages" in the incoming mail
queue, causing MS to get its count wrong.

>I've also started getting a few messages in my Inbox that have:
>
><<< No Message Collected >>>
>
>in the body...nothing else.  Related?

That tends to indicate a locking problem.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 16 12:32:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: MailScanner notifies recipients even with Sender Notify off
Message-ID: <mailman.3601.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:07 15/10/2004, you wrote:
>At 12:35 PM 10/15/2004, A. Sajjad Zaidi wrote:
>>It's understandable if it goes to the sender when 'Notify Senders' is
>>on, which it does, but it doesn't make sense to notify the recipient as
>>well. The notice gets sent regardless of what 'Notify Senders' or the
>>other notification settings are set to.

Also, see the "Deliver Cleaned Messages" option. If you set this to no,
then the recipients won't see anything.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 16 12:40:01 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: how to fight fake email addresss?
Message-ID: <mailman.3602.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
That's more or less what SPF is for. SpamAssassin will do SPF checks for you.

At 07:49 16/10/2004, you wrote:
>    For example an email is sent from someone@somehost.com. To make sure it
>is not from a fake domain, check up someone.com to see whether it has the
>same ip as the ip this email is sending from. Although it is still possible
>that someother@somehonst.com faking someone@somehost.com, but at least the
>email is coming from somehost.com
>
>Jason
>
>----- Original Message -----
>From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Friday, October 15, 2004 10:53 PM
>Subject: Re: how to fight fake email addresss?
>
>
>>Jason wrote:
>>>Hi,
>>>
>>>    I'm curious to know whether MailScanner will do a DNS lookup to make
>>>sure the sender's domain matches its ip.
>>
>>What do you mean exactly?  Check that the domain exists?  That's the
>>MTA's job.  Check that the smtp server used is the good one?  That is
>>SPF and there are SPF rules in SpamAssassin.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at CAMAROSS.NET  Sat Oct 16 13:10:29 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:18 2006
Subject: Inaccurate Queue Amount?
Message-ID: <mailman.3603.1137101238.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
> At 04:51 16/10/2004, you wrote:
>> I started noticing in the past few days that the number of messages
>> in
>> the incoming queue is not correct for some reason.  My logs show
>> this:
>>
>> Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Found 14
>> messages waiting Oct 15 22:43:08 avwall2 MailScanner[2760]: New
>> Batch: Scanning 1 messages, 1252 bytes
>> Oct 15 22:43:08 avwall2 MailScanner[2760]: Spam Checks: Starting Oct
>> 15 22:43:08 avwall2 MailScanner[2760]: Virus and Content Scanning:
>> Starting
>> Oct 15 22:43:08 avwall2 MailScanner[2760]: Uninfected: Delivered 1
>> messages
>>
>> But there aren't 14 messages in the queue:
>>
>> [root@avwall2 /etc/MailScanner] #ls -al
>> /var/spool/MailScanner/incoming/ total 4
>> drwxrwxrwt   12 root     root          240 Oct 15 22:44 .
>> drwxr-xr-x    4 root     root         4096 May 20 19:37 ..
>> drwx------    2 root     root           40 Oct 15 22:42 2754
>> drwx------    2 root     root           40 Oct 15 22:43 2760
>> drwx------    2 root     root           40 Oct 15 22:43 2769
>> drwx------    2 root     root           40 Oct 15 22:43 2775
>> drwx------    2 root     root           40 Oct 15 22:43 2785
>> drwx------    2 root     root           40 Oct 15 22:43 2792
>> drwx------    2 root     root           40 Oct 15 22:44 2799
>> drwx------    2 root     root           40 Oct 15 22:44 2821
>> drwx------    2 root     root           40 Oct 15 22:44 2826
>> drwx------    2 root     root           40 Oct 15 22:44 2829
>
> That's not the queue. That's the list of working directories for each
> of the MailScanner children. You should have as many of those as you
> have set in "Max Children".
>
>> If I stop MailScanner, the /var/spool/MailScanner/incoming directory
>> becomes empty.  Start the service again, and I have 14 messages
>> waiting
>> again.  I even tried a reboot...same result.  Am I missing something
>> somewhere?
>
> What MTA are you using? You may have "half-messages" in the incoming
> mail queue, causing MS to get its count wrong.
>
>> I've also started getting a few messages in my Inbox that have:
>>
>> <<< No Message Collected >>>
>>
>> in the body...nothing else.  Related?
>
> That tends to indicate a locking problem.

Running sendmail 8.13.1-2

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct 16 13:24:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Inaccurate Queue Amount?
Message-ID: <mailman.3604.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 13:10 16/10/2004, you wrote:
>Julian Field wrote:
> > At 04:51 16/10/2004, you wrote:
> >> I started noticing in the past few days that the number of messages
> >> in
> >> the incoming queue is not correct for some reason.  My logs show
> >> this:
> >>
> >> Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Found 14
> >> messages waiting Oct 15 22:43:08 avwall2 MailScanner[2760]: New
> >> Batch: Scanning 1 messages, 1252 bytes
> >> Oct 15 22:43:08 avwall2 MailScanner[2760]: Spam Checks: Starting Oct
> >> 15 22:43:08 avwall2 MailScanner[2760]: Virus and Content Scanning:
> >> Starting
> >> Oct 15 22:43:08 avwall2 MailScanner[2760]: Uninfected: Delivered 1
> >> messages
> >>
> >> But there aren't 14 messages in the queue:
> >>
> >> [root@avwall2 /etc/MailScanner] #ls -al
> >> /var/spool/MailScanner/incoming/ total 4
> >> drwxrwxrwt   12 root     root          240 Oct 15 22:44 .
> >> drwxr-xr-x    4 root     root         4096 May 20 19:37 ..
> >> drwx------    2 root     root           40 Oct 15 22:42 2754
> >> drwx------    2 root     root           40 Oct 15 22:43 2760
> >> drwx------    2 root     root           40 Oct 15 22:43 2769
> >> drwx------    2 root     root           40 Oct 15 22:43 2775
> >> drwx------    2 root     root           40 Oct 15 22:43 2785
> >> drwx------    2 root     root           40 Oct 15 22:43 2792
> >> drwx------    2 root     root           40 Oct 15 22:44 2799
> >> drwx------    2 root     root           40 Oct 15 22:44 2821
> >> drwx------    2 root     root           40 Oct 15 22:44 2826
> >> drwx------    2 root     root           40 Oct 15 22:44 2829
> >
> > That's not the queue. That's the list of working directories for each
> > of the MailScanner children. You should have as many of those as you
> > have set in "Max Children".
> >
> >> If I stop MailScanner, the /var/spool/MailScanner/incoming directory
> >> becomes empty.  Start the service again, and I have 14 messages
> >> waiting
> >> again.  I even tried a reboot...same result.  Am I missing something
> >> somewhere?
> >
> > What MTA are you using? You may have "half-messages" in the incoming
> > mail queue, causing MS to get its count wrong.
> >
> >> I've also started getting a few messages in my Inbox that have:
> >>
> >> <<< No Message Collected >>>
> >>
> >> in the body...nothing else.  Related?
> >
> > That tends to indicate a locking problem.
>
>Running sendmail 8.13.1-2

Set
Lock Type = posix
in your MailScanner.conf. And take a look in your /var/spool/mqueue.in to
see if you have any old qf files without corresponding df files or vice versa.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Sat Oct 16 15:03:21 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:18 2006
Subject: Inaccurate Queue Amount?
Message-ID: <mailman.3605.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Mike Kercher wrote:
> I started noticing in the past few days that the number of messages in the
> incoming queue is not correct for some reason.  My logs show this:
>
> Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Found 14 messages
> waiting
> Oct 15 22:43:08 avwall2 MailScanner[2760]: New Batch: Scanning 1 messages,
> 1252 bytes
> Oct 15 22:43:08 avwall2 MailScanner[2760]: Spam Checks: Starting
> Oct 15 22:43:08 avwall2 MailScanner[2760]: Virus and Content Scanning:
> Starting
> Oct 15 22:43:08 avwall2 MailScanner[2760]: Uninfected: Delivered 1 messages
>
> But there aren't 14 messages in the queue:
>

http://www.mailscanner.biz/maq/#waiting

> [root@avwall2 /etc/MailScanner] #ls -al /var/spool/MailScanner/incoming/
> total 4
> drwxrwxrwt   12 root     root          240 Oct 15 22:44 .
> drwxr-xr-x    4 root     root         4096 May 20 19:37 ..
> drwx------    2 root     root           40 Oct 15 22:42 2754
> drwx------    2 root     root           40 Oct 15 22:43 2760
> drwx------    2 root     root           40 Oct 15 22:43 2769
> drwx------    2 root     root           40 Oct 15 22:43 2775
> drwx------    2 root     root           40 Oct 15 22:43 2785
> drwx------    2 root     root           40 Oct 15 22:43 2792
> drwx------    2 root     root           40 Oct 15 22:44 2799
> drwx------    2 root     root           40 Oct 15 22:44 2821
> drwx------    2 root     root           40 Oct 15 22:44 2826
> drwx------    2 root     root           40 Oct 15 22:44 2829
>
> If I stop MailScanner, the /var/spool/MailScanner/incoming directory becomes
> empty.  Start the service again, and I have 14 messages waiting again.  I
> even tried a reboot...same result.  Am I missing something somewhere?
>
> I've also started getting a few messages in my Inbox that have:
>
> <<< No Message Collected >>>
>
> in the body...nothing else.  Related?
>
>
> Mike
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dfilchak at sympatico.ca  Sat Oct 16 16:24:26 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:18 2006
Subject: permissions
Message-ID: <mailman.3606.1137101238.24926.mailscanner@lists.mailscanner.info>

Pardon me for being dull, and I have tried to figure this out by searching
the lists and archives but nothing seems to match my set up. I am still
struggling with update_virus_scanners permissions errors. I get these errors
a lot and the only way it seems to work is if I run freshclam -u root. My
crontab script always complains about permissions.

When I look in my maillog, I get a lot of the following:

Oct 13 23:01:00 rosewood update.virus.scanners: Delaying cron job up to 200
seconds
Oct 13 23:01:52 rosewood update.virus.scanners: Found clamav installed
Oct 13 23:01:52 rosewood update.virus.scanners: Running autoupdate for
clamav
Oct 13 23:01:53 rosewood ClamAV-autoupdate[16705]: ClamAV updater failed

When I run /etc/cron.daily/update_virus_scanners I get the following entry
into /tmp/ClamAV.update.log

ClamAV update process started at Sat Oct 16 11:05:24 2004
main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
tomek)
ERROR: Can't open new file ./clamav-8b1fdc42829250a9 to write
ERROR: Can't download daily.cvd from 24.73.112.74

When I run /usr/lib/MailScanner/clamav-autoupdate I get the following:

ERROR: Can't open new file ./clamav-fcd0ab451ecd560f to write
open: Permission denied
ERROR: Can't download daily.cvd from 64.69.64.158

Obviously it is a permissions thing. However, what I do not understand
(tired brain) is where this error is originating from and how I can fix this
problem.

Currently, the machine is Red Hat 9, I am running Mail::ClamAV 0.11 with
MailScanner 4.34.4 and clamd / ClamAV version 0.75. My setup seems to be
writing two files to /tmp, a lock file and the actual update log:
ClamAVBusy.lock and ClamAV.update.log . Permissions for the
ClamAV.update.log are clamav:clamav however the lockfile is owned by root.
Wouldn't that stop the update script from writing to the log file? There is
nothing in the clamav users home directory.

If someone could just take the time to educate me as to how the update
process works, where the files are supposed to be written to and what
permissions, I would be sincerely appreciative. I am afraid that at the
present moment, the only way for me to update the virus patterns is
manually, and just will never do ;-).

Thanks in advance.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Sat Oct 16 16:46:31 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:18 2006
Subject: permissions
Message-ID: <mailman.3607.1137101238.24926.mailscanner@lists.mailscanner.info>

 Just after I sent this, I found what appears to be the solution so I will
post it back to the list for future users with this problem. If anyone sees
an issue with this solution, please let us know.

I came across a post that said to find out what the current working
directory for freshclam was. This can be done by running:
/usr/local/bin/freshclam -v (I am running Red Hat 9 so your path may be
different). Then check the permissions on the working directory which in my
case is /usr/local/share/clamav. I set the permissions to the clamav
directory there to clamav:clamav (they were set to root) and all errors seem
to disappear. I will watch my logs over the next few days for reoccurrences
but this seems to have fixed the issue.

Cheers

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dave Filchak
Sent: Saturday, October 16, 2004 11:24 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] permissions

Pardon me for being dull, and I have tried to figure this out by searching
the lists and archives but nothing seems to match my set up. I am still
struggling with update_virus_scanners permissions errors. I get these errors
a lot and the only way it seems to work is if I run freshclam -u root. My
crontab script always complains about permissions.

When I look in my maillog, I get a lot of the following:

Oct 13 23:01:00 rosewood update.virus.scanners: Delaying cron job up to 200
seconds Oct 13 23:01:52 rosewood update.virus.scanners: Found clamav
installed Oct 13 23:01:52 rosewood update.virus.scanners: Running autoupdate
for clamav Oct 13 23:01:53 rosewood ClamAV-autoupdate[16705]: ClamAV updater
failed

When I run /etc/cron.daily/update_virus_scanners I get the following entry
into /tmp/ClamAV.update.log

ClamAV update process started at Sat Oct 16 11:05:24 2004 main.cvd is up to
date (version: 27, sigs: 23982, f-level: 2, builder:
tomek)
ERROR: Can't open new file ./clamav-8b1fdc42829250a9 to write
ERROR: Can't download daily.cvd from 24.73.112.74

When I run /usr/lib/MailScanner/clamav-autoupdate I get the following:

ERROR: Can't open new file ./clamav-fcd0ab451ecd560f to write
open: Permission denied
ERROR: Can't download daily.cvd from 64.69.64.158

Obviously it is a permissions thing. However, what I do not understand
(tired brain) is where this error is originating from and how I can fix this
problem.

Currently, the machine is Red Hat 9, I am running Mail::ClamAV 0.11 with
MailScanner 4.34.4 and clamd / ClamAV version 0.75. My setup seems to be
writing two files to /tmp, a lock file and the actual update log:
ClamAVBusy.lock and ClamAV.update.log . Permissions for the
ClamAV.update.log are clamav:clamav however the lockfile is owned by root.
Wouldn't that stop the update script from writing to the log file? There is
nothing in the clamav users home directory.

If someone could just take the time to educate me as to how the update
process works, where the files are supposed to be written to and what
permissions, I would be sincerely appreciative. I am afraid that at the
present moment, the only way for me to update the virus patterns is
manually, and just will never do ;-).

Thanks in advance.

Dave

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Sun Oct 17 06:38:37 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:18 2006
Subject: Security warning
Message-ID: <mailman.3608.1137101238.24926.mailscanner@lists.mailscanner.info>

Hello again,

On my secondary mail server, when I run /usr/local/bin/freshclam -v, I get
the following warning:

        SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES

How can I fix this? I have searched both the MailScanner list archives and
the ClamAV archives with no luck.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greg at BLASTZONE.COM  Sun Oct 17 08:02:45 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:18 2006
Subject: Security warning
Message-ID: <mailman.3609.1137101238.24926.mailscanner@lists.mailscanner.info>

ClamAV Faq.  Item #7.

http://www.clamav.net/faq.html#pagestart



> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Filchak
> Sent: Saturday, October 16, 2004 10:39 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Security warning
>
>
> Hello again,
>
> On my secondary mail server, when I run
> /usr/local/bin/freshclam -v, I get the following warning:
>
>         SECURITY WARNING: NO SUPPORT FOR DIGITAL SIGNATURES
>
> How can I fix this? I have searched both the MailScanner list
> archives and the ClamAV archives with no luck.
>
> Dave
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner'
> in the body of the email. Before posting, read the MAQ
(http://www.mailscanner.biz/maq/) and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From h.goebel at GOEBEL-CONSULT.DE  Mon Oct 18 09:14:48 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3610.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello,

I'm new to MailScanner. Currently I'm evaluating whether it's usable for 
our needs. What I've seen until now, it looks very good. Esp. the levels 
of indirection for rules (as Julian descripted last week) are very fine!

Nevertheless I have some questions:

1) www.postfix.org says there are problems with duplicate or truncted
    mails. I found a thread in this mailinglist dicussion that these
    problems have been solved. So, is this statement still valid?

    (If this is outdated, I suggest tasking postfix people to remove this
    statement.)

2) Why does MailScanner not use postifx's 'content_filter'
    functionality? I understand, that content_filter would require to
    implement a smtpd, but currently MailScanner uses unsupported direct
    access to the Q-files (acccoring to www.postfix.org).

3) Why does MailScanner start the MTA (postfix) by itself? Normaly those
    jobs are left over to the SysV-init stuff.

4) Where to send bug-reports, suggestions and enhancement-requests?

5) Minor Bug: F-Secure 4.61 for Linux installs it's config file into
    /opt/f-secure/fsav/etc/fsav.conf, while f-secure-wrapper only checks
    for /etc/fsav.conf.

    Possible solutions: a) Change installtion instructions to add a link.
    b) Change the wrapper to test for multiple directories.

6) Can anybody please clean up the FAQ-O-mat. There are lots of empty
    questions ("New item") and some answers are not readable since some
    lines are about 400 charakters long. Thanks!

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 09:30:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3611.1137101238.24926.mailscanner@lists.mailscanner.info>

At 09:14 18/10/2004, you wrote:
>Hello,
>
>I'm new to MailScanner. Currently I'm evaluating whether it's usable for
>our needs. What I've seen until now, it looks very good. Esp. the levels
>of indirection for rules (as Julian descripted last week) are very fine!
>
>Nevertheless I have some questions:
>
>1) www.postfix.org says there are problems with duplicate or truncted
>    mails. I found a thread in this mailinglist dicussion that these
>    problems have been solved. So, is this statement still valid?
>
>    (If this is outdated, I suggest tasking postfix people to remove this
>    statement.)

Thousands of people use them both with no problems at all. The Postfix
author has near-religious objections to MailScanner. I didn't interface to
it in the way that he intended everyone to, I found a faster way. So he
doesn't like me or MailScanner. Such is life :-)

>2) Why does MailScanner not use postifx's 'content_filter'
>    functionality? I understand, that content_filter would require to
>    implement a smtpd, but currently MailScanner uses unsupported direct
>    access to the Q-files (acccoring to www.postfix.org).

Because it is relatively slow and it's not how I chose to do it.

>3) Why does MailScanner start the MTA (postfix) by itself? Normaly those
>    jobs are left over to the SysV-init stuff.

Most of the MTA's I support have to be started in a very specific way to
operate with MailScanner, so I start the MTA in the MailScanner init.d
script so it is the same as all the others I support.

>4) Where to send bug-reports, suggestions and enhancement-requests?

This mailing list.

>5) Minor Bug: F-Secure 4.61 for Linux installs it's config file into
>    /opt/f-secure/fsav/etc/fsav.conf, while f-secure-wrapper only checks
>    for /etc/fsav.conf.

This is fixed in the latest release. It was only changed very recently. The
very latest f-secure-wrapper is attached to this message for you.

>6) Can anybody please clean up the FAQ-O-mat. There are lots of empty
>    questions ("New item") and some answers are not readable since some
>    lines are about 400 charakters long. Thanks!

Anyone out there have a few minutes to do this for me please?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
    [ Part 2, Application/OCTET-STREAM (Name: "f-secure-wrapper")  3.7KB. ]
    [ Unable to print this part. ]


    [ Part 3: "Attached Text" ]

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 09:40:17 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3612.1137101238.24926.mailscanner@lists.mailscanner.info>

>> 6) Can anybody please clean up the FAQ-O-mat. There are lots of empty
>>    questions ("New item") and some answers are not readable since
>>    some lines are about 400 charakters long. Thanks!
>
> Anyone out there have a few minutes to do this for me please?

I can do it for you this evening if you want :)
What do I need to be able to do it?


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 10:01:23 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3613.1137101238.24926.mailscanner@lists.mailscanner.info>

This error keeps on appearing in logs since we upgraded to the latest
stable:

Oct 18 09:55:16 av MailScanner[5425]: Cannot parse
/var/spool/MailScanner/incoming/5425/i9I8t1se006400.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at
/usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.

A lot of mail is being rejected by MailScanner due to this which is causing
a lot of headaches

Any thoughts?

Michele

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Mail-Lists at KARAN.ORG  Mon Oct 18 10:44:10 2004
From: Mail-Lists at KARAN.ORG (Karanbir Singh)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3614.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
hey,

Julian Field wrote:
>> Nevertheless I have some questions:
>>
>> 1) www.postfix.org says there are problems with duplicate or truncted
>>    mails. I found a thread in this mailinglist dicussion that these
>>    problems have been solved. So, is this statement still valid?
>>
>>    (If this is outdated, I suggest tasking postfix people to remove this
>>    statement.)
>
>
> Thousands of people use them both with no problems at all. The Postfix

Me being one of these thousands of people, can say, that I havent had an
issue with MailScanner + Postfix as yet. Machines I run process between
25 to 30k emails a day.

- KB

--
Karanbir Singh   : http://www.karan.org/
GnuPG Public Key : http://www.karan.org/publickey.asc

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From DawsonA at CHESTERFIELD.AC.UK  Mon Oct 18 09:45:01 2004
From: DawsonA at CHESTERFIELD.AC.UK (Dawson, Alan)
Date: Thu Jan 12 21:27:18 2006
Subject: AV  / MailScanner missing message.zip
Message-ID: <mailman.3615.1137101238.24926.mailscanner@lists.mailscanner.info>

I've recently been receiving some MyDoom.O messages ( as i'm sure the rest
of the world has too )


My AV software  (CAI etrust ) will detect the virus in the attached zip file

charon:~ # inocmd32 message.zip
File /root/message.zip is infected by virus: Win32/MyDoom.O.ZIP.Worm

But when its sent as an email attachement it doesn't detect it !

Oddly though if I rename message.zip to message.scr the AV software does
detect it in an email attachment

I added message.zip into the filename.rules.conf to catch it.  What have i
missed here ?


Alan Dawson
--
ICT Services

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at ZANKER.ORG  Mon Oct 18 10:58:07 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:18 2006
Subject: [Clamav-announce] announcing ClamAV 0.80 (fwd)
Message-ID: <mailman.3616.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
For info. Working fine here with MailScanner 4.34.8 and
Mail-ClamAV-0.11.

Mike.

---------- Forwarded Message ----------
Date: 17 October 2004 19:37 +0200
From: Luca Gibelli <luca@clamav.net>
To: clamav-announce@lists.clamav.net
Subject: [Clamav-announce] announcing ClamAV 0.80


Dear ClamAV users,

the new stable release introduces the following new features and
improvements:

-) libclamav
    + Portable Executable analyser (CL_SCAN_PE) featuring:
        o UPX decompression (all versions)
        o Petite decompression (2.x)
        o FSG decompression (1.3, 1.31, 1.33)
        o detection of broken executables (CL_SCAN_BLOCKBROKEN)
    + new, memory efficient, pattern matching algorithm (multipattern
variant       of Boyer-Moore) - it's now primary matcher and
Aho-Corasick is only used       for regular expression extended
signatures
    + new signature format with advanced target type and offset
specification     + support for MD5 based signatures
    + extended regular expression scanner
    + added support for MS cabinet files
    + added support for CHM files
    + added support for POSIX tar archives
    + scanning inside PowerPoint documents
    + HTML normaliser with support for decoding of MS Script Encoder
code     + great improvements in e-mail scanner (now handles even more
worm tricks)     + new method of mail files detection
    + all e-mail attachments are now scanned (previously only the first
ten       attachments were scanned)
    + added support for scanning URLs in e-mails (CL_SCAN_MAILURL)
    + detection of Worm.Mydoom.M.log
    + updated API (still backward compatible but please consult Section
6 of        clamdoc.pdf and adapt your software)
    + faster base64 decoding
    + support for GNU tar files
    + updated on-access scanner

-) clamd
    + new directive ScanHTML (enables HTML normalisator and ScrEnc
decoder)     + new directive ScanPE (win32 executable analyser and
decompressor)     + new directive DetectBrokenExecutables (try to
detect broken executables       and mark them as Broken.Executable)
    + new directive MailFollowURLs (try to download and scan files from
URLs       in mails. BE CAREFUL! DO NOT ENABLE IT ON LOADED MAIL
SERVERS)     + new directive ArchiveBlockMax (archives that exceed
limits will be       marked as viruses)
    + clamav.conf was renamed to clamd.conf

-) clamscan
    + mail files are scanned by default, use --no-mail to disable it
    + new option --no-html (disables HTML normalisator)
    + new option --no-pe (disables PE analyser)
    + new option --detect-broken
    + new option --block-max
    + new option --mail-follow-urls (download and scan files from URLs
in mails)

-) clamdscan
    + now prints warnings if some activated command line options are
only       supported by clamscan
    + added support for archive scanning in stdin mode

-) clamav-milter
    + improved template file format
    + quarantined file names now contain virus names
    + initial support for SESSION mode of clamd

-) freshclam:
    + new directive DNSDatabaseInfo that enables ultra lightweight
version       verification method through DNS (using TXT records).
Based on idea by       Christopher X. Candreva and enabled by default.
      (see http://www.gossamer-threads.com/lists/clamav/users/11102)
    + new option --no-dns (quick option to disable DNS method without
editing       freshclam.conf)

-) sigtool
    + removed ability of automatic signature generation (use MD5 sums to
      create your own signatures, see signatures.pdf for details)
    + new option --md5
    + new option --html-normalise (saves HTML normalisation and
decryption       results in three html files in current directory)

-) configure:
    + new option --disable-gethostbyname_r (try enabling it if
clamav-milter       compilation fails)
    + new option --disable-dns (try enabling it if freshclam
compilation fails)     + extended regular expression scanner

-) documentation
    + included new Mac OS X installation instructions
    + official documentation rewritten and outdated docs removed


We encourage our users to take advantage of our new mirror structure.
In order  to download the database from the closest mirror you should
configure freshclam to use db.XY.clamav.net where XY is your country
code (see
http://www.iana.org/cctld/cctld-whois.htm for the full list). Please add
the following lines to freshclam.conf:

    DNSDatabaseInfo current.cvd.clamav.net
    DatabaseMirror db.XY.clamav.net
    DatabaseMirror database.clamav.net

DNSDatabaseInfo enables database and software version verification
through DNS TXT records, and the second database mirror acts as a
fallback in case a connection to the first mirror fails for some reason.



--
The ClamAV team (http://www.clamav.net/team.html)


--
Luca Gibelli (luca@clamav.net) - http://www.ClamAV.net - A GPL virus
scanner PGP Key Fingerprint: C782 121E 8C3A 90E3 7A87  D802 6277 8FF4
5EFC 5582 PGP Key Available on: Key Servers ||
http://www.clamav.net/gpg/nervoso.gpg
_______________________________________________
http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-announce

---------- End Forwarded Message ----------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From misterpo at IFRANCE.COM  Mon Oct 18 11:03:37 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:18 2006
Subject: How to pass through MailScanner with specific file extension ?
Message-ID: <mailman.3617.1137101238.24926.mailscanner@lists.mailscanner.info>

Hello all,

I have not found any solution to make e-mail containing XML files with
extensions like *.ast.xml, *.ast73.xml go through MailScanner.

I get the following report :

Attempt to hide real filename extension (Calib_002.ast.xml)

Password-protected archives and adding the extension to the filetype.rules
or filename.rules files can't solve my problem.

Any idea ?

Thanks,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Mon Oct 18 11:01:05 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3618.1137101238.24926.mailscanner@lists.mailscanner.info>

On Mon, October 18, 2004 10:44, Karanbir Singh said:
> hey,
>
> Julian Field wrote:
>>> Nevertheless I have some questions:
>>>
>>> 1) www.postfix.org says there are problems with duplicate or truncted
>>>    mails. I found a thread in this mailinglist dicussion that these
>>>    problems have been solved. So, is this statement still valid?
>>>
>>>    (If this is outdated, I suggest tasking postfix people to remove
>>> this
>>>    statement.)
>>
>>
>> Thousands of people use them both with no problems at all. The Postfix
>
> Me being one of these thousands of people, can say, that I havent had an
> issue with MailScanner + Postfix as yet. Machines I run process between
> 25 to 30k emails a day.
>
> - KB

Me too!! I would say (As I am sure has been said already) this has been
discussed at length previously. You will find it in the archives. You will
notice that there isn't a huge amount of love lost between the two
developers...

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 11:29:40 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: How to pass through MailScanner with specific file extension ?
Message-ID: <mailman.3619.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:03 18/10/2004, you wrote:
>Hello all,
>
>I have not found any solution to make e-mail containing XML files with
>extensions like *.ast.xml, *.ast73.xml go through MailScanner.
>
>I get the following report :
>
>Attempt to hide real filename extension (Calib_002.ast.xml)
>
>Password-protected archives and adding the extension to the filetype.rules
>or filename.rules files can't solve my problem.

Add you custom rule to the star of the filename.rules.conf file, not at the
end.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 11:28:11 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: AV  / MailScanner missing message.zip
Message-ID: <mailman.3620.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What version of MailScanner are you running? I strongly suspect you need to
upgrade. Check the ChangeLog at
www.sng.ecs.soton.ac.uk/mailscanner/ChangeLog and you will find a mention
of MyDoom-O.

At 09:45 18/10/2004, you wrote:
>I've recently been receiving some MyDoom.O messages ( as i'm sure the rest
>of the world has too )
>
>
>My AV software  (CAI etrust ) will detect the virus in the attached zip file
>
>charon:~ # inocmd32 message.zip
>File /root/message.zip is infected by virus: Win32/MyDoom.O.ZIP.Worm
>
>But when its sent as an email attachement it doesn't detect it !
>
>Oddly though if I rename message.zip to message.scr the AV software does
>detect it in an email attachment
>
>I added message.zip into the filename.rules.conf to catch it.  What have i
>missed here ?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sajjad at IINIX.COM  Mon Oct 18 09:45:42 2004
From: sajjad at IINIX.COM (A. Sajjad Zaidi)
Date: Thu Jan 12 21:27:18 2006
Subject: MailScanner notifies recipients even with Sender Notify off
Message-ID: <mailman.3621.1137101238.24926.mailscanner@lists.mailscanner.info>

On Sat, Oct 16, 2004 at 12:32:28PM +0100, Julian Field wrote:
>
> Also, see the "Deliver Cleaned Messages" option. If you set this to no,
> then the recipients won't see anything.

Thanks. That was exactly what I was looking for.

--
A. Sajjad Zaidi                      http://www.sajjadzaidi.com/
GnuPG Key ID: 0xD7AD0E13
"Irony is when you buy a suit with two pairs of pants and burn a hole in the coat."

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 10:13:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3622.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:01 18/10/2004, you wrote:
>This error keeps on appearing in logs since we upgraded to the latest
>stable:
>
>Oct 18 09:55:16 av MailScanner[5425]: Cannot parse
>/var/spool/MailScanner/incoming/5425/i9I8t1se006400.header and , Can't
>locate object method "init" via package "MIME::Decoder::QuotedPrint" at
>/usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
>
>A lot of mail is being rejected by MailScanner due to this which is causing
>a lot of headaches
>
>Any thoughts?

Either upgrade to the latest beta release, or else install MIME::Base64 and
MIME-tools via CPAN.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 12:55:14 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3623.1137101238.24926.mailscanner@lists.mailscanner.info>

MailScanner mailing list wrote:
> At 10:01 18/10/2004, you wrote:
>> This error keeps on appearing in logs since we upgraded to the
>> latest stable:
>>
>> Oct 18 09:55:16 av MailScanner[5425]: Cannot parse
>> /var/spool/MailScanner/incoming/5425/i9I8t1se006400.header and ,
>> Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint" at
>> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
>>
>> A lot of mail is being rejected by MailScanner due to this which is
>> causing a lot of headaches
>>
>> Any thoughts?
>
> Either upgrade to the latest beta release, or else install
> MIME::Base64 and MIME-tools via CPAN.

The latest version of MIME-tools via CPAN still causes the same error, so I
rolled back to a much older version.

We are now using:
3.05    MIME::Base64
5.412   MIME::Tools

I'm very worried about breaking things again :(




Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From h.goebel at GOEBEL-CONSULT.DE  Mon Oct 18 13:15:04 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:18 2006
Subject: Attach original message to noritfication?
Message-ID: <mailman.3624.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello,

is it possible to attach the original message or attachment to the virus 
notification?

I know, this is often contra productive. But at the place I'm currently 
working, there is an anti-virus team which wants to get _every_ single 
virus for anlyzis.

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From h.goebel at GOEBEL-CONSULT.DE  Mon Oct 18 13:23:25 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3625.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Thanks for your answers.

Julian Field schrieb:

> Thousands of people use them both with no problems at all. The Postfix
> author has near-religious objections to MailScanner. I didn't interface to
> it in the way that he intended everyone to, I found a faster way. So he
> doesn't like me or MailScanner. Such is life :-)

Oh god! I thought, these guys would have left kindergarden some years 
ago. Would it make sense to drop Wietse a note?

> Most of the MTA's I support have to be started in a very specific way to
> operate with MailScanner, so I start the MTA in the MailScanner init.d
> script so it is the same as all the others I support.

IC.

> This is fixed in the latest release. It was only changed very recently. The

Fine!

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 13:38:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Attach original message to noritfication?
Message-ID: <mailman.3626.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 13:15 18/10/2004, you wrote:
>Hello,
>
>is it possible to attach the original message or attachment to the virus
>notification?
>
>I know, this is often contra productive. But at the place I'm currently
>working, there is an anti-virus team which wants to get _every_ single
>virus for anlyzis.

That's what the quarantine archive is for.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Carl.Boberg at NRM.SE  Mon Oct 18 13:49:25 2004
From: Carl.Boberg at NRM.SE (Carl Boberg)
Date: Thu Jan 12 21:27:18 2006
Subject: Blacklist yahoo group  problem?
Message-ID: <mailman.3627.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi,
I need to blacklist a yahoo group which uses the below form as from address:

sentto-10798619-42-1097426196-[name].[lastname]=nrm.se@returns.groups.yahoo.com

the stuff in [] is edited by me to not disclose the user
The numbers in the from address change from email to email.

I do not wish to blacklist returns.groups.yahoo.com so how can I go about blacklisting this spamming yahoo group...?
It goes by the name [International_Real_Estate_Auction_136] or 137... 

Any ideas?

Cheers
--------------------------------
Carl Boberg
System & Network Administrator
Swedish Museum of Naturalhistory
Frescativägen 40
104 05 Stockholm
Sweden
Tel nr: 08-5195 5116
Mobile: 0701-82 4055
E-mail: carl.boberg@nrm.se
--------------------------------  
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Mon Oct 18 14:05:12 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:18 2006
Subject: antivir-autoupdate broken ?
Message-ID: <mailman.3628.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi there,

i just found the following in the ML-Archive, but there was no answer..

so i found the same in my logs..and wondered why the manual update now
works for me.

So..

in my logs i do find the following:

Oct 18 15:01:08 marcel update.virus.scanners: Found antivir installed
Oct 18 15:01:08 marcel update.virus.scanners: Running autoupdate for
antivir
Oct 18 15:01:08 marcel AntiVir-autoupdate[31720]: AntiVir updater
/usr/lib/AntiVir/antivir --update cannot be run


is there any hint for that?
The update-problem on the Server-Side from antivir itself does no longer
exist.

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Mon Oct 18 14:15:30 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:18 2006
Subject: Inaccurate Queue Amount?
Message-ID: <mailman.3629.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi there,

[...]
> >>
> >> <<< No Message Collected >>>
> >>
> >> in the body...nothing else.  Related?
> >
> > That tends to indicate a locking problem.
>
> Running sendmail 8.13.1-2
>
Had the same on sendmail.
After starting MS you should see what kind of locking-system is used on
your maschine.
On mine it was flock..after changing the Lock-Type into posix within the
MS-Conf everything is working fine here..

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Mon Oct 18 14:19:36 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:18 2006
Subject: Re. Phishing fraud question
Message-ID: <mailman.3630.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi there again ;)

> >
> >MailScanner checks the HTMl-Mail for the a href-tag and the text which is
> >the link displayed in the mail,right?
> >something like -a href="somewhere.com"-nothere.com-/a-  (sorry..but i do
> >not want to use html-tags ;)
>
> Yes.

I just was courious if i got it right :) and i did..gosh..maybe there is
still some hope for me ;)


>
> >but some phishingmails do use images with the so called content and they
> >do contain image-maps, which are behind the so called "text", but do link
> >somewhere else..
>
> There's not a lot I can do about that. I'm not about to write an entire OCR
> system :-)
God behave..
you are doing a marvelous job here, so everything if working fine for me
:)
thanks for the job anyway :))


> Most of that sort of mail will get picked up as spam by SpamAssassin, so it
> shouldn't be a big problem.

i do think the same..as in the past sa said for th last phishing-mails,
those would be spam..and everything was working fine :)

See ya

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From misterpo at IFRANCE.COM  Mon Oct 18 14:24:24 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:18 2006
Subject: How to pass through MailScanner with specific file extension ?
Message-ID: <mailman.3631.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi,

Thanks for your answer. What does this custom rule look like ?

allow \.ast[0-9].xml$

or

allow \.ast?.xml$

Thanks,

PO.

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 14:40:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: How to pass through MailScanner with specific file extension ?
Message-ID: <mailman.3632.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:24 18/10/2004, you wrote:
>Thanks for your answer. What does this custom rule look like ?
>
>allow \.ast[0-9].xml$

Nearly. You must still put the other 2 bits of the line in, even if they
aren't used in allow rules. So you need
allow   \.ast[0-9]\.xml$        -       -
Or even just
allow   \.ast\d\.xml$   -       -
They 4 bits of each line must be tab-separated in this file, as there's no
way for MailScanner to be able to deduce where log text starts and ends.

>allow \.ast?.xml$

No.

The allow/deny rules in filename.rules.conf and filetype.rules.conf are
regular expressions.
In all other "real rules files", ? and * work how you expect them to,
unless you put "/" characters round the expression at which point it is
treated as a regular expression.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 14:22:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Blacklist yahoo group  problem?
Message-ID: <mailman.3633.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 13:49 18/10/2004, you wrote:
>Hi,
>I need to blacklist a yahoo group which uses the below form as from address:
>
>sentto-10798619-42-1097426196-[name].[lastname]=nrm.se@returns.groups.yahoo.com
>
>the stuff in [] is edited by me to not disclose the user
>The numbers in the from address change from email to email.
>
>I do not wish to blacklist returns.groups.yahoo.com so how can I go about
>blacklisting this spamming yahoo group...?
>It goes by the name [International_Real_Estate_Auction_136] or 137...
>
>Any ideas?

Add a rule like this:
From:
/sentto-\d+-\d+-\d+-name\.lastname=nrm\.se\@returns\.groups\.yahoo\.com/ yes
(That should all be on 1 line of course)

You can use arbitrary regular expressions in rules, just surround them in
"/" characters so MailScanner can tell what it's looking at.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 14:50:24 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3634.1137101238.24926.mailscanner@lists.mailscanner.info>

>>
>>> Oct 18 09:55:16 av MailScanner[5425]: Cannot parse
>>> /var/spool/MailScanner/incoming/5425/i9I8t1se006400.header and ,
>>> Can't locate object method "init" via package
>> "MIME::Decoder::QuotedPrint" at
>>> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
>>>
>>> A lot of mail is being rejected by MailScanner due to this which is
>>> causing a lot of headaches
>>>
>>> Any thoughts?
>>
>> Either upgrade to the latest beta release, or else install
>> MIME::Base64 and MIME-tools via CPAN.
>
> The latest version of MIME-tools via CPAN still causes the
> same error, so I rolled back to a much older version.
>
> We are now using:
> 3.05    MIME::Base64
> 5.412   MIME::Tools
>
> I'm very worried about breaking things again :(
>
Sorry for replying to my own email....

If I upgrade to the latest version of MIME::Base64 how will that affect
MIME::Tools?
The error message seems to be specific to MIME::Tools

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Mon Oct 18 15:00:18 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:18 2006
Subject: Per User or Domain Signature
Message-ID: <mailman.3635.1137101238.24926.mailscanner@lists.mailscanner.info>

Good day:

Is it possible in MailScanner to set a signature per only one user, or per
domain?  If so, how ?

Thanks,

Steve

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 15:11:44 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Per User or Domain Signature
Message-ID: <mailman.3636.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Using a ruleset. Please see
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/207.html

At 15:00 18/10/2004, you wrote:
>Good day:
>
>Is it possible in MailScanner to set a signature per only one user, or per
>domain?  If so, how ?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sanjay.patel at REXWIRE.COM  Mon Oct 18 15:04:32 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:18 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3637.1137101238.24926.mailscanner@lists.mailscanner.info>

Although this is a bit of topic I was hoping someone here might have a
answer. I want to send spam not caught by mailscanner back to the server for
sa-learn to learn the spam. The question is "does sa-learn learn the content
of the spam or the headers also?". My concern is that all the headers will
have my info since I am forwarding it and I don't want sa-learn to think I
am a spammer.

Also has anyone noticed that the Outlook junk filter catch's almost all the
spam that makes it through. I think it uses keywords which is pretty weak
but makes it easier for me to set a rule that forwards anything that hits
that folder to go back to the server.

SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 15:11:24 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Per User or Domain Signature
Message-ID: <mailman.3638.1137101238.24926.mailscanner@lists.mailscanner.info>

> Is it possible in MailScanner to set a signature per only one
> user, or per domain?  If so, how ?

It is possible.
Have a look at rulesets

Michele

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Mon Oct 18 14:51:38 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3639.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Michele Neylon :: Blacknight Solutions wrote:
>>>6) Can anybody please clean up the FAQ-O-mat. There are lots of empty
>>>   questions ("New item") and some answers are not readable since
>>>   some lines are about 400 charakters long. Thanks!
>>
>>Anyone out there have a few minutes to do this for me please?
>
>
> I can do it for you this evening if you want :)
> What do I need to be able to do it?

Just log in, go into display options, set everything to yes and you can
do it then.

>
>
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 15:21:47 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3640.1137101238.24926.mailscanner@lists.mailscanner.info>

>>
>> I can do it for you this evening if you want :) What do I need to be
>> able to do it?
>
> Just log in, go into display options, set everything to yes and you

Fine so. I'll do it some time after 1800 IST - when I have "spare" time :)


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 15:03:25 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3641.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 14:50 18/10/2004, you wrote:
> >>
> >>> Oct 18 09:55:16 av MailScanner[5425]: Cannot parse
> >>> /var/spool/MailScanner/incoming/5425/i9I8t1se006400.header and ,
> >>> Can't locate object method "init" via package
> >> "MIME::Decoder::QuotedPrint" at
> >>> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
> >>>
> >>> A lot of mail is being rejected by MailScanner due to this which is
> >>> causing a lot of headaches
> >>>
> >>> Any thoughts?
> >>
> >> Either upgrade to the latest beta release, or else install
> >> MIME::Base64 and MIME-tools via CPAN.
> >
> > The latest version of MIME-tools via CPAN still causes the
> > same error, so I rolled back to a much older version.
> >
> > We are now using:
> > 3.05    MIME::Base64
> > 5.412   MIME::Tools
> >
> > I'm very worried about breaking things again :(
> >
>Sorry for replying to my own email....
>
>If I upgrade to the latest version of MIME::Base64 how will that affect
>MIME::Tools?
>The error message seems to be specific to MIME::Tools

You need to use either
1) The old MIME-tools with all the patches applied,
or
2) The new MIME-tools with the new MIME::Base64.

I'm not sure what happens with the old MIME-tools with the new
MIME::Base64, I'm not convinced it will work, but it should complain fairly
quickly if it won't. I strongly advise you send a few test messages through
it, some with eicar in them to test it.

These problems should all go away with the latest beta.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From h.goebel at GOEBEL-CONSULT.DE  Mon Oct 18 15:36:55 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:18 2006
Subject: Attach original message to noritfication?
Message-ID: <mailman.3642.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

Julian Field schrieb:

> That's what the quarantine archive is for.

Thus I have to write a script for delivering these files from the 
quarantine?

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From misterpo at IFRANCE.COM  Mon Oct 18 14:24:24 2004
From: misterpo at IFRANCE.COM (Mister PO)
Date: Thu Jan 12 21:27:18 2006
Subject: How to pass through MailScanner with specific file extension ?
Message-ID: <mailman.3643.1137101238.24926.mailscanner@lists.mailscanner.info>

Hi,

Thanks for your answer. What does this custom rule look like ?

allow \.ast[0-9].xml$

or

allow \.ast?.xml$

Thanks,

PO.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Mon Oct 18 15:36:01 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:18 2006
Subject: Question about update logs
Message-ID: <mailman.3644.1137101238.24926.mailscanner@lists.mailscanner.info>

After much screwing around (on my part at least) I finally appear to have
the update_virus_scanners script working with no permissions errors.
However, even though /tmp/ClamAV.update.log shows that the database is being
checked on an hourly basis with no errors, my logwatch email still says the
following:

-------------------- clam-update Begin ------------------------

WARNING: Database has not been checked for updates

---------------------- clam-update End -------------------------

I then realized that logwatch is only watching /var/log where the
freshclam.log file resides but which does not appear to be written to when
the update_virus_scanners script runs.

So, I am trying to figure out what the two log files that I apparently have
are doing and what process is writing to them. I have /tmp/ClamAV.update.log
which appears to be written to on an hourly basis
(/etc/cron.hourly/update_virus_scanners). I also have /var/log/freshclam.log
which appears to only be written to when I run freshclam manually.

Can someone clarify how this is supposed to work and what the relationship
of these two log files are? What I would like is if all the log files
resided in /var/log so that logwatch can keep me informed.

Cheers

Dave



David Filchak
President - Zuka Inc.
Toronto, On Canada M5V2J1
www.zuka.net | www.screamingmedia.ca

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From h.goebel at GOEBEL-CONSULT.DE  Mon Oct 18 16:04:53 2004
From: h.goebel at GOEBEL-CONSULT.DE (Hartmut Goebel)
Date: Thu Jan 12 21:27:18 2006
Subject: Notifications/Quarantaine only for viruses,
     not for filenames/fiiletypes?
Message-ID: <mailman.3645.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

how can I make MailScanner to only send Admin Notifications for viruses 
(discovered by the virus scanner) but not for attachemant filtered by 
filename/filetype? Same for Quarantaine.

I look as if one can adjust this for the sender, but not for the admin 
notifications.

-- 
Schönen Gruß - Regards
Hartmut Goebel

| Hartmut Goebel             | IT-Security -- effizient |
| h.goebel@goebel-consult.de | www.goebel-consult.de    |

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 16:22:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Attach original message to noritfication?
Message-ID: <mailman.3646.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 15:36 18/10/2004, you wrote:
>Hi,
>
>Julian Field schrieb:
>
>>That's what the quarantine archive is for.
>
>Thus I have to write a script for delivering these files from the quarantine?

Yes, or else give them some other route to access the quarantine.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 16:23:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Notifications/Quarantaine only for viruses,
     not for filenames/fiiletypes?
Message-ID: <mailman.3647.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:04 18/10/2004, you wrote:
>how can I make MailScanner to only send Admin Notifications for viruses
>(discovered by the virus scanner) but not for attachemant filtered by
>filename/filetype?

Just write a little procmail filter on the admin email address so that it
throws away notifications it is not interested in.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Mon Oct 18 16:26:59 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:18 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3648.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:04 AM 10/18/2004, Sanjay K. Patel wrote:
>Although this is a bit of topic I was hoping someone here might have a
>answer. I want to send spam not caught by mailscanner back to the server for
>sa-learn to learn the spam. The question is "does sa-learn learn the content
>of the spam or the headers also?". My concern is that all the headers will
>have my info since I am forwarding it and I don't want sa-learn to think I
>am a spammer.

Yes, sa-learn does tokenize headers. Especially Received: headers.

Your best bet is to set up a system where you forward messages as
attachments, and then set up a script to yank off the attachments and feed
those to sa-learn.

However, this is dependant on your mail client having a working
forward-as-attachment feature. I'm not sure if outlook does.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sconway at WLNET.COM  Mon Oct 18 16:32:00 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:18 2006
Subject: Per User or Domain Signature
Message-ID: <mailman.3649.1137101238.24926.mailscanner@lists.mailscanner.info>

Thanks very much, I have looked into the rules subdir , and found the README
that outlines exactly what I want to do, sorry for my mistake in not looking
there first.

Thanks,

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, October 18, 2004 10:12 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Per User or Domain Signature

Using a ruleset. Please see
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/207.html

At 15:00 18/10/2004, you wrote:
>Good day:
>
>Is it possible in MailScanner to set a signature per only one user, or per
>domain?  If so, how ?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From G.Pentland at SOTON.AC.UK  Mon Oct 18 16:01:40 2004
From: G.Pentland at SOTON.AC.UK (Pentland G.)
Date: Thu Jan 12 21:27:18 2006
Subject: OT: Quick MailWatch Query, Oracle support?
Message-ID: <mailman.3650.1137101238.24926.mailscanner@lists.mailscanner.info>

I know this is slightly OT but still a reasonable place to ask.

Has anyone got MailWatch working with Oracle?

Gary

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Mon Oct 18 16:34:39 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:18 2006
Subject: OT: Quick MailWatch Query, Oracle support?
Message-ID: <mailman.3651.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Pentland G. wrote:
> I know this is slightly OT but still a reasonable place to ask.
>
> Has anyone got MailWatch working with Oracle?

You could ask on MailWatch's mailing list.

>
> Gary
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rpotter at RPCS.NET  Mon Oct 18 17:19:27 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3652.1137101238.24926.mailscanner@lists.mailscanner.info>

On Mon, 18 Oct 2004, Julian Field wrote:

> These problems should all go away with the latest beta.

Julian.... I installed the lastest beta, and I still have up2date
complaining in RHEL U 3.

Before install, I ran;
rpm -e --nodeps perl
up2date -u perl

# up2date -l

Invalid group id server-cfg

Fetching Obsoletes list for channel: rhel-i386-ws-3...

Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...

Fetching rpm headers...

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7              i386

The following Packages were marked to be skipped by your configuration:

Name                                    Version        Rel  Reason
-------------------------------------------------------------------------------
spamassassin                            2.55           3.2  Pkg name/pattern

The following Packages are obsoleted by newer packages:

Name-Version-Release        obsoleted by      Name-Version-Release
-------------------------------------------------------------------------------
perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
perl-Mail-SpamAssassin-3.0.0-1          spamassassin-2.55-3.2

# MailScanner -v

Running on
Linux dalan.rpcs.net 2.4.21-20.ELsmp #1 SMP Wed Aug 18 20:46:40 EDT 2004 i686 i686 i386 GNU/Linux
This is Red Hat Enterprise Linux WS release 3 (Taroon Update 3)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.35.4
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.23    HTML::Entities
3.26    HTML::Parser
2.24    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.05    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.806   DB_File
1.00    Digest
1.01    Digest::HMAC
2.20    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.31    URI


Any ideas?

Richard

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 17:50:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3653.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
You need to uninstall SpamAssassin 2.55 before installing the new one, the
RPM package names are different so "rpm -Uvh" won't do it properly.

Force it to remove perl-MIME-Base64, then re-install the latest version
using the install.sh script.
("rpm -e --nodeps perl-MIME-Base64" to remove it).

But first please can you also do
rpm -q perl-MIME-Base64
and
rpm -ql perl-MIME-Base64
and send me the output. They should be installed under "site_perl" which
shouldn't conflict with perl at all.

At 17:19 18/10/2004, you wrote:
>On Mon, 18 Oct 2004, Julian Field wrote:
>
> > These problems should all go away with the latest beta.
>
>Julian.... I installed the lastest beta, and I still have up2date
>complaining in RHEL U 3.
>
>Before install, I ran;
>rpm -e --nodeps perl
>up2date -u perl
>
># up2date -l
>
>Invalid group id server-cfg
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3...
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
>
>Fetching rpm headers...
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7              i386
>
>The following Packages were marked to be skipped by your configuration:
>
>Name                                    Version        Rel  Reason
>-------------------------------------------------------------------------------
>spamassassin                            2.55           3.2  Pkg name/pattern
>
>The following Packages are obsoleted by newer packages:
>
>Name-Version-Release        obsoleted by      Name-Version-Release
>-------------------------------------------------------------------------------
>perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
>perl-Mail-SpamAssassin-3.0.0-1          spamassassin-2.55-3.2
>
># MailScanner -v
>
>Running on
>Linux dalan.rpcs.net 2.4.21-20.ELsmp #1 SMP Wed Aug 18 20:46:40 EDT 2004
>i686 i686 i386 GNU/Linux
>This is Red Hat Enterprise Linux WS release 3 (Taroon Update 3)
>This is Perl version 5.008000 (5.8.0)
>
>This is MailScanner version 4.35.4
>Module versions are:
>1.00    AnyDBM_File
>1.13    Archive::Zip
>1.01    Carp
>1.119   Convert::BinHex
>1.00    DirHandle
>1.04    Fcntl
>2.71    File::Basename
>2.05    File::Copy
>2.01    FileHandle
>1.05    File::Path
>0.13    File::Temp
>1.23    HTML::Entities
>3.26    HTML::Parser
>2.24    HTML::TokeParser
>1.20    IO
>1.09    IO::File
>1.122   IO::Pipe
>3.05    MIME::Base64
>5.413   MIME::Decoder
>5.413   MIME::Decoder::UU
>5.413   MIME::Head
>5.413   MIME::Parser
>3.03    MIME::QuotedPrint
>5.413   MIME::Tools
>0.09    Net::CIDR
>1.05    POSIX
>1.75    Socket
>0.03    Sys::Syslog
>1.02    Time::localtime
>
>Optional module versions are:
>1.806   DB_File
>1.00    Digest
>1.01    Digest::HMAC
>2.20    Digest::MD5
>2.10    Digest::SHA1
>0.44    Inline
>0.11    Mail::ClamAV
>3.000000        Mail::SpamAssassin
>1.997   Mail::SPF::Query
>0.15    Net::CIDR::Lite
>0.48    Net::DNS
>missing Net::LDAP
>1.94    Parse::RecDescent
>missing SAVI
>1.2     Sys::Hostname::Long
>2.26    Test::Harness
>0.47    Test::Simple
>1.89    Text::Balanced
>1.31    URI
>
>
>Any ideas?
>
>Richard
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From pparsons at COLUMBIAFUELS.COM  Mon Oct 18 17:48:52 2004
From: pparsons at COLUMBIAFUELS.COM (Philip Parsons)
Date: Thu Jan 12 21:27:18 2006
Subject: I have not received any e-mails for a few days on the list
Message-ID: <mailman.3654.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.6944.0">
<TITLE>I have not received any e-mails for a few days on the list</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->

<P><FONT SIZE=2 FACE="Arial">Is there something wrong ???</FONT>
</P>

<P><FONT SIZE=2 FACE="Arial">&nbsp;</FONT>

<BR><FONT SIZE=2 FACE="Arial">Thank you.</FONT>

<BR><FONT SIZE=2 FACE="Arial">Philip Parsons </FONT>

<BR><FONT SIZE=2 FACE="Arial">Manager IT</FONT>

<BR><FONT SIZE=2 FACE="Arial">&nbsp;</FONT>

<BR><FONT SIZE=2 FACE="Arial">Columbia Fuels Inc.</FONT>

<BR><FONT SIZE=2 FACE="Arial">2669 Wilfert Rd., Victoria BC, V9B 5Z3</FONT>

<BR><FONT SIZE=2 FACE="Arial">Phone: (250) 391-3638</FONT>

<BR><FONT SIZE=2 FACE="Arial">Cell: (250) 883-5972</FONT>

<BR><A HREF="http://www.columbiafuels.com"></FONT></U><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://www.columbiafuels.com</A>

<BR><A HREF="http://www.columbiaenergy.com"></FONT></U><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://www.columbiaenergy.com</A>

<BR><A HREF="http://www.columbiaice.com"></FONT></U><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">http://www.columbiaice.com</A>

<BR><FONT SIZE=2 FACE="Arial">pparsons@columbiafuels.com</FONT>

<BR><FONT SIZE=2 FACE="Arial">E-mail protection by Mailscanner/SA</FONT>

<BR><FONT SIZE=2 FACE="Arial">Virus protection by Bitdefender</FONT><FONT SIZE=2 FACE="Arial">/ClamAv</FONT>
</P>

</BODY>
</HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From rpotter at RPCS.NET  Mon Oct 18 18:05:36 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3655.1137101238.24926.mailscanner@lists.mailscanner.info>

On Mon, 18 Oct 2004, Julian Field wrote:

> You need to uninstall SpamAssassin 2.55 before installing the new one, the
> RPM package names are different so "rpm -Uvh" won't do it properly.

I don't have 2.55 installed. I mark it to be skipped just to be sure.
# rpm -q spamassassin
package spamasaasin is not installed

> But first please can you also do
> rpm -q perl-MIME-Base64

perl-MIME-Base64-3.05-2

> and
> rpm -ql perl-MIME-Base64

/usr/bin/decode-base64
/usr/bin/decode-qp
/usr/bin/encode-base64
/usr/bin/encode-qp
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/MIME/Base64.pm
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/MIME/QuotedPrint.pm
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/auto/MIME/Base64/Base64.so

> and send me the output. They should be installed under "site_perl" which
> shouldn't conflict with perl at all.

Thanks  Richard

> At 17:19 18/10/2004, you wrote:
> >On Mon, 18 Oct 2004, Julian Field wrote:
> >
> > > These problems should all go away with the latest beta.
> >
> >Julian.... I installed the lastest beta, and I still have up2date
> >complaining in RHEL U 3.
> >
> >Before install, I ran;
> >rpm -e --nodeps perl
> >up2date -u perl
> >
> ># up2date -l
> >
> >Invalid group id server-cfg
> >
> >Fetching Obsoletes list for channel: rhel-i386-ws-3...
> >
> >Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
> >
> >Fetching rpm headers...
> >
> >Name                                    Version        Rel
> >----------------------------------------------------------
> >perl                                    5.8.0          88.7              i386
> >
> >The following Packages were marked to be skipped by your configuration:
> >
> >Name                                    Version        Rel  Reason
> >-------------------------------------------------------------------------------
> >spamassassin                            2.55           3.2  Pkg name/pattern
> >
> >The following Packages are obsoleted by newer packages:
> >
> >Name-Version-Release        obsoleted by      Name-Version-Release
> >-------------------------------------------------------------------------------
> >perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
> >perl-Mail-SpamAssassin-3.0.0-1          spamassassin-2.55-3.2
> >
> ># MailScanner -v
> >
> >Running on
> >Linux dalan.rpcs.net 2.4.21-20.ELsmp #1 SMP Wed Aug 18 20:46:40 EDT 2004
> >i686 i686 i386 GNU/Linux
> >This is Red Hat Enterprise Linux WS release 3 (Taroon Update 3)
> >This is Perl version 5.008000 (5.8.0)
> >
> >This is MailScanner version 4.35.4
> >Module versions are:
> >1.00    AnyDBM_File
> >1.13    Archive::Zip
> >1.01    Carp
> >1.119   Convert::BinHex
> >1.00    DirHandle
> >1.04    Fcntl
> >2.71    File::Basename
> >2.05    File::Copy
> >2.01    FileHandle
> >1.05    File::Path
> >0.13    File::Temp
> >1.23    HTML::Entities
> >3.26    HTML::Parser
> >2.24    HTML::TokeParser
> >1.20    IO
> >1.09    IO::File
> >1.122   IO::Pipe
> >3.05    MIME::Base64
> >5.413   MIME::Decoder
> >5.413   MIME::Decoder::UU
> >5.413   MIME::Head
> >5.413   MIME::Parser
> >3.03    MIME::QuotedPrint
> >5.413   MIME::Tools
> >0.09    Net::CIDR
> >1.05    POSIX
> >1.75    Socket
> >0.03    Sys::Syslog
> >1.02    Time::localtime
> >
> >Optional module versions are:
> >1.806   DB_File
> >1.00    Digest
> >1.01    Digest::HMAC
> >2.20    Digest::MD5
> >2.10    Digest::SHA1
> >0.44    Inline
> >0.11    Mail::ClamAV
> >3.000000        Mail::SpamAssassin
> >1.997   Mail::SPF::Query
> >0.15    Net::CIDR::Lite
> >0.48    Net::DNS
> >missing Net::LDAP
> >1.94    Parse::RecDescent
> >missing SAVI
> >1.2     Sys::Hostname::Long
> >2.26    Test::Harness
> >0.47    Test::Simple
> >1.89    Text::Balanced
> >1.31    URI
> >
> >
> >Any ideas?
> >
> >Richard
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>


Cheers!
--
Richard Potter
Re/Max Team ideal Realty Inc.
Kingston, ON  CANADA              http://www.kingstonhouses.ca

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 18:16:55 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3656.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What does it actually do when you "update -u"?
As your MIME::Base64 is installed in the right place I would expect to see
it, and you don't have the spamassassin rpm installed, I don't understand
its grounds for complaint. If it is actually complaining at all, and not
just warning about stuff that doesn't matter.

At 18:05 18/10/2004, you wrote:
>On Mon, 18 Oct 2004, Julian Field wrote:
>
> > You need to uninstall SpamAssassin 2.55 before installing the new one, the
> > RPM package names are different so "rpm -Uvh" won't do it properly.
>
>I don't have 2.55 installed. I mark it to be skipped just to be sure.
># rpm -q spamassassin
>package spamasaasin is not installed
>
> > But first please can you also do
> > rpm -q perl-MIME-Base64
>
>perl-MIME-Base64-3.05-2
>
> > and
> > rpm -ql perl-MIME-Base64
>
>/usr/bin/decode-base64
>/usr/bin/decode-qp
>/usr/bin/encode-base64
>/usr/bin/encode-qp
>/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/MIME/Base64.pm
>/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/MIME/QuotedPrint.pm
>/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/auto/MIME/Base64/Base64.bs
>/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi/auto/MIME/Base64/Base64.so
>
> > and send me the output. They should be installed under "site_perl" which
> > shouldn't conflict with perl at all.
>
>Thanks  Richard
>
> > At 17:19 18/10/2004, you wrote:
> > >On Mon, 18 Oct 2004, Julian Field wrote:
> > >
> > > > These problems should all go away with the latest beta.
> > >
> > >Julian.... I installed the lastest beta, and I still have up2date
> > >complaining in RHEL U 3.
> > >
> > >Before install, I ran;
> > >rpm -e --nodeps perl
> > >up2date -u perl
> > >
> > ># up2date -l
> > >
> > >Invalid group id server-cfg
> > >
> > >Fetching Obsoletes list for channel: rhel-i386-ws-3...
> > >
> > >Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
> > >
> > >Fetching rpm headers...
> > >
> > >Name                                    Version        Rel
> > >----------------------------------------------------------
> > >perl                                    5.8.0          88.7
>    i386
> > >
> > >The following Packages were marked to be skipped by your configuration:
> > >
> > >Name                                    Version        Rel  Reason
> > >-----------------------------------------------------------------------
> --------
> > >spamassassin                            2.55           3.2  Pkg
> name/pattern
> > >
> > >The following Packages are obsoleted by newer packages:
> > >
> > >Name-Version-Release        obsoleted by      Name-Version-Release
> > >-----------------------------------------------------------------------
> --------
> > >perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
> > >perl-Mail-SpamAssassin-3.0.0-1          spamassassin-2.55-3.2
> > >
> > ># MailScanner -v
> > >
> > >Running on
> > >Linux dalan.rpcs.net 2.4.21-20.ELsmp #1 SMP Wed Aug 18 20:46:40 EDT 2004
> > >i686 i686 i386 GNU/Linux
> > >This is Red Hat Enterprise Linux WS release 3 (Taroon Update 3)
> > >This is Perl version 5.008000 (5.8.0)
> > >
> > >This is MailScanner version 4.35.4
> > >Module versions are:
> > >1.00    AnyDBM_File
> > >1.13    Archive::Zip
> > >1.01    Carp
> > >1.119   Convert::BinHex
> > >1.00    DirHandle
> > >1.04    Fcntl
> > >2.71    File::Basename
> > >2.05    File::Copy
> > >2.01    FileHandle
> > >1.05    File::Path
> > >0.13    File::Temp
> > >1.23    HTML::Entities
> > >3.26    HTML::Parser
> > >2.24    HTML::TokeParser
> > >1.20    IO
> > >1.09    IO::File
> > >1.122   IO::Pipe
> > >3.05    MIME::Base64
> > >5.413   MIME::Decoder
> > >5.413   MIME::Decoder::UU
> > >5.413   MIME::Head
> > >5.413   MIME::Parser
> > >3.03    MIME::QuotedPrint
> > >5.413   MIME::Tools
> > >0.09    Net::CIDR
> > >1.05    POSIX
> > >1.75    Socket
> > >0.03    Sys::Syslog
> > >1.02    Time::localtime
> > >
> > >Optional module versions are:
> > >1.806   DB_File
> > >1.00    Digest
> > >1.01    Digest::HMAC
> > >2.20    Digest::MD5
> > >2.10    Digest::SHA1
> > >0.44    Inline
> > >0.11    Mail::ClamAV
> > >3.000000        Mail::SpamAssassin
> > >1.997   Mail::SPF::Query
> > >0.15    Net::CIDR::Lite
> > >0.48    Net::DNS
> > >missing Net::LDAP
> > >1.94    Parse::RecDescent
> > >missing SAVI
> > >1.2     Sys::Hostname::Long
> > >2.26    Test::Harness
> > >0.47    Test::Simple
> > >1.89    Text::Balanced
> > >1.31    URI
> > >
> > >
> > >Any ideas?
> > >
> > >Richard
> > >
> > >------------------------ MailScanner list ------------------------
> > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > >'leave mailscanner' in the body of the email.
> > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
>
>Cheers!
>--
>Richard Potter
>Re/Max Team ideal Realty Inc.
>Kingston, ON  CANADA              http://www.kingstonhouses.ca
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Mon Oct 18 10:18:51 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3657.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Michelle

have you upgrades MIME::decoder via CPAN??? I seem to remember Julian
making this suggestion to a similar problem last week..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Michele Neylon :: Blacknight Solutions wrote:
> This error keeps on appearing in logs since we upgraded to the latest
> stable:
>
> Oct 18 09:55:16 av MailScanner[5425]: Cannot parse
> /var/spool/MailScanner/incoming/5425/i9I8t1se006400.header and , Can't
> locate object method "init" via package "MIME::Decoder::QuotedPrint" at
> /usr/lib/perl5/site_perl/5.8.0/MIME/Decoder.pm line 179.
>
> A lot of mail is being rejected by MailScanner due to this which is causing
> a lot of headaches
>
> Any thoughts?
>
> Michele
>
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Mon Oct 18 16:38:34 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:18 2006
Subject: OT: Quick MailWatch Query, Oracle support?
Message-ID: <mailman.3658.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Gary

not that I know of, someone has ported it to PostgresSQL...

BTW, this should really be on the mailwatch uses list....yes I know you
tagged the subject with OT.....:-)


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Pentland G. wrote:
> I know this is slightly OT but still a reasonable place to ask.
>
> Has anyone got MailWatch working with Oracle?
>
> Gary
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Mon Oct 18 17:54:29 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:18 2006
Subject: I have not received any e-mails for a few days on the list
Message-ID: <mailman.3659.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Philip

lots of traffic over the last few days - hopefully you get two of these
emails..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Philip Parsons wrote:
> Is there something wrong ???
>
>
> Thank you.
> Philip Parsons
> Manager IT
>
> Columbia Fuels Inc.
> 2669 Wilfert Rd., Victoria BC, V9B 5Z3
> Phone: (250) 391-3638
> Cell: (250) 883-5972
> _http://www.columbiafuels.com_
> _http://www.columbiaenergy.com_
> _http://www.columbiaice.com_
> pparsons@columbiafuels.com
> E-mail protection by Mailscanner/SA
> Virus protection by Bitdefender/ClamAv
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ds at CARIBENET.COM  Mon Oct 18 18:30:53 2004
From: ds at CARIBENET.COM (Dirk Enrique Seiffert - CaribeNet)
Date: Thu Jan 12 21:27:18 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3660.1137101238.24926.mailscanner@lists.mailscanner.info>

I move all Spam that didn't get caught into an ima folder called SPAM_Learn
every night I run a cronscript:

sa-learn --spam --mbox /home/username/INBOX.SPAM_Learn --rebuild


On Monday 18 October 2004 09:04, you wrote:
> Although this is a bit of topic I was hoping someone here might have a
> answer. I want to send spam not caught by mailscanner back to the server
> for sa-learn to learn the spam. The question is "does sa-learn learn the
> content of the spam or the headers also?". My concern is that all the
> headers will have my info since I am forwarding it and I don't want
> sa-learn to think I am a spammer.
>
> Also has anyone noticed that the Outlook junk filter catch's almost all the
> spam that makes it through. I think it uses keywords which is pretty weak
> but makes it easier for me to set a rule that forwards anything that hits
> that folder to go back to the server.
>
> SKP
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
CaribeNet S.A. - Cartagena - Colombia
        www.caribenet.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rpotter at RPCS.NET  Mon Oct 18 18:52:37 2004
From: rpotter at RPCS.NET (Richard Potter)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3661.1137101238.24926.mailscanner@lists.mailscanner.info>

On Mon, 18 Oct 2004, Julian Field wrote:

> What does it actually do when you "update -u"?
> As your MIME::Base64 is installed in the right place I would expect to see
> it, and you don't have the spamassassin rpm installed, I don't understand
> its grounds for complaint. If it is actually complaining at all, and not
> just warning about stuff that doesn't matter.

Well.. watch this:

# rpm -e perl-MIME-Base64

# rpm -e --nodeps perl

# up2date -u perl
Invalid group id server-cfg

Fetching Obsoletes list for channel: rhel-i386-ws-3...

Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...

Fetching rpm headers...
Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7              i386

Testing package set / solving RPM inter-dependencies...
perl-5.8.0-88.7.i386.rpm:    Retrieved.
Preparing
Installing /var/spool/up2date/perl-5.8.0-88.7.i386.rpm...

# up2date -u
Invalid group id server-cfg

Fetching Obsoletes list for channel: rhel-i386-ws-3...

Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...

Fetching rpm headers...

Name                                    Version        Rel
----------------------------------------------------------

The following Packages were marked to be skipped by your configuration:

Name                                    Version        Rel  Reason
-------------------------------------------------------------------------------
spamassassin                            2.55           3.2  Pkg name/pattern

All packages are currently up to date

# rpm -ivh perl-MIME-Base64-3.05-2.i386.rpm
Preparing...                ##################################################
perl-MIME-Base64            ##################################################

# up2date -u
Invalid group id server-cfg

Fetching Obsoletes list for channel: rhel-i386-ws-3...

Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...

Fetching rpm headers...

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7              i386


Testing package set / solving RPM inter-dependencies...
RPM package conflict error.  The message was:
Test install failed because of package conflicts:
package perl-5.8.0-88.7 is already installed

# up2date -l
Invalid group id server-cfg

Fetching Obsoletes list for channel: rhel-i386-ws-3...

Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...

Fetching rpm headers...

Name                                    Version        Rel
----------------------------------------------------------
perl                                    5.8.0          88.7              i386

The following Packages were marked to be skipped by your configuration:

Name                                    Version        Rel  Reason
-------------------------------------------------------------------------------
spamassassin                            2.55           3.2  Pkg name/pattern

The following Packages are obsoleted by newer packages:

Name-Version-Release        obsoleted by      Name-Version-Release
-------------------------------------------------------------------------------
perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
perl-Mail-SpamAssassin-3.0.0-1          spamassassin-2.55-3.2


I am going in circles here.

Richard

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 18 18:55:11 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3662.1137101238.24926.mailscanner@lists.mailscanner.info>

MailScanner mailing list wrote:
> Michelle
>
> have you upgrades MIME::decoder via CPAN??? I seem to
> remember Julian making this suggestion to a similar problem
> last week..
>

Martin

We upgraded via cpan but it didn't make any difference.
Rolling back the version of MIME::Tools made the problem go away, but I am
not a happy bunny
I'm trying to find a quiet mail server on our network to run some tests on
:(

I really don't want any more mail going missing..

Michele

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 18 19:12:01 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3663.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
So the up2date -u works okay. I can't see where it is convinced that you
have spamassassin rpm installed, when you don't. I haven't been able to get
my RHEL3 system as confused as this, it seems to think with "up2date -l"
that perl-MIME-Base64 is obsoleted by perl-5.8.0 but that doesn't mean it
actually minds too much.

If you "rpm -ql perl-MIME-Base64" and "rpm -ql perl" you will see that they
don't actually share any files in common at all, so I don't see why up2date
moans. Both "rpm --verify perl-MIME-Base64" and "rpm --verify perl"
succeed, so the packages haven't been upset at all.

Other than up2date moaning about the package being obsoleted, I can find no
trace that anything is really wrong at all! It all works just fine.

At 18:52 18/10/2004, you wrote:
>On Mon, 18 Oct 2004, Julian Field wrote:
>
> > What does it actually do when you "update -u"?
> > As your MIME::Base64 is installed in the right place I would expect to see
> > it, and you don't have the spamassassin rpm installed, I don't understand
> > its grounds for complaint. If it is actually complaining at all, and not
> > just warning about stuff that doesn't matter.
>
>Well.. watch this:
>
># rpm -e perl-MIME-Base64
>
># rpm -e --nodeps perl
>
># up2date -u perl
>Invalid group id server-cfg
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3...
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
>
>Fetching rpm headers...
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7              i386
>
>Testing package set / solving RPM inter-dependencies...
>perl-5.8.0-88.7.i386.rpm:    Retrieved.
>Preparing
>Installing /var/spool/up2date/perl-5.8.0-88.7.i386.rpm...
>
># up2date -u
>Invalid group id server-cfg
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3...
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
>
>Fetching rpm headers...
>
>Name                                    Version        Rel
>----------------------------------------------------------
>
>The following Packages were marked to be skipped by your configuration:
>
>Name                                    Version        Rel  Reason
>-------------------------------------------------------------------------------
>spamassassin                            2.55           3.2  Pkg name/pattern
>
>All packages are currently up to date
>
># rpm -ivh perl-MIME-Base64-3.05-2.i386.rpm
>Preparing...                ##################################################
>perl-MIME-Base64            ##################################################
>
># up2date -u
>Invalid group id server-cfg
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3...
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
>
>Fetching rpm headers...
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7              i386
>
>
>Testing package set / solving RPM inter-dependencies...
>RPM package conflict error.  The message was:
>Test install failed because of package conflicts:
>package perl-5.8.0-88.7 is already installed
>
># up2date -l
>Invalid group id server-cfg
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3...
>
>Fetching Obsoletes list for channel: rhel-i386-ws-3-extras...
>
>Fetching rpm headers...
>
>Name                                    Version        Rel
>----------------------------------------------------------
>perl                                    5.8.0          88.7              i386
>
>The following Packages were marked to be skipped by your configuration:
>
>Name                                    Version        Rel  Reason
>-------------------------------------------------------------------------------
>spamassassin                            2.55           3.2  Pkg name/pattern
>
>The following Packages are obsoleted by newer packages:
>
>Name-Version-Release        obsoleted by      Name-Version-Release
>-------------------------------------------------------------------------------
>perl-MIME-Base64-3.05-2                 perl-5.8.0-88.7
>perl-Mail-SpamAssassin-3.0.0-1          spamassassin-2.55-3.2
>
>
>I am going in circles here.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Mon Oct 18 18:28:07 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:18 2006
Subject: Some new-user questions
Message-ID: <mailman.3664.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Michele Neylon :: Blacknight Solutions wrote:
>>>I can do it for you this evening if you want :) What do I need to be
>>>able to do it?
>>
>>Just log in, go into display options, set everything to yes and you
>
>
> Fine so. I'll do it some time after 1800 IST - when I have "spare" time :)

I've done some cleanup.  I removed all the empty items I saw.  For the
entries with no wrap-up, I don't feel like checking every single entry
to detect them, so I suggest that anyone who finds one either provide
the URL, or edit it yourself (you just need an acount, log in, go into
"appereanc" and set it to show everything, you'll get the editing options.

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From david at ECHOPC.COM  Mon Oct 18 20:06:42 2004
From: david at ECHOPC.COM (David Young)
Date: Thu Jan 12 21:27:18 2006
Subject: MailScanner + Postfix can't find /etc/postfix.in/main.cf
Message-ID: <mailman.3665.1137101238.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi, I've been trying to setup MailScanner with 
Postfix by following the "Using MailScanner with Postfix" instruction on the 
mailscanner website.&nbsp; When I startup MailScanner, I get the following 
error:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Oct 13 16:29:36 node1 postfix[28270]: fatal: open 
/etc/postfix.in/main.cf: No such file or directory<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>The installation guide says that Postfix can handle 
both incoming and outgoing mail, but doesn't make mention of a postfix.in 
directory.&nbsp; Anyone using MailScanner with Postfix?&nbsp; And if so, can you 
provide some pointers (and gotchas) that I need to be aware of to get this thing 
setup?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Thanks a bunch,</FONT></DIV>
<DIV><FONT face=Arial size=2>David</FONT></DIV>
<DIV><FONT face=Arial size=2>&nbsp;</DIV></FONT></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From sanjay.patel at REXWIRE.COM  Mon Oct 18 20:29:00 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:18 2006
Subject: Error - MIME::Decoder::QuotedPrint
Message-ID: <mailman.3666.1137101238.24926.mailscanner@lists.mailscanner.info>

In order to MailScanner to work upgrading or installing all pre-requisites
through CPAN is the best option. We are running MS on Mandrake 10.1 and once
we installed all the packages through CPAN the install went perfect.

Use Webmin to install the packages if command line looks intermediating.

-SKP

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Michele Neylon :: Blacknight Solutions
Sent: Monday, October 18, 2004 1:55 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Error - MIME::Decoder::QuotedPrint

MailScanner mailing list wrote:
> Michelle
>
> have you upgrades MIME::decoder via CPAN??? I seem to remember Julian
> making this suggestion to a similar problem last week..
>

Martin

We upgraded via cpan but it didn't make any difference.
Rolling back the version of MIME::Tools made the problem go away, but I am
not a happy bunny
I'm trying to find a quiet mail server on our network to run some tests on
:(

I really don't want any more mail going missing..

Michele

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Mon Oct 18 20:26:32 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:18 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3667.1137101238.24926.mailscanner@lists.mailscanner.info>

How do you remove your headers? If individuals forward mail to a mailbox for
sa to learn, than the mail will have header information about the
individuals.

Do you run a script to remove headers?

-SKP

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dirk Enrique Seiffert - CaribeNet
Sent: Monday, October 18, 2004 1:31 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Sa-learn tricks

I move all Spam that didn't get caught into an ima folder called SPAM_Learn
every night I run a cronscript:

sa-learn --spam --mbox /home/username/INBOX.SPAM_Learn --rebuild


On Monday 18 October 2004 09:04, you wrote:
> Although this is a bit of topic I was hoping someone here might have a
> answer. I want to send spam not caught by mailscanner back to the
> server for sa-learn to learn the spam. The question is "does sa-learn
> learn the content of the spam or the headers also?". My concern is
> that all the headers will have my info since I am forwarding it and I
> don't want sa-learn to think I am a spammer.
>
> Also has anyone noticed that the Outlook junk filter catch's almost
> all the spam that makes it through. I think it uses keywords which is
> pretty weak but makes it easier for me to set a rule that forwards
> anything that hits that folder to go back to the server.
>
> SKP
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
CaribeNet S.A. - Cartagena - Colombia
        www.caribenet.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstuart at EDENPR.K12.MN.US  Mon Oct 18 20:32:59 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:18 2006
Subject: mydoom
Message-ID: <mailman.3668.1137101238.24926.mailscanner@lists.mailscanner.info>

I am starting to have a problem with a Mydoom variant Mydoom.O that
comes in a zip file that is not password protected.  I hae had no
problem stopping this virus in the past. F-prot detects it if I run a
manual scan, but when it comes through as mail it gets by. The only
difference I can see between the past ones that got stopped and this one
is that the one getting by is an archive that is 2 deep.  I have set
Mailscanner up to scan archives that are up tp 25 deep, but they still
get through. If anyone can help I would really appreciate it.

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstuart at EDENPR.K12.MN.US  Mon Oct 18 20:54:31 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:19 2006
Subject: mydoom
Message-ID: <mailman.3669.1137101238.24926.mailscanner@lists.mailscanner.info>

never mind I seen this is fix in a newer version of Mailscanner.

>>> jstuart@EDENPR.K12.MN.US 10/18/04 02:32PM >>>
I am starting to have a problem with a Mydoom variant Mydoom.O that
comes in a zip file that is not password protected.  I hae had no
problem stopping this virus in the past. F-prot detects it if I run a
manual scan, but when it comes through as mail it gets by. The only
difference I can see between the past ones that got stopped and this
one
is that the one getting by is an archive that is 2 deep.  I have set
Mailscanner up to scan archives that are up tp 25 deep, but they still
get through. If anyone can help I would really appreciate it.

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vboulytchev at COINFOTECH.COM  Mon Oct 18 22:27:44 2004
From: vboulytchev at COINFOTECH.COM (Boulytchev, Vasiliy)
Date: Thu Jan 12 21:27:19 2006
Subject: "Failed to link message body between queues" error
Message-ID: <mailman.3670.1137101239.24926.mailscanner@lists.mailscanner.info>


Ladies and Gents,
        We are trying to load balance mailscanning.  I will post everyone
on our progress.  For your info, the two folders below are NFS shared, 
we get the following in syslog:

Failed to link message body between queues
(/usr/local/mailscanner.out/df22831 -->
/usr/local/mailscanner.in/df22831)

For some reason they never make it to the mailscanner.out folder &#8230; 
Any quick suggestions?

Im going to go dig in the code.


Thanks,
Vasiliy Boulytchev
Colorado Information Technologies, Inc.
http://www.coinfotech.com

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-PKCS7-SIGNATURE  6KB. ]
    [ Unable to print this part. ]


From SJCJonker at SJC.NL  Mon Oct 18 22:44:46 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:19 2006
Subject: "Failed to link message body between queues" error
Message-ID: <mailman.3671.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello Vasiliy,

Boulytchev, Vasiliy said the following on 18-Oct-04 23:27:
> Ladies and Gents,
>         We are trying to load balance mailscanning.  I will post 
> everyone on our progress.  For your info, the two folders below are NFS 
> shared,  we get the following in syslog:

I assume you are using sendmail, afaik mailscanner uses hardlinks to 
perform this. Hardlinks can only be made on one filesystem. This could 
be part of your problem. I'm uncertain whether hardlinks work on NFS, 
but they will not work when the 2 directories are mounted seperatly.

Next to this i'm wondering if it's save to use nfs for you're inbound 
queues. But depending on equipment and other parameters that's something 
for you to decided.

> 
> Failed to link message body between queues 
> (/usr/local/mailscanner.out/df22831 --> /usr/local/mailscanner.in/df22831)
> 
> For some reason they never make it to the mailscanner.out folder ^Å  Any 
> quick suggestions?

See above.

> Im going to go dig in the code.

P.S. Next time please include some more detail suchs as:
Operating system, version and distro
Mailer and Version

SpamAssassin version
Virusscanners used
And maybe mailscanner -v

Without the first 2 it's almost impossible to answer any questions, the 
last 3 differ depending on the question

-- 
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From hden at KCBBS.GEN.NZ  Mon Oct 18 23:07:50 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:19 2006
Subject: Adding 2+2 and getting 5
Message-ID: <mailman.3672.1137101239.24926.mailscanner@lists.mailscanner.info>

Recently I wrote to the list regarding a problem, namely
that MailScanner was locking up our server [server freezing
up]

Seems I had incorrectly jumped to a wrong conclusion. Path
followed = Box locking up >> Resd Archives >>see previous
mail regarding MS and CPUs running at 100% locking up systems,
Symptoms fit >>Blame MS.

However, I need to retract that comment. It was NOT MS that
was causing the system freeze ups. Temporarily moved MS to
another [far less resourced and older] server, running flawlessly!

In the mean time, the original server has frozen at times.
So, apologies Julian for blamming MS - my bad!

So am currently building a replacement from scratch on a new
box. Using CenTOS 3.3. Went better after I sorted the 'UTF-8'
setting 'as documented'<G>,  but had some grief with Digest::SHA1,
several perl modules wouldn't pass 'make test'. Trying to update
SHAI via cpan ended with 'up to date' responses. Had to do an
'ugly hack' to reinstall it, but it seemed to have worked OK.

Q How can I 'feed' the new box some test mail to test it out?

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jase at SENSIS.COM  Mon Oct 18 23:11:29 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:19 2006
Subject: "Failed to link message body between queues" er ror
Message-ID: <mailman.3673.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2900.2523" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=267300922-18102004><FONT face=Arial color=#0000ff size=2>Check 
that your locking is working correctly, and you don't have multiple processes 
scanning the same message.</FONT></SPAN></DIV>
<DIV><SPAN class=267300922-18102004><FONT face=Arial color=#0000ff 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=267300922-18102004><FONT face=Arial color=#0000ff 
size=2>Jase</FONT></SPAN></DIV>
<BLOCKQUOTE style="MARGIN-RIGHT: 0px">
  <DIV></DIV>
  <DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left><FONT 
  face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> Boulytchev, 
  Vasiliy [mailto:vboulytchev@COINFOTECH.COM] <BR><B>Sent:</B> Monday, October 
  18, 2004 5:28 PM<BR><B>To:</B> MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> 
  [MAILSCANNER] "Failed to link message body between queues" 
  error<BR><BR></FONT></DIV><!-- Converted from text/rtf format -->
  <P><SPAN lang=en-us><FONT face=Tahoma color=#000080 size=2>Ladies and 
  Gents,</FONT></SPAN> <BR><SPAN 
  lang=en-us>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT face=Tahoma 
  color=#000080 size=2>We are trying to load balance mailscanning.&nbsp; I will 
  post everyone on our progress.&nbsp; For your info, the two folders below are 
  NFS shared,&nbsp; we get the following in syslog:</FONT></SPAN><SPAN 
  lang=ru></SPAN></P>
  <P><SPAN lang=ru><FONT face=Tahoma color=#000080 size=2>Failed to link message 
  body between queues (/usr/local/mailscanner.out/df22831 --&gt; 
  /usr/local/mailscanner.in/df22831)</FONT></SPAN> </P>
  <P><SPAN lang=en-us><FONT face=Tahoma color=#000080 size=2>For some reason 
  they never make it to the mailscanner.out folder ...&nbsp; Any quick 
  suggestions?</FONT></SPAN> </P>
  <P><SPAN lang=en-us><FONT face=Tahoma color=#000080 size=2>Im going to go dig 
  in the code.</FONT></SPAN><SPAN lang=ru></SPAN> </P><BR>
  <P><SPAN lang=en-us><FONT face=Tahoma color=#000080 
  size=2>Thanks,</FONT></SPAN> <BR><SPAN lang=en-us><FONT face=Tahoma 
  color=#000080 size=2>Vasiliy Boulytchev</FONT></SPAN><SPAN lang=ru></SPAN> 
  <BR><SPAN lang=en-us><FONT face=Tahoma color=#000080 size=2>Colorado 
  Information Technologies, Inc.</FONT></SPAN><SPAN lang=ru></SPAN> <BR><SPAN 
  lang=en-us></SPAN><A href="http://www.coinfotech.com"></U></SPAN></FONT></U></SPAN></SPAN><SPAN 
  lang=en-us><U><SPAN lang=en-us><U><FONT face=Tahoma color=#0000ff 
  size=2>http://www.coinfotech.com<SPAN 
  lang=en-us></A><SPAN lang=en-us></SPAN><SPAN lang=ru></SPAN><SPAN 
  lang=ru></SPAN><SPAN lang=ru></SPAN> </P>------------------------ MailScanner 
  list ------------------------ To unsubscribe, email <A 
  href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> with the 
  words:<BR>'leave mailscanner' in the body of the email.<BR>Before posting, 
  read the MAQ (<A 
  href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
  the archives (<A 
  href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>).</BLOCKQUOTE></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From sanjay.patel at REXWIRE.COM  Mon Oct 18 23:26:37 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:19 2006
Subject: Panda Update Script
Message-ID: <mailman.3674.1137101239.24926.mailscanner@lists.mailscanner.info>

After looking for a decent script to update panda, I decided to write my
own. This is the first script I have ever written. Its not the best script
on Earth but it downloads the file ad puts it in the right dir.

Hope it helps anyone who wants to use panda. It's a cheap alternative and
works great with MailScanner thanks to Julian's efforts.


-SKP




------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-SH  795bytes. ]
    [ Unable to print this part. ]


From garry at GLENDOWN.DE  Mon Oct 18 23:47:02 2004
From: garry at GLENDOWN.DE (Garry Glendown)
Date: Thu Jan 12 21:27:19 2006
Subject: "Failed to link message body between queues" error
Message-ID: <mailman.3675.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Boulytchev, Vasiliy wrote:
> Ladies and Gents,
>         We are trying to load balance mailscanning.  I will post 
> everyone on our progress.  For your info, the two folders below are NFS 
> shared,  we get the following in syslog:
> 
> Failed to link message body between queues 
> (/usr/local/mailscanner.out/df22831 --> /usr/local/mailscanner.in/df22831)
> 
> For some reason they never make it to the mailscanner.out folder ^Å  Any 
> quick suggestions?

Why do you bother to share the queue between the two machines? A 
spam/virus filter does not require shared data (maybe apart from some 
config files, which could be updated via simple batch jobs), especially 
not the message queues ... every message is independent of the next ...

But maybe you have some clever reason for using NFS between the machines 
that I can't see at the moment ...

-garry

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From leduc at CTS.COM  Tue Oct 19 00:46:09 2004
From: leduc at CTS.COM (Gene LeDuc)
Date: Thu Jan 12 21:27:19 2006
Subject: freshclam error
Message-ID: <mailman.3676.1137101239.24926.mailscanner@lists.mailscanner.info>

Yikes!

OS is RH 8.0.  I just upgraded from 4.24 to 4.34.8.  I had clamav and sophos
installed and working with 4.24.  In addition to running the MS install
script I ran the one that installs clamav and SA.

Running freshclam gives me this:
"freshclam: relocation error: freshclam: undefined symbol: cl_gentemp"

Can anyone give me a quick idea of what's wrong?  The howto links on the
clamav faq page go to a generic "we've moved to www.clamav.net" page, so I
used the defaults and installed from source.

Thanks in advance!
Gene

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ds at CARIBENET.COM  Tue Oct 19 00:51:10 2004
From: ds at CARIBENET.COM (Dirk Enrique Seiffert - CaribeNet)
Date: Thu Jan 12 21:27:19 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3677.1137101239.24926.mailscanner@lists.mailscanner.info>

On Monday 18 October 2004 14:26, Sanjay K. Patel wrote:
> How do you remove your headers? If individuals forward mail to a mailbox
> for sa to learn, than the mail will have header information about the
> individuals.
>
> Do you run a script to remove headers?

As I just move (not forward!) the mails into a dedicated imap-folder they
still have their original headers.  No need to modify the headers.

Hope this helps

Enrique

>
> -SKP
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Dirk Enrique Seiffert - CaribeNet
> Sent: Monday, October 18, 2004 1:31 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Sa-learn tricks
>
> I move all Spam that didn't get caught into an ima folder called SPAM_Learn
> every night I run a cronscript:
>
> sa-learn --spam --mbox /home/username/INBOX.SPAM_Learn --rebuild
>
> On Monday 18 October 2004 09:04, you wrote:
> > Although this is a bit of topic I was hoping someone here might have a
> > answer. I want to send spam not caught by mailscanner back to the
> > server for sa-learn to learn the spam. The question is "does sa-learn
> > learn the content of the spam or the headers also?". My concern is
> > that all the headers will have my info since I am forwarding it and I
> > don't want sa-learn to think I am a spammer.
> >
> > Also has anyone noticed that the Outlook junk filter catch's almost
> > all the spam that makes it through. I think it uses keywords which is
> > pretty weak but makes it easier for me to set a rule that forwards
> > anything that hits that folder to go back to the server.
> >
> > SKP
> >
> > ------------------------ MailScanner list ------------------------ To
> > unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> CaribeNet S.A. - Cartagena - Colombia
>         www.caribenet.com
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
CaribeNet S.A. - Cartagena - Colombia
        www.caribenet.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 00:49:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: freshclam error
Message-ID: <mailman.3678.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 00:46 19/10/2004, you wrote:
>Yikes!
>
>OS is RH 8.0.  I just upgraded from 4.24 to 4.34.8.  I had clamav and sophos
>installed and working with 4.24.  In addition to running the MS install
>script I ran the one that installs clamav and SA.
>
>Running freshclam gives me this:
>"freshclam: relocation error: freshclam: undefined symbol: cl_gentemp"

What happens when you run update_virus_scanners?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From leduc at CTS.COM  Tue Oct 19 01:37:24 2004
From: leduc at CTS.COM (Gene LeDuc)
Date: Thu Jan 12 21:27:19 2006
Subject: freshclam error
Message-ID: <mailman.3679.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi Julian,

I found a problem, if not _the_ problem.  There was an old version of
freshclam in /usr/bin, the new version was in /usr/local/bin, and /usr/bin
was first in the path.  I deleted the old version, but then attempts to run
it came back with "can't find freshcalm in /usr/bin" so I dropped a link to
the new one in /usr/bin.  Freshclam seems to be working now.

But... how do I tell the script not to run the "generic" wrapper?

Here's what is in maillog when i run update_virus_scanners:
Oct 18 17:29:54 organizer update.virus.scanners: Found clamav installed
Oct 18 17:29:54 organizer update.virus.scanners: Running autoupdate for clamav
Oct 18 17:29:55 organizer ClamAV-autoupdate[16419]: ClamAV did not need
updating
Oct 18 17:29:55 organizer update.virus.scanners: Found generic installed
Oct 18 17:29:55 organizer update.virus.scanners: Running autoupdate for
generic
Oct 18 17:29:55 organizer Generic-autoupdate[16451]: Generic scanner
successfully updated
Oct 18 17:29:56 organizer update.virus.scanners: Found sophos installed
Oct 18 17:29:56 organizer update.virus.scanners: Running autoupdate for sophos
Oct 18 17:29:57 organizer Sophos-autoupdate[16508]: Sophos successfully
updated in /usr/local/Sophos/386.200410181729

On Monday 18 October 2004 04:49 pm, Julian Field wrote:
> At 00:46 19/10/2004, you wrote:
> >Yikes!
> >
> >OS is RH 8.0.  I just upgraded from 4.24 to 4.34.8.  I had clamav and
> > sophos installed and working with 4.24.  In addition to running the MS
> > install script I ran the one that installs clamav and SA.
> >
> >Running freshclam gives me this:
> >"freshclam: relocation error: freshclam: undefined symbol: cl_gentemp"
>
> What happens when you run update_virus_scanners?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ediaz at PK25.COM  Tue Oct 19 01:56:34 2004
From: ediaz at PK25.COM (Eduardo Diaz Rodriguez)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3680.1137101239.24926.mailscanner@lists.mailscanner.info>

Hello people sorry for my bad english.

you must change the first code of antivir-autoupdate to this.

#!/usr/bin/perl

#
# AntiVir updater. Original code by Julian Field. Timeout code by
# Alessandro Bianchi.
#

use Sys::Syslog;

$PackageDir = shift || "/usr/lib/AntiVir";

$AntiVirUpdateCommand = "$PackageDir/antivir --update";

$AntiVirCommand = "$PackageDir/antivir";

$LockFile = "/tmp/AntiVirBusy.lock";

$LOCK_SH = 1;
$LOCK_EX = 2;
$LOCK_NB = 4;
$LOCK_UN = 8;

eval { Sys::Syslog::setlogsock('unix'); }; # This may fail!
Sys::Syslog::openlog("AntiVir-autoupdate", 'pid, nowait', 'mail');

BailOut("Installation dir \"$PackageDir\" does not exist!")
  unless $PackageDir ne "" && -d $PackageDir;

if (-x $AntiVirCommand) {



This line: if (-x $AntiVirCommand) {

is the modify of: if (-x $AntiVirUpdateCommand) {


 The solutions is the string: $AntiVirUpdateCommand is not a exec file  :)
$PackageDir/antivir --update

The solution can be create a new $AntiVirCommand = "$PackageDir/antivir";
for example and use this option for the if ( -x $AntiVirCommand )

simple perl :-)

anybody can contact with the developer for change the code in next release?

regards !!!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rcooper at DWFORD.COM  Tue Oct 19 02:53:02 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:19 2006
Subject: mydoom
Message-ID: <mailman.3681.1137101239.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Joe Stuart
> Sent: Monday, October 18, 2004 2:33 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: mydoom
>
>
> I am starting to have a problem with a Mydoom variant Mydoom.O that
> comes in a zip file that is not password protected.  I hae had no
> problem stopping this virus in the past. F-prot detects it if I run a
> manual scan, but when it comes through as mail it gets by. The only
> difference I can see between the past ones that got stopped and this one
> is that the one getting by is an archive that is 2 deep.  I have set
> Mailscanner up to scan archives that are up tp 25 deep, but they still
> get through. If anyone can help I would really appreciate it.
>
> Thanks
>

The second archive doesn't happen to have the same name as the parent does
it? Such as

file.zip contains another file named file.zip that contains the virus?

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james_gray at OCS.COM  Tue Oct 19 02:58:10 2004
From: james_gray at OCS.COM (James Gray)
Date: Thu Jan 12 21:27:19 2006
Subject: Per-user with default filename rules not working
Message-ID: <mailman.3682.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi All,

We have a dopey program that insists on sending messages with double-extension
attachments.  These are always something like "123456789.txt.err" which
invariably get flagged + quarantined.

In MailScanner.conf I've got:
%rules-dir% = /opt/MailScanner/etc/rules
...
Filename Rules = %rules-dir%/filename.user.rules

Then in /opt/MailScanner/etc/rules/filetype.user.rules:
(all separated by tabs - spaces used here to prevent wrap)
From:       auto-mailer@here.com    /etc/MailScanner/filename-OMS.rules.conf
ToOrFrom:   default                 /etc/MailScanner/filename.rules.conf

What happens though, is that all users get the first "filename-OMS.rules.conf"
rules, which means no double-extension checks.

Any thoughts?

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstuart at EDENPR.K12.MN.US  Tue Oct 19 05:15:28 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:19 2006
Subject: mydoom
Message-ID: <mailman.3683.1137101239.24926.mailscanner@lists.mailscanner.info>

Yeah, it does. I saw that a this was fixed in 4.32 though I'm going to
upgrade mailscanner tomorrow to hopefully fix it.

Joe

>>> rcooper@DWFORD.COM 10/18/04 20:54 PM >>>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Joe Stuart
> Sent: Monday, October 18, 2004 2:33 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: mydoom
>
>
> I am starting to have a problem with a Mydoom variant Mydoom.O that
> comes in a zip file that is not password protected.  I hae had no
> problem stopping this virus in the past. F-prot detects it if I run a
> manual scan, but when it comes through as mail it gets by. The only
> difference I can see between the past ones that got stopped and this
one
> is that the one getting by is an archive that is 2 deep.  I have set
> Mailscanner up to scan archives that are up tp 25 deep, but they still
> get through. If anyone can help I would really appreciate it.
>
> Thanks
>

The second archive doesn't happen to have the same name as the parent
does
it? Such as

file.zip contains another file named file.zip that contains the virus?

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From BBerglund at TECHPRO.COM  Tue Oct 19 05:29:41 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:19 2006
Subject: Transport file
Message-ID: <mailman.3684.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.3790.186" name=GENERATOR></HEAD>
<BODY text=#000000 bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=601382804-19102004><FONT face=Arial 
color=#0000ff size=2>So, it would be better to just put the ip address in the 
database table rather than. </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=601382804-19102004><FONT face=Arial 
color=#0000ff size=2>whatever.com for the domain </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=601382804-19102004><FONT face=Arial 
color=#0000ff size=2>and relay:[172.16.2.1] in the destination field. 
</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=601382804-19102004><FONT face=Arial 
color=#0000ff size=2></FONT></SPAN>&nbsp;</DIV>
<DIV dir=ltr align=left><SPAN class=601382804-19102004><FONT face=Arial 
color=#0000ff size=2>I am going to switch to just the ip and see if that fixes 
my current issue. </FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=601382804-19102004><FONT face=Arial 
color=#0000ff size=2>Thanks.</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> MailScanner mailing list 
[mailto:MAILSCANNER@JISCMAIL.AC.UK] <B>On Behalf Of </B>Drew 
Marshall<BR><B>Sent:</B> Friday, October 15, 2004 6:04 PM<BR><B>To:</B> 
MAILSCANNER@JISCMAIL.AC.UK<BR><B>Subject:</B> Re: Transport 
file<BR></FONT><BR></DIV>
<DIV></DIV>Brian Berglund wrote: 
<BLOCKQUOTE cite=mid2E09A52C9852E24A9A084352AB68F2C51958CC@w2k3-tp.techpro.local 
type="cite">
  <META content="MSHTML 6.00.3790.186" name=GENERATOR>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Can the transport 
  file of postfix be setup to read from a mysql 
database?<BR></FONT></SPAN></DIV></BLOCKQUOTE>Yes transport_map = 
mysql:/path/to/database/file<BR>with the database file containing the arguments 
for connection etc to the database.<BR>
<BLOCKQUOTE cite=mid2E09A52C9852E24A9A084352AB68F2C51958CC@w2k3-tp.techpro.local 
type="cite">
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Like if the 
  database has a table with </FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>domain name and 
  relay server</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial 
  size=2>whatever.com,172.26.2.1</FONT></SPAN></DIV>
  <DIV><SPAN class=769465518-15102004></SPAN>&nbsp;</DIV>
  <DIV><SPAN class=769465518-15102004><FONT face=Arial size=2>Then the transport 
  would read from that and relay to the appropriate 
  server?<BR></FONT></SPAN></DIV></BLOCKQUOTE>Yup!<BR><BR>See <A 
class=moz-txt-link-freetext 
href="http://www.gentoo.org/doc/en/virt-mail-howto.xml">http://www.gentoo.org/doc/en/virt-mail-howto.xml</A> 
for examples (It's not bad but written for Gentoo Linux) or for Postgre <A 
class=moz-txt-link-freetext 
href="http://www.postfix.org/PGSQL_README.html">http://www.postfix.org/PGSQL_README.html</A>. 
There are others, Google is your friend! <BR><BR>HTH<BR><BR>Drew<BR><BR>-- 
<BR>In line with our <A href="http://www.themarshalls.co.uk/policy">policy</A>, 
this message has been scanned for <BR>viruses and dangerous content by <A 
href="http://www.mailscanner.info/">MailScanner</A>, and is <BR>believed to be 
clean. ------------------------ MailScanner list ------------------------ To 
unsubscribe, email <A href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</A> 
with the words:<BR>'leave mailscanner' in the body of the email.<BR>Before 
posting, read the MAQ (<A 
href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</A>)<BR>and 
the archives (<A 
href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</A>). 
</BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From Q.G.Campbell at NEWCASTLE.AC.UK  Tue Oct 19 09:10:44 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:19 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3685.1137101239.24926.mailscanner@lists.mailscanner.info>

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Sanjay K. Patel
>Sent: 18 October 2004 15:05
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Sa-learn tricks
>
>Although this is a bit of topic I was hoping someone here might have a
>answer. I want to send spam not caught by mailscanner back to 
>the server for
>sa-learn to learn the spam. The question is "does sa-learn 
>learn the content
>of the spam or the headers also?". My concern is that all the 
>headers will
>have my info since I am forwarding it and I don't want 
>sa-learn to think I
>am a spammer.

Sanjay

Since sa-learn _does_ use the message headers you have to be careful.

However if you are forwarding roughly equal amounts of spam & ham it
should not matter since the added headers appear in both so their
overall effect is nill.

Although I have stopped using the Bayes stuff in SpamAssassin, when I
was forwarding spam & ham for sa-learn to use I ran it through a script
at the recipient end to remove the headers, mostly "Received:" but
including ReSent:, etc, that were added locally.

Quentin  

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 09:10:13 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: Per-user with default filename rules not working
Message-ID: <mailman.3686.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:58 19/10/2004, you wrote:
>Hi All,
>
>We have a dopey program that insists on sending messages with double-extension
>attachments.  These are always something like "123456789.txt.err" which
>invariably get flagged + quarantined.
>
>In MailScanner.conf I've got:
>%rules-dir% = /opt/MailScanner/etc/rules
>...
>Filename Rules = %rules-dir%/filename.user.rules
>
>Then in /opt/MailScanner/etc/rules/filetype.user.rules:
>(all separated by tabs - spaces used here to prevent wrap)
>From:       auto-mailer@here.com    /etc/MailScanner/filename-OMS.rules.conf
>ToOrFrom:   default                 /etc/MailScanner/filename.rules.conf
>
>What happens though, is that all users get the first "filename-OMS.rules.conf"
>rules, which means no double-extension checks.
>
>Any thoughts?

Make sure your filename-OMS.rules.conf file explicitly allows .txt.err files.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 09:07:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3687.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
This is already correct in my copy of the code. Maybe you have an old
version of this file?
According to the ChangeLog, what is probably this bug was fixed in version
4.12.

At 01:56 19/10/2004, you wrote:
>Hello people sorry for my bad english.
>
>you must change the first code of antivir-autoupdate to this.
>
>#!/usr/bin/perl
>
>#
># AntiVir updater. Original code by Julian Field. Timeout code by
># Alessandro Bianchi.
>#
>
>use Sys::Syslog;
>
>$PackageDir = shift || "/usr/lib/AntiVir";
>
>$AntiVirUpdateCommand = "$PackageDir/antivir --update";
>
>$AntiVirCommand = "$PackageDir/antivir";
>
>$LockFile = "/tmp/AntiVirBusy.lock";
>
>$LOCK_SH = 1;
>$LOCK_EX = 2;
>$LOCK_NB = 4;
>$LOCK_UN = 8;
>
>eval { Sys::Syslog::setlogsock('unix'); }; # This may fail!
>Sys::Syslog::openlog("AntiVir-autoupdate", 'pid, nowait', 'mail');
>
>BailOut("Installation dir \"$PackageDir\" does not exist!")
>   unless $PackageDir ne "" && -d $PackageDir;
>
>if (-x $AntiVirCommand) {
>
>
>
>This line: if (-x $AntiVirCommand) {
>
>is the modify of: if (-x $AntiVirUpdateCommand) {
>
>
>  The solutions is the string: $AntiVirUpdateCommand is not a exec file  :)
>$PackageDir/antivir --update
>
>The solution can be create a new $AntiVirCommand = "$PackageDir/antivir";
>for example and use this option for the if ( -x $AntiVirCommand )
>
>simple perl :-)
>
>anybody can contact with the developer for change the code in next release?

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 08:58:09 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: freshclam error
Message-ID: <mailman.3688.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
You can't stop it running the "generic" autoupdate script. However, I will
tweak the script slightly so it doesn't log anything happened if you
haven't changed its autoupdate.

At 01:37 19/10/2004, you wrote:
>Hi Julian,
>
>I found a problem, if not _the_ problem.  There was an old version of
>freshclam in /usr/bin, the new version was in /usr/local/bin, and /usr/bin
>was first in the path.  I deleted the old version, but then attempts to run
>it came back with "can't find freshcalm in /usr/bin" so I dropped a link to
>the new one in /usr/bin.  Freshclam seems to be working now.
>
>But... how do I tell the script not to run the "generic" wrapper?
>
>Here's what is in maillog when i run update_virus_scanners:
>Oct 18 17:29:54 organizer update.virus.scanners: Found clamav installed
>Oct 18 17:29:54 organizer update.virus.scanners: Running autoupdate for clamav
>Oct 18 17:29:55 organizer ClamAV-autoupdate[16419]: ClamAV did not need
>updating
>Oct 18 17:29:55 organizer update.virus.scanners: Found generic installed
>Oct 18 17:29:55 organizer update.virus.scanners: Running autoupdate for
>generic
>Oct 18 17:29:55 organizer Generic-autoupdate[16451]: Generic scanner
>successfully updated
>Oct 18 17:29:56 organizer update.virus.scanners: Found sophos installed
>Oct 18 17:29:56 organizer update.virus.scanners: Running autoupdate for sophos
>Oct 18 17:29:57 organizer Sophos-autoupdate[16508]: Sophos successfully
>updated in /usr/local/Sophos/386.200410181729
>
>On Monday 18 October 2004 04:49 pm, Julian Field wrote:
> > At 00:46 19/10/2004, you wrote:
> > >Yikes!
> > >
> > >OS is RH 8.0.  I just upgraded from 4.24 to 4.34.8.  I had clamav and
> > > sophos installed and working with 4.24.  In addition to running the MS
> > > install script I ran the one that installs clamav and SA.
> > >
> > >Running freshclam gives me this:
> > >"freshclam: relocation error: freshclam: undefined symbol: cl_gentemp"
> >
> > What happens when you run update_virus_scanners?
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ediaz at PK25.COM  Tue Oct 19 09:45:04 2004
From: ediaz at PK25.COM (Eduardo Diaz Rodriguez)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3689.1137101239.24926.mailscanner@lists.mailscanner.info>

Sure??, I download yesterday the copy of mailscanner from mailscanner.info.

my version is: MailScanner-4.34.8

http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-4.tar.gz

And this file are bad:

d3c86afc594aff892e89720f21d593b0  antivir-autoupdate

-rwxr-xr-x    1 root     root         1568 2004-09-29 21:12 antivir-autoupdate

regards!

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 09:53:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3690.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
The file is indeed 1568 bytes long, and the MD5 sum matches. It contains this:

-----SNIP-----
eval { Sys::Syslog::setlogsock('unix'); }; # This may fail!
Sys::Syslog::openlog("AntiVir-autoupdate", 'pid, nowait', 'mail');

BailOut("Installation dir \"$PackageDir\" does not exist!")
   unless $PackageDir ne "" && -d $PackageDir;

if (-x $AntiVirUpdateCommand) {
   # Timeout prevention
   $SIG{ALRM} = sub { die "timeout"};
-----SNIP-----

At 09:45 19/10/2004, you wrote:
>Sure??, I download yesterday the copy of mailscanner from mailscanner.info.
>
>my version is: MailScanner-4.34.8
>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-4.tar.gz
>
>And this file are bad:
>
>d3c86afc594aff892e89720f21d593b0  antivir-autoupdate
>
>-rwxr-xr-x    1 root     root         1568 2004-09-29 21:12 antivir-autoupdate
>
>regards!

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ediaz at PK25.COM  Tue Oct 19 09:45:04 2004
From: ediaz at PK25.COM (Eduardo Diaz Rodriguez)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3691.1137101239.24926.mailscanner@lists.mailscanner.info>

Sure??, I download yesterday the copy of mailscanner from mailscanner.info.

my version is: MailScanner-4.34.8

http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-4.tar.gz

And this file are bad:

d3c86afc594aff892e89720f21d593b0  antivir-autoupdate

-rwxr-xr-x    1 root     root         1568 2004-09-29 21:12 antivir-autoupdate

regards!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Tue Oct 19 11:33:52 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:19 2006
Subject: MailScanner + Postfix can't find
Message-ID: <mailman.3692.1137101239.24926.mailscanner@lists.mailscanner.info>

On Mon, October 18, 2004 20:06, David Young said:
> Hi, I've been trying to setup MailScanner with Postfix by following the
> "Using MailScanner with Postfix" instruction on the mailscanner website.
> When I startup MailScanner, I get the following error:
>
> Oct 13 16:29:36 node1 postfix[28270]: fatal: open /etc/postfix.in/main.cf:
> No such file or directory
>
> The installation guide says that Postfix can handle both incoming and
> outgoing mail, but doesn't make mention of a postfix.in directory.  Anyone
> using MailScanner with Postfix?  And if so, can you provide some pointers
> (and gotchas) that I need to be aware of to get this thing setup?
>
> Thanks a bunch,
> David

That is still included for a 'legacy' installation of MS with Postfix.
Just comment them out of your start up script (Or even just start Postfix
normally and then start MailScanner using the check_mailscanner script -
depending on your distro).

Basically all that Postfix does is drop all mail in to the hold queue
file. MailScanner scans it and moves it to the incoming queue for Postfix
to deliver. This means that you only need 1 Postfix 'instance' and not 2
as was needed once so there is no need to start postfix.in.

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 11:43:17 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: MailScanner + Postfix can't find
Message-ID: <mailman.3693.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have just tweaked the init.d script so that it doesn't complain so loudly
about not using 2 Postfix instances. It now just points out it is assuming
you are using 1 if it couldn't find the 2nd.

At 11:33 19/10/2004, you wrote:
>On Mon, October 18, 2004 20:06, David Young said:
> > Hi, I've been trying to setup MailScanner with Postfix by following the
> > "Using MailScanner with Postfix" instruction on the mailscanner website.
> > When I startup MailScanner, I get the following error:
> >
> > Oct 13 16:29:36 node1 postfix[28270]: fatal: open /etc/postfix.in/main.cf:
> > No such file or directory
> >
> > The installation guide says that Postfix can handle both incoming and
> > outgoing mail, but doesn't make mention of a postfix.in directory.  Anyone
> > using MailScanner with Postfix?  And if so, can you provide some pointers
> > (and gotchas) that I need to be aware of to get this thing setup?
> >
> > Thanks a bunch,
> > David
>
>That is still included for a 'legacy' installation of MS with Postfix.
>Just comment them out of your start up script (Or even just start Postfix
>normally and then start MailScanner using the check_mailscanner script -
>depending on your distro).
>
>Basically all that Postfix does is drop all mail in to the hold queue
>file. MailScanner scans it and moves it to the incoming queue for Postfix
>to deliver. This means that you only need 1 Postfix 'instance' and not 2
>as was needed once so there is no need to start postfix.in.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcel-ml at IRC-ADDICTS.DE  Tue Oct 19 12:08:38 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3694.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi there,


just checked my version of the antivir-autoupdate, and it seems to be
correct, as the mentioned lines from Julian are still in there ;)

but still no autoupdate from antivir..

:(

any ideas??

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Tue Oct 19 12:04:25 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3695.1137101239.24926.mailscanner@lists.mailscanner.info>

Mailscanner seems to create a tmp directory in /tmp on one of our servers
for each and every e-mail.

It fills /tmp with tmp dirs that look like tmp0d864484 etc.

What is causing this??

How can we make it stop?

Versions:
SA 2.64
MS - latest stable
OS - Whitebox
MTA - sendmail
MailWatch is also installed, but has been heavily modified


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 12:22:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3696.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
It's probably SpamAssassin doing it.

At 12:04 19/10/2004, you wrote:
>Mailscanner seems to create a tmp directory in /tmp on one of our servers
>for each and every e-mail.
>
>It fills /tmp with tmp dirs that look like tmp0d864484 etc.
>
>What is causing this??
>
>How can we make it stop?
>
>Versions:
>SA 2.64
>MS - latest stable
>OS - Whitebox
>MTA - sendmail
>MailWatch is also installed, but has been heavily modified

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ediaz at PK25.COM  Tue Oct 19 12:30:41 2004
From: ediaz at PK25.COM (Diaz Rodriguez, Eduardo)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3697.1137101239.24926.mailscanner@lists.mailscanner.info>

Correct, the mod can be this:

change this
-----SNIP-----
 BailOut("Installation dir \"$PackageDir\" does not exist!")
    unless $PackageDir ne "" && -d $PackageDir;
 
 if (-x $AntiVirUpdateCommand) {
-----SNIP-----
===================================
for this:
-----SNIP-----
 BailOut("Installation dir \"$PackageDir\" does not exist!")
    unless $PackageDir ne "" && -d $PackageDir;
$AntiVirCommand = "$PackageDir/antivir";
 if (-x $AntiVirCommand) {
-----SNIP-----
for example.

this command:
$PackageDir/antivir --update

never can be exec... becasue the exec command are this: $PackageDir/antivir

regards

On Tue, 19 Oct 2004 09:53:58 +0100, Julian Field wrote
> The file is indeed 1568 bytes long, and the MD5 sum matches. It 
> contains this:
> 
> -----SNIP-----
> eval { Sys::Syslog::setlogsock('unix'); }; # This may fail!
> Sys::Syslog::openlog("AntiVir-autoupdate", 'pid, nowait', 'mail');
> 
> BailOut("Installation dir \"$PackageDir\" does not exist!")
>    unless $PackageDir ne "" && -d $PackageDir;
> 
> if (-x $AntiVirUpdateCommand) {
>    # Timeout prevention
>    $SIG{ALRM} = sub { die "timeout"};
> -----SNIP-----
> 
> At 09:45 19/10/2004, you wrote:
> >Sure??, I download yesterday the copy of mailscanner from mailscanner.info.
> >
> >my version is: MailScanner-4.34.8
> >
>
>http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/tar/MailScanner-install-4.34.8-4.tar.gz
> >
> >And this file are bad:
> >
> >d3c86afc594aff892e89720f21d593b0  antivir-autoupdate
> >
> >-rwxr-xr-x    1 root     root         1568 2004-09-29 21:12 antivir-autoupdate
> >
> >regards!
> 
> -- 
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


=======================================================================================
No basta adquirir la sabiduría, es preciso usarla.
                -- Marco Tulio Cicerón. (106-43 A.C.) Escritor, orador y
                político romano. 
=======================================================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From james.ytterstene at MDH.SE  Tue Oct 19 12:40:14 2004
From: james.ytterstene at MDH.SE (James Ytterstene)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3698.1137101239.24926.mailscanner@lists.mailscanner.info>

Hello

I would like to add an extra header to all mail that is spam.
There is an header named "Spam Score Header" that is inserted into mails
that are spam, but i would like to have two headers.
The first header is a static one and the second is the normal where i get
the detailed information. The result should look something like this

X-spam: YES
X-My-Company-MailScanner-SpamScore: spam, bla bla

It is this first extra line i would like to insert. I have tried
everyting i know. but cant get it to work. Can it be done with rulesets ?


/James Ytterstene

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hywel.burris at COMTEC-EUROPE.CO.UK  Tue Oct 19 13:39:46 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:19 2006
Subject: OT: Clam-0.80rc3 Problem
Message-ID: <mailman.3699.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2180" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=503303612-19102004>Hi 
All,</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN 
class=503303612-19102004></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=503303612-19102004>Just to let you 
know, I just had a problem with Clam-0.80rc3 it was blocking all jpg's as having 
the latest vunerability (<FONT face="Times New Roman" 
size=3>Exploit.JPEG.Comment.1)</FONT></SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN 
class=503303612-19102004></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2><SPAN class=503303612-19102004>The&nbsp;stable 
version of Clam-0.80 was released yesterday the upgrade to the full version 
fixed this.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN 
class=503303612-19102004></SPAN></FONT>&nbsp;</DIV>
<DIV><SPAN class=319124411-14062004><FONT face=Arial size=2><SPAN 
class=title_emph><SPAN 
class=503303612-19102004>Regards</SPAN></SPAN></FONT></SPAN></DIV>
<DIV><SPAN class=319124411-14062004><SPAN class=title_emph><FONT face=Arial 
size=2>&nbsp; </FONT></DIV>
<DIV align=left>
<DIV align=left><FONT face=Arial size=2><SPAN 
class=503303612-19102004>--</SPAN></FONT></DIV>
<DIV align=left><FONT face=Arial size=2>Hywel Burris</FONT></DIV>
<DIV align=left>
<DIV align=left><FONT face=Arial size=2></FONT></DIV></SPAN></SPAN><FONT 
face=Arial size=2></FONT></DIV></DIV></BODY><P align=center><BR>************************************************************************<BR>This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. </P>
<P align=center>Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.<BR></P>
</HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From marcel-ml at IRC-ADDICTS.DE  Tue Oct 19 13:47:59 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:19 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3700.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi there,

[...]

>
> this command:
> $PackageDir/antivir --update
>
> never can be exec... becasue the exec command are this: $PackageDir/antivir


i might be stupid..

but the update-command to update antivir is still:

antivir --update

and not just antivir..

as this is the stuff i do enter on the shell to update the vdf-file

Greetings

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Tue Oct 19 13:50:47 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3701.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
James
Already there..

from MailScanner.conf

# Add this extra header to all messages found to be spam.
# This can also be the filename of a ruleset.
Spam Header = X-%org-name%-MailScanner-SpamCheck:





--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


James Ytterstene wrote:
> Hello
>
> I would like to add an extra header to all mail that is spam.
> There is an header named "Spam Score Header" that is inserted into mails
> that are spam, but i would like to have two headers.
> The first header is a static one and the second is the normal where i get
> the detailed information. The result should look something like this
>
> X-spam: YES
> X-My-Company-MailScanner-SpamScore: spam, bla bla
>
> It is this first extra line i would like to insert. I have tried
> everyting i know. but cant get it to work. Can it be done with rulesets ?
>
>
> /James Ytterstene
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From raymond at PROLOCATION.NET  Tue Oct 19 13:50:58 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:19 2006
Subject: OT: Clam-0.80rc3 Problem
Message-ID: <mailman.3702.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

> Just to let you know, I just had a problem with Clam-0.80rc3 it was
> blocking all jpg's as having the latest vunerability
> (Exploit.JPEG.Comment.1)
>
> The stable version of Clam-0.80 was released yesterday the upgrade to
> the full version fixed this.

Same here. Very very nasty.

5910    (first @ 12:01:06, last = 14:49:10)     Exploit.JPEG.Comment.1
24      (first @ 12:05:32, last = 14:47:59)     Exploit.JPEG.Comment.FE
20      (first @ 02:25:13, last = 11:23:37)     Exploit.JPEG.Comment1
12      (first @ 12:59:06, last = 14:28:15)     Exploit.JPEG.Comment.DF
6       (first @ 12:37:25, last = 14:03:48)     Exploit.JPEG.Comment.FA
5       (first @ 13:40:03, last = 14:28:15)     Exploit.JPEG.Comment.EF
5       (first @ 12:18:44, last = 13:58:06)     Exploit.JPEG.Comment.FB
5       (first @ 12:23:04, last = 14:21:27)     Exploit.JPEG.Comment.FD
5       (first @ 12:12:10, last = 14:28:36)     Exploit.JPEG.Comment.EE
4       (first @ 12:26:16, last = 13:06:09)     Exploit.JPEG.Comment.F2
4       (first @ 12:37:25, last = 13:43:59)     Exploit.JPEG.Comment.DD
4       (first @ 12:36:32, last = 13:59:44)     Exploit.JPEG.Comment.E1
4       (first @ 13:24:00, last = 14:09:05)     Exploit.JPEG.Comment.C3
4       (first @ 12:21:55, last = 14:46:48)     Exploit.JPEG.Comment.F9
3       (first @ 12:52:34, last = 14:06:50)     Exploit.JPEG.Comment.E3

Upgrading engine now... :(

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From james.ytterstene at MDH.SE  Tue Oct 19 14:09:37 2004
From: james.ytterstene at MDH.SE (James Ytterstene)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3703.1137101239.24926.mailscanner@lists.mailscanner.info>

Hello

My misstake. I ment that it was this header i would like to doubble. The
header "Spam Header = X-%org-name%-MailScanner-SpamCheck:" includes the
detailed information about the different scores from a spam mail. I need a
clean header with only the value "YES".

So a correct look would be like this
------------------------------------

X-spam: YES
X-My-Company-MailScanner-SpamCheck: spam, SpamAssassin (resultat=26.966, krav 5,
        autolearn=disabled, HTML_10_20 0.29, HTML_MESSAGE 0.00,
...
        X_MESSAGE_INFO 4.19)
X-My-Company-MailScanner-SpamScore: ssssssssssssssssssss

-------------------------------------

/James

On Tue, 19 Oct 2004, Martin Hepworth wrote:

> James
> Already there..
>
> from MailScanner.conf
>
> # Add this extra header to all messages found to be spam.
> # This can also be the filename of a ruleset.
> Spam Header = X-%org-name%-MailScanner-SpamCheck:
>
>
>
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> James Ytterstene wrote:
> > Hello
> >
> > I would like to add an extra header to all mail that is spam.
> > There is an header named "Spam Score Header" that is inserted into mails
> > that are spam, but i would like to have two headers.
> > The first header is a static one and the second is the normal where i get
> > the detailed information. The result should look something like this
> >
> > X-spam: YES
> > X-My-Company-MailScanner-SpamScore: spam, bla bla
> >
> > It is this first extra line i would like to insert. I have tried
> > everyting i know. but cant get it to work. Can it be done with rulesets ?
> >
> >
> > /James Ytterstene
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Tue Oct 19 11:12:16 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:19 2006
Subject: Transport file
Message-ID: <mailman.3704.1137101239.24926.mailscanner@lists.mailscanner.info>

On Tue, October 19, 2004 5:29, Brian Berglund said:
> So, it would be better to just put the ip address in the database table
> rather than.
> whatever.com for the domain
> and relay:[172.16.2.1] in the destination field.
>
Better syntax is field 1 <domain.com> field 2 smtp:host (Or
smtp:[host.ip.add.ess]

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Tue Oct 19 15:07:30 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3705.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
James

Apart from the strict I dn't see how this differs from the 'spam' part
of the said header. Or maybe I'm being thick as usual..?

You should be able to write rules for the MUA/procmail/whatever against
either varient..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


James Ytterstene wrote:
> Hello
>
> My misstake. I ment that it was this header i would like to doubble. The
> header "Spam Header = X-%org-name%-MailScanner-SpamCheck:" includes the
> detailed information about the different scores from a spam mail. I need a
> clean header with only the value "YES".
>
> So a correct look would be like this
> ------------------------------------
>
> X-spam: YES
> X-My-Company-MailScanner-SpamCheck: spam, SpamAssassin (resultat=26.966, krav 5,
>         autolearn=disabled, HTML_10_20 0.29, HTML_MESSAGE 0.00,
> ...
>         X_MESSAGE_INFO 4.19)
> X-My-Company-MailScanner-SpamScore: ssssssssssssssssssss
>
> -------------------------------------
>
> /James
>
> On Tue, 19 Oct 2004, Martin Hepworth wrote:
>
>
>>James
>>Already there..
>>
>>from MailScanner.conf
>>
>># Add this extra header to all messages found to be spam.
>># This can also be the filename of a ruleset.
>>Spam Header = X-%org-name%-MailScanner-SpamCheck:
>>
>>
>>
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>James Ytterstene wrote:
>>
>>>Hello
>>>
>>>I would like to add an extra header to all mail that is spam.
>>>There is an header named "Spam Score Header" that is inserted into mails
>>>that are spam, but i would like to have two headers.
>>>The first header is a static one and the second is the normal where i get
>>>the detailed information. The result should look something like this
>>>
>>>X-spam: YES
>>>X-My-Company-MailScanner-SpamScore: spam, bla bla
>>>
>>>It is this first extra line i would like to insert. I have tried
>>>everyting i know. but cant get it to work. Can it be done with rulesets ?
>>>
>>>
>>>/James Ytterstene
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Tue Oct 19 15:15:21 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:19 2006
Subject: OT: Brit Landed Gentry 419ing, what next?
Message-ID: <mailman.3706.1137101239.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

My Most Esteemed Collegues (ahem),

Totally off-topic here, but I'm sure Julian and others in the UK can
have a laugh at this one.  The email below came into our College's
alumni relations/donors office, and was actually passed around as a
a legit opportunity before the College treasurer got it and asked me.

The Burkes Peerage AOL address is a laugh.  And does Verizon provide
ISP service in the UK?  Last I looked, 67.216.58.94 is a UUNET number
in the US.  Perhaps his Lordship in on the lam from the British police?

Julian, perhaps this is **your** chance for title, land, nobility...

Jeff Earickson
Colby College

>Return-Path: <L.shalford@verizon.net>
>Received: from out014.verizon.net (out014pub.verizon.net [206.46.170.46])
>         by basalt.colby.edu (8.13.1/8.13.1/1.48') with ESMTP id
> i9HLhBxp000642
>         for <deleted@colby.edu>; Sun, 17 Oct 2004 17:43:17 -0400 (EDT)
>Received: from [67.216.58.94] by out014.verizon.net
>           (InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP
>           id <20041017213853.EWT25088.out014.verizon.net@[67.216.58.94]>
>           for <deleted@colby.edu>; Sun, 17 Oct 2004 16:38:53 -0500
>User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.0.6
>Date: Sun, 17 Oct 2004 17:38:32 -0400
>Subject: Proposed gift of partial proceeds from sale of English
>         hereditaments
>From: "L.Shalford" <L.shalford@verizon.net>
>To: <deleted@colby.edu>
>Message-ID: <BD985E98.798C%L.shalford@verizon.net>
>Mime-version: 1.0
>Content-type: multipart/mixed;
>    boundary="MS_Mac_OE_3180879512_1509085_MIME_Part"
>X-Authentication-Info: Submitted using SMTP AUTH at out014.verizon.net
>from [67.216.58.94] at Sun, 17 Oct 2004 16:38:52 -0500
>X-Colby-MailScanner: ftbc
>X-Colby-MailScanner-SpamScore:  1.06
>X-MailScanner-From: l.shalford@verizon.net
>X-UIDL: e$'!!9Vl!!6*e"!Bl4"!
>
>Good morning, Ms. Tessler,
>
>I have only the remotest connection to Colby College family, and my
>proposal is very unusual; so it would be prudent to obtain assurances. I
>suggest someone well-known and respected in such matters: Mr. Harold
>Brooks-Baker, Publishing Director, Burkes Peerage, London. His e-mail
>address is Burkespeer@aol.com
>
>My proposed gift is not altruistic; it is motivated by a need to raise a
>considerable amount of cash to pay unforeseen medical expenses for my
>wife. I am, myself, in fragile health and seventy years of age. I have no
>heirs capable of succeeding to one of two hereditaments I possess. If I
>fail to assign (sell) it before my death it will escheat to The Crown and
>be merged into the residue of Crown Lands and Offices. Moreover, it is
>also uncertain if some future amendment of the Reform of the House of
>Lords Act,1999, if any, might affect an assignment (sale) of either or
>both hereditaments permitted, historically, by a 1350 statute of King
>Edward III.
>
>Specifically, I propose to give Colby College ten percent of the gross
>proceeds of the assignment (sale) of these  two singular and especially
>valuable English hereditaments. Their nature and quality are generally
>explained by one of the two PDFs attached: a feature story in the April
>2004 issue of Country Life, England's leading up-market country property
>magazine.
>
>Each is listed with Her Majesty's Land Registry at a stated value of
>£500,000. At today's currency exchange rate, £1.00 = $1.85, ten percent
>equals $90,265 for one or $180,530 for both. The assignment (sale) price
>is negotiable so the gift amount could be less. Colby College needs only
>to identify, present and persuade an affluent alumnus or benefactor, or
>someone known to an alumnus or benefactor, to accept assignment (purchase)
>of one or both of them.
>
>If you wish to pursue my offer and want to learn more, I have additional
>UK government-sourced information in PDF format for evaluation by the
>College's counsel and, if thought suitable, for presentation to one or
>more prospective assignees (purchasers).
>
>Sincerely,
>
>Thomas, Lord Shalford
>
>L.Shalford@Verizon.Net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
    [ Part 2, ""  Application/PDF  651KB. ]
    [ Unable to print this part. ]


    [ Part 3, ""  Application/PDF  149KB. ]
    [ Unable to print this part. ]


From james.ytterstene at MDH.SE  Tue Oct 19 15:34:43 2004
From: james.ytterstene at MDH.SE (James Ytterstene)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3707.1137101239.24926.mailscanner@lists.mailscanner.info>

Hello

The real name of the flag is "X-Spam-Flag: YES" which SpamAssassin inserts
into the mail. I have som badly written mail clients which need a clean
flag to filter on. When i use SpamAssassin standalone i get the flag but
not when using MailScanner as an frontend.

I dont know why the header from SpamAssassin is left out, but if i could
dubble the "Spam Header" i could manually put it back. But i cant get it
to work.

/James

On Tue, 19 Oct 2004, Martin Hepworth wrote:

> James
>
> Apart from the strict I dn't see how this differs from the 'spam' part
> of the said header. Or maybe I'm being thick as usual..?
>
> You should be able to write rules for the MUA/procmail/whatever against
> either varient..
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> James Ytterstene wrote:
> > Hello
> >
> > My misstake. I ment that it was this header i would like to doubble. The
> > header "Spam Header = X-%org-name%-MailScanner-SpamCheck:" includes the
> > detailed information about the different scores from a spam mail. I need a
> > clean header with only the value "YES".
> >
> > So a correct look would be like this
> > ------------------------------------
> >
> > X-spam: YES
> > X-My-Company-MailScanner-SpamCheck: spam, SpamAssassin (resultat=26.966, krav 5,
> >         autolearn=disabled, HTML_10_20 0.29, HTML_MESSAGE 0.00,
> > ...
> >         X_MESSAGE_INFO 4.19)
> > X-My-Company-MailScanner-SpamScore: ssssssssssssssssssss
> >
> > -------------------------------------
> >
> > /James
> >
> > On Tue, 19 Oct 2004, Martin Hepworth wrote:
> >
> >
> >>James
> >>Already there..
> >>
> >>from MailScanner.conf
> >>
> >># Add this extra header to all messages found to be spam.
> >># This can also be the filename of a ruleset.
> >>Spam Header = X-%org-name%-MailScanner-SpamCheck:
> >>
> >>
> >>
> >>
> >>
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>
> >>James Ytterstene wrote:
> >>
> >>>Hello
> >>>
> >>>I would like to add an extra header to all mail that is spam.
> >>>There is an header named "Spam Score Header" that is inserted into mails
> >>>that are spam, but i would like to have two headers.
> >>>The first header is a static one and the second is the normal where i get
> >>>the detailed information. The result should look something like this
> >>>
> >>>X-spam: YES
> >>>X-My-Company-MailScanner-SpamScore: spam, bla bla
> >>>
> >>>It is this first extra line i would like to insert. I have tried
> >>>everyting i know. but cant get it to work. Can it be done with rulesets ?
> >>>
> >>>
> >>>/James Ytterstene
> >>>
> >>>------------------------ MailScanner list ------------------------
> >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >>>'leave mailscanner' in the body of the email.
> >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >>**********************************************************************
> >>
> >>This email and any files transmitted with it are confidential and
> >>intended solely for the use of the individual or entity to whom they
> >>are addressed. If you have received this email in error please notify
> >>the system manager.
> >>
> >>This footnote confirms that this email message has been swept
> >>for the presence of computer viruses and is believed to be clean.
> >>
> >>**********************************************************************
> >>
> >>------------------------ MailScanner list ------------------------
> >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >>'leave mailscanner' in the body of the email.
> >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstevens at ATHENSDISTRIBUTING.COM  Tue Oct 19 16:06:31 2004
From: jstevens at ATHENSDISTRIBUTING.COM (James R. Stevens)
Date: Thu Jan 12 21:27:19 2006
Subject: Sa-learn tricks
Message-ID: <mailman.3708.1137101239.24926.mailscanner@lists.mailscanner.info>

This is something I have also strugled with. There are two scripts out
on the web designed to remove the forwarded headers before sa-lear scans
them, although I was not happy with the results.

If anyone has a clean way of doing this I would also be very interested.
A small log STDOUT of the headers removes before sa-learn ran would
proove its use. It would also give us a tool in troubleshooting Bayes
false positives. 

-----Original Message-----
From: Quentin Campbell [mailto:Q.G.Campbell@NEWCASTLE.AC.UK] 
Sent: Tuesday, October 19, 2004 3:11 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Sa-learn tricks

>-----Original Message-----
>From: MailScanner mailing list 
>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Sanjay K. Patel
>Sent: 18 October 2004 15:05
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Sa-learn tricks
>
>Although this is a bit of topic I was hoping someone here might have a
>answer. I want to send spam not caught by mailscanner back to 
>the server for
>sa-learn to learn the spam. The question is "does sa-learn 
>learn the content
>of the spam or the headers also?". My concern is that all the 
>headers will
>have my info since I am forwarding it and I don't want 
>sa-learn to think I
>am a spammer.

Sanjay

Since sa-learn _does_ use the message headers you have to be careful.

However if you are forwarding roughly equal amounts of spam & ham it
should not matter since the added headers appear in both so their
overall effect is nill.

Although I have stopped using the Bayes stuff in SpamAssassin, when I
was forwarding spam & ham for sa-learn to use I ran it through a script
at the recipient end to remove the headers, mostly "Received:" but
including ReSent:, etc, that were added locally.

Quentin  

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.




-- 
This message has been scanned for viruses and
dangerous content by Athens Hyperion Scanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dnsadmin at 1BIGTHINK.COM  Tue Oct 19 16:12:35 2004
From: dnsadmin at 1BIGTHINK.COM (DNSAdmin)
Date: Thu Jan 12 21:27:19 2006
Subject: ClamAV False positives on "Exploit.JPEG.Comment.1"?????
Message-ID: <mailman.3709.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello All,

This morning I have two "regular" senders, one which on my servers, another
from outside who regularly sends to a user on our servers. They've both
sent multiple JPeG files (which is an unusual occurrence) and they all are
tagged by ClamAV as:

     Report: ClamAV: image006.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: image007.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: image008.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: image001.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: image003.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: image004.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: image005.jpg contains Exploit.JPEG.Comment.1

AND:

     Report: ClamAV: msg-9197-33.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: msg-9197-34.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: msg-9197-35.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: msg-9197-36.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: msg-9197-31.jpg contains Exploit.JPEG.Comment.1
     Report: ClamAV: msg-9197-32.jpg contains Exploit.JPEG.Comment.1

I've pulled them out of the Quarantine and scanned them locally with Norton
AV (I just checked Live Update and I'm good). They test negative. Any idea
what is going on here?

Thanks,
Glenn



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
http://www.sng.ecs.soton.ac.uk/mailscanner/
Configuration by Glenn Parsons dnsadmin-at-1bigthink.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Tue Oct 19 15:51:23 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3710.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
James

OK..

you could alway tag the subject line and use that to filter to...

subject starts with {Spam?}

???

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


James Ytterstene wrote:
> Hello
>
> The real name of the flag is "X-Spam-Flag: YES" which SpamAssassin inserts
> into the mail. I have som badly written mail clients which need a clean
> flag to filter on. When i use SpamAssassin standalone i get the flag but
> not when using MailScanner as an frontend.
>
> I dont know why the header from SpamAssassin is left out, but if i could
> dubble the "Spam Header" i could manually put it back. But i cant get it
> to work.
>
> /James
>
> On Tue, 19 Oct 2004, Martin Hepworth wrote:
>
>
>>James
>>
>>Apart from the strict I dn't see how this differs from the 'spam' part
>>of the said header. Or maybe I'm being thick as usual..?
>>
>>You should be able to write rules for the MUA/procmail/whatever against
>>either varient..
>>
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>James Ytterstene wrote:
>>
>>>Hello
>>>
>>>My misstake. I ment that it was this header i would like to doubble. The
>>>header "Spam Header = X-%org-name%-MailScanner-SpamCheck:" includes the
>>>detailed information about the different scores from a spam mail. I need a
>>>clean header with only the value "YES".
>>>
>>>So a correct look would be like this
>>>------------------------------------
>>>
>>>X-spam: YES
>>>X-My-Company-MailScanner-SpamCheck: spam, SpamAssassin (resultat=26.966, krav 5,
>>>        autolearn=disabled, HTML_10_20 0.29, HTML_MESSAGE 0.00,
>>>...
>>>        X_MESSAGE_INFO 4.19)
>>>X-My-Company-MailScanner-SpamScore: ssssssssssssssssssss
>>>
>>>-------------------------------------
>>>
>>>/James
>>>
>>>On Tue, 19 Oct 2004, Martin Hepworth wrote:
>>>
>>>
>>>
>>>>James
>>>>Already there..
>>>>
>>>
>>>>from MailScanner.conf
>>>
>>>># Add this extra header to all messages found to be spam.
>>>># This can also be the filename of a ruleset.
>>>>Spam Header = X-%org-name%-MailScanner-SpamCheck:
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>--
>>>>Martin Hepworth
>>>>Snr Systems Administrator
>>>>Solid State Logic
>>>>Tel: +44 (0)1865 842300
>>>>
>>>>
>>>>James Ytterstene wrote:
>>>>
>>>>
>>>>>Hello
>>>>>
>>>>>I would like to add an extra header to all mail that is spam.
>>>>>There is an header named "Spam Score Header" that is inserted into mails
>>>>>that are spam, but i would like to have two headers.
>>>>>The first header is a static one and the second is the normal where i get
>>>>>the detailed information. The result should look something like this
>>>>>
>>>>>X-spam: YES
>>>>>X-My-Company-MailScanner-SpamScore: spam, bla bla
>>>>>
>>>>>It is this first extra line i would like to insert. I have tried
>>>>>everyting i know. but cant get it to work. Can it be done with rulesets ?
>>>>>
>>>>>
>>>>>/James Ytterstene
>>>>>
>>>>>------------------------ MailScanner list ------------------------
>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>>'leave mailscanner' in the body of the email.
>>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>**********************************************************************
>>>>
>>>>This email and any files transmitted with it are confidential and
>>>>intended solely for the use of the individual or entity to whom they
>>>>are addressed. If you have received this email in error please notify
>>>>the system manager.
>>>>
>>>>This footnote confirms that this email message has been swept
>>>>for the presence of computer viruses and is believed to be clean.
>>>>
>>>>**********************************************************************
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>**********************************************************************
>>
>>This email and any files transmitted with it are confidential and
>>intended solely for the use of the individual or entity to whom they
>>are addressed. If you have received this email in error please notify
>>the system manager.
>>
>>This footnote confirms that this email message has been swept
>>for the presence of computer viruses and is believed to be clean.
>>
>>**********************************************************************
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From cconn at ABACOM.COM  Tue Oct 19 16:21:13 2004
From: cconn at ABACOM.COM (Chris Conn)
Date: Thu Jan 12 21:27:19 2006
Subject: ClamAV False positives on "Exploit.JPEG.Comment.1"?????
Message-ID: <mailman.3711.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
DNSAdmin wrote:
> Hello All,
>
> This morning I have two "regular" senders, one which on my servers, another
> from outside who regularly sends to a user on our servers. They've both
> sent multiple JPeG files (which is an unusual occurrence) and they all are
> tagged by ClamAV as:
>
>     Report: ClamAV: image006.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image007.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image008.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image001.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image003.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image004.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image005.jpg contains Exploit.JPEG.Comment.1
>
> AND:
>
>     Report: ClamAV: msg-9197-33.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-34.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-35.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-36.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-31.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-32.jpg contains Exploit.JPEG.Comment.1
>
> I've pulled them out of the Quarantine and scanned them locally with Norton
> AV (I just checked Live Update and I'm good). They test negative. Any idea
> what is going on here?

Hello,

Asking this question these days is treading on thin ice...someone might
call you an egoist, a caveman or other various labels =)

As many, you are probably using a pre-built RPM or what have you of a
0.80-rcXX release candidate, and it is out of date as of yesterday
(which makes anything before it very obsolete and quite antiquated...).
  OR, you are still using signature version 535, which had some sort of
matching problem with .jpg files from what I understand from the release
information of 536 which say:

Notes: Re-issue these sigs, modified to work around a scanning error.
Notes: daily:535 reverted to previous signatures.


So take your pick, and choose your words for this list =)  And upgrade
to 0.80 release.

Been there, done that,

Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Tue Oct 19 16:25:45 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3712.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 07:22 AM 10/19/2004, Julian Field wrote:
>It's probably SpamAssassin doing it.
>
>At 12:04 19/10/2004, you wrote:
> >Mailscanner seems to create a tmp directory in /tmp on one of our servers
> >for each and every e-mail.
> >
> >It fills /tmp with tmp dirs that look like tmp0d864484 etc.

I've never seen SA do that before, although SA does create tempfiles, it
generates them late in the game and cleans them up pretty soon afterward.
You'd have to kill SA at just the right time to cause it.

Michele, do you see MailScanner killing SA with timeout errors in your mailogs?

You might want to consider extending your SA timeout in MailScanner.conf.
IMO, Julian's default here is way too short for a bayes-enabled install of SA:

         SpamAssassin Timeout = 120

You might also want to enable MS's "Rebuild Bayes Every" option, and
disable bayes_auto_expire in SA's /etc/mail/spamassassin/local.cf. This
will make bayes expiry run when MS wants to run it, not as SA gets fed a
message.

Even with these settings I get the occasional timeout, but it's only
happened twice in the past month, instead of 10-15 times a day.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Tue Oct 19 16:40:39 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3713.1137101239.24926.mailscanner@lists.mailscanner.info>

>> At 12:04 19/10/2004, you wrote:
>>> Mailscanner seems to create a tmp directory in /tmp on one of our
>>> servers for each and every e-mail.
>>>
>>> It fills /tmp with tmp dirs that look like tmp0d864484 etc.
>
> I've never seen SA do that before, although SA does create
> tempfiles, it generates them late in the game and cleans them up
> pretty soon afterward. You'd have to kill SA at just the right time
> to cause it.
>
> Michele, do you see MailScanner killing SA with timeout errors in
> your mailogs?

Nope. That server never has any issues like that.. If it did it would make a
good starting point, but it behaves very well

>
> You might want to consider extending your SA timeout in
> MailScanner.conf. IMO, Julian's default here is way too short for a
> bayes-enabled install of SA:
>
>          SpamAssassin Timeout = 120
>
> You might also want to enable MS's "Rebuild Bayes Every"
> option, and disable bayes_auto_expire in SA's
> /etc/mail/spamassassin/local.cf. This will make bayes expiry
> run when MS wants to run it, not as SA gets fed a message.

I'll have a look at that.
On an unrelated note (to this issue) where does that setting "live" in SA3?
>
> Even with these settings I get the occasional timeout, but
> it's only happened twice in the past month, instead of 10-15 times a
> day.




Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 16:29:06 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: ClamAV False positives on "Exploit.JPEG.Comment.1"?????
Message-ID: <mailman.3714.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
As mentioned elsewhere on this list today, upgrade to the stable release of
ClamAV.

At 16:12 19/10/2004, you wrote:
>Hello All,
>
>This morning I have two "regular" senders, one which on my servers, another
>from outside who regularly sends to a user on our servers. They've both
>sent multiple JPeG files (which is an unusual occurrence) and they all are
>tagged by ClamAV as:
>
>     Report: ClamAV: image006.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image007.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image008.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image001.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image003.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image004.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image005.jpg contains Exploit.JPEG.Comment.1
>
>AND:
>
>     Report: ClamAV: msg-9197-33.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-34.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-35.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-36.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-31.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-32.jpg contains Exploit.JPEG.Comment.1
>
>I've pulled them out of the Quarantine and scanned them locally with Norton
>AV (I just checked Live Update and I'm good). They test negative. Any idea
>what is going on here?
>
>Thanks,
>Glenn
>
>
>
>--
>This message has been scanned for viruses and
>dangerous content by MailScanner, and is
>believed to be clean.
>http://www.sng.ecs.soton.ac.uk/mailscanner/
>Configuration by Glenn Parsons dnsadmin-at-1bigthink.com
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From raymond at PROLOCATION.NET  Tue Oct 19 16:40:36 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:19 2006
Subject: ClamAV False positives on "Exploit.JPEG.Comment.1"?????
Message-ID: <mailman.3715.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

>    Report: ClamAV: msg-9197-33.jpg contains Exploit.JPEG.Comment.1
>    Report: ClamAV: msg-9197-34.jpg contains Exploit.JPEG.Comment.1
>    Report: ClamAV: msg-9197-35.jpg contains Exploit.JPEG.Comment.1
>    Report: ClamAV: msg-9197-36.jpg contains Exploit.JPEG.Comment.1
>    Report: ClamAV: msg-9197-31.jpg contains Exploit.JPEG.Comment.1
>    Report: ClamAV: msg-9197-32.jpg contains Exploit.JPEG.Comment.1
>
> I've pulled them out of the Quarantine and scanned them locally with Norton
> AV (I just checked Live Update and I'm good). They test negative. Any idea
> what is going on here?

Like reported earleir today, uprade to .80, other versions with the same
signatures are definately broken.

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From JHuber at MICROSOURCE.COM  Tue Oct 19 16:46:56 2004
From: JHuber at MICROSOURCE.COM (Jeremy Huber)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3716.1137101239.24926.mailscanner@lists.mailscanner.info>

I'm having the same problem (I have to nuke them about once a day or
they get out of control).  I'm not getting any SA timeouts, either.
Some of the info I've been finding online points to clamav causing them,
not SA.

Jeremy

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Michele Neylon :: Blacknight Solutions
Sent: Tuesday, October 19, 2004 5:04 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: /tmp issue


Mailscanner seems to create a tmp directory in /tmp on one of our
servers
for each and every e-mail.

It fills /tmp with tmp dirs that look like tmp0d864484 etc.

What is causing this??

How can we make it stop?

Versions:
SA 2.64
MS - latest stable
OS - Whitebox
MTA - sendmail
MailWatch is also installed, but has been heavily modified


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Tue Oct 19 16:52:41 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:19 2006
Subject: MailScanner and webmail
Message-ID: <mailman.3717.1137101239.24926.mailscanner@lists.mailscanner.info>

Which webmail compliments MailScanner? I was looking for features like auto
routing of spam to end users spam folder. Does anything like this exist in
open source?

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at seceidos.de  Tue Oct 19 17:42:36 2004
From: Jan-Peter.Koopmann at seceidos.de (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3718.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi,

I just checked a MailScanner installation against the currupt ZIP file
problem many virus scanners seem to have. I used the virus check on
www.heise.de
(http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=zip
_g0). This test will send you a ZIP archive, which is manipulated so
that the eicar.com file is supposed to have only 0 bytes. Many archivers
will extract this correctly. MailScanner obviously did not. It was
blocked due to being .com but the test virus was not found.

There are two tests. One changes the uncompressed size in the global ZIP
directory and one in the local ZIP directory (sorry, trying to translate
the german page as good as I can without knowing ZIP files too well).
One test (local dir) works ok but the global dir test fails.

Is there anything we/Julian etc. can do? Are the ZIPs extracted by the
virus scanners or by MailScanner?


Regards,
  JP

From phil at ICSERV.NET  Tue Oct 19 17:50:21 2004
From: phil at ICSERV.NET (Philip Larkin Waters)
Date: Thu Jan 12 21:27:19 2006
Subject: MailScanner and webmail
Message-ID: <mailman.3719.1137101239.24926.mailscanner@lists.mailscanner.info>

Squirrelmail has a plugin that we use and is configurable by the user
which folder in which to put the spam
____
Theory is when you know something, but it doesn't work.
Practice is when something works, but you don't know why.
Programmers combine theory and practice:
Nothing works and they don't know why.
--Unknown
----- Original Message -----
From: "Sanjay K. Patel" <sanjay.patel@REXWIRE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 19, 2004 9:52 AM
Subject: MailScanner and webmail


> Which webmail compliments MailScanner? I was looking for features like
auto
> routing of spam to end users spam folder. Does anything like this
exist in
> open source?
>
> -SKP
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dnsadmin at 1BIGTHINK.COM  Tue Oct 19 18:01:03 2004
From: dnsadmin at 1BIGTHINK.COM (DNSAdmin)
Date: Thu Jan 12 21:27:19 2006
Subject: SOLVED: ClamAV False positives on "Exploit.JPEG.Comment.1"????? &
    THANKS!
Message-ID: <mailman.3720.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:40 AM 10/19/2004, you wrote:
>Hi!
>
>>    Report: ClamAV: msg-9197-33.jpg contains Exploit.JPEG.Comment.1
>>    Report: ClamAV: msg-9197-34.jpg contains Exploit.JPEG.Comment.1
>>    Report: ClamAV: msg-9197-35.jpg contains Exploit.JPEG.Comment.1
>>    Report: ClamAV: msg-9197-36.jpg contains Exploit.JPEG.Comment.1
>>    Report: ClamAV: msg-9197-31.jpg contains Exploit.JPEG.Comment.1
>>    Report: ClamAV: msg-9197-32.jpg contains Exploit.JPEG.Comment.1
>>
>>I've pulled them out of the Quarantine and scanned them locally with Norton
>>AV (I just checked Live Update and I'm good). They test negative. Any idea
>>what is going on here?
>
>Like reported earleir today, uprade to .80, other versions with the same
>signatures are definately broken.

Thanks ALL!



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
http://www.sng.ecs.soton.ac.uk/mailscanner/
Configuration by Glenn Parsons dnsadmin-at-1bigthink.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Jan-Peter.Koopmann at SECEIDOS.DE  Tue Oct 19 17:42:36 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3721.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi,

I just checked a MailScanner installation against the currupt ZIP file
problem many virus scanners seem to have. I used the virus check on
www.heise.de
(http://www.heise.de/security/dienste/emailcheck/demos/go.shtml?mail=zip
_g0). This test will send you a ZIP archive, which is manipulated so
that the eicar.com file is supposed to have only 0 bytes. Many archivers
will extract this correctly. MailScanner obviously did not. It was
blocked due to being .com but the test virus was not found.

There are two tests. One changes the uncompressed size in the global ZIP
directory and one in the local ZIP directory (sorry, trying to translate
the german page as good as I can without knowing ZIP files too well).
One test (local dir) works ok but the global dir test fails.

Is there anything we/Julian etc. can do? Are the ZIPs extracted by the
virus scanners or by MailScanner?


Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 17:54:23 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3722.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:42 19/10/2004, you wrote:
>Are the ZIPs extracted by the
>virus scanners or by MailScanner?

Both.
For filename and filetype rules.conf files, MailScanner does it if you have
set "Maximum Archive Depth" to something other than 0.
For virus-scanning it's down to the virus scanners.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Jan-Peter.Koopmann at seceidos.de  Tue Oct 19 18:31:49 2004
From: Jan-Peter.Koopmann at seceidos.de (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3723.1137101239.24926.mailscanner@lists.mailscanner.info>

On Tuesday, October 19, 2004 6:54 PM MailScanner mailing list wrote:

> Both.
> For filename and filetype rules.conf files, MailScanner does
> it if you have set "Maximum Archive Depth" to something other than 0.
> For virus-scanning it's down to the virus scanners.

Thought so. Strange thing: The VirusWarning message said only this:

At Tue Oct 19 19:28:41 2004 the virus scanner said:
   MailScanner: Executable DOS/Windows programs are dangerous in email
(eicar.com)



But the logfile shows that eicar _was_ detected and everything is fine:

Oct 19 19:28:39 proxy MailScanner[23721]:
[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR_Test_File 
[Libra]
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
virus EICAR_Test_File
Oct 19 19:28:39 proxy MailScanner[23721]:
[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR Test File
[Orion]
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
virus EICAR Test File
Oct 19 19:28:39 proxy MailScanner[23721]:
[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR-Test-File
[AVP]
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
virus EICAR-Test-File
Oct 19 19:28:39 proxy MailScanner[23721]: Scan ended at Tue Oct 19
19:28:39 2004
Oct 19 19:28:39 proxy MailScanner[23721]: 5 files scanned
Oct 19 19:28:39 proxy MailScanner[23721]: 1 file infected
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
1 infections
Oct 19 19:28:40 proxy MailScanner[23721]:
/1CJxmi-0008ip-GS/eicar_g0.zip/EICAR.COM        Found: EICAR test file
NOT a virus.
Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: McAfee found 1
infections
Oct 19 19:28:40 proxy MailScanner[23721]:
/var/spool/MailScanner/incoming/23721/./1CJxmi-0008ip-GS/eicar_g0.zip:
Eicar-Test-Signature FOUND
Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: ClamAV found 1
infections
Oct 19 19:28:40 proxy MailScanner[23721]: ALERT: [Eicar-Test-Signature
virus] ./1CJxmi-0008ip-GS/eicar_g0.zip -->
 eicar.com <<< Contains code of the Eicar-Test-Signature virus


Parsing problems?

Regards,
  JP

From Jan-Peter.Koopmann at seceidos.de  Tue Oct 19 18:31:49 2004
From: Jan-Peter.Koopmann at seceidos.de (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3724.1137101239.24926.mailscanner@lists.mailscanner.info>

On Tuesday, October 19, 2004 6:54 PM MailScanner mailing list wrote:

> Both.
> For filename and filetype rules.conf files, MailScanner does
> it if you have set "Maximum Archive Depth" to something other than 0.
> For virus-scanning it's down to the virus scanners.

Thought so. Strange thing: The VirusWarning message said only this:

At Tue Oct 19 19:28:41 2004 the virus scanner said:
   MailScanner: Executable DOS/Windows programs are dangerous in email
(eicar.com)



But the logfile shows that eicar _was_ detected and everything is fine:

Oct 19 19:28:39 proxy MailScanner[23721]:
[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR_Test_File 
[Libra]
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
virus EICAR_Test_File
Oct 19 19:28:39 proxy MailScanner[23721]:
[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR Test File
[Orion]
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
virus EICAR Test File
Oct 19 19:28:39 proxy MailScanner[23721]:
[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR-Test-File
[AVP]
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
virus EICAR-Test-File
Oct 19 19:28:39 proxy MailScanner[23721]: Scan ended at Tue Oct 19
19:28:39 2004
Oct 19 19:28:39 proxy MailScanner[23721]: 5 files scanned
Oct 19 19:28:39 proxy MailScanner[23721]: 1 file infected
Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
1 infections
Oct 19 19:28:40 proxy MailScanner[23721]:
/1CJxmi-0008ip-GS/eicar_g0.zip/EICAR.COM        Found: EICAR test file
NOT a virus.
Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: McAfee found 1
infections
Oct 19 19:28:40 proxy MailScanner[23721]:
/var/spool/MailScanner/incoming/23721/./1CJxmi-0008ip-GS/eicar_g0.zip:
Eicar-Test-Signature FOUND
Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: ClamAV found 1
infections
Oct 19 19:28:40 proxy MailScanner[23721]: ALERT: [Eicar-Test-Signature
virus] ./1CJxmi-0008ip-GS/eicar_g0.zip -->
 eicar.com <<< Contains code of the Eicar-Test-Signature virus


Parsing problems?

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 18:46:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3725.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
 From the URL you gave, which link do I need to click on? Bit of a long
time since I did any German, and Google makes a complete mess of it.

At 18:31 19/10/2004, you wrote:
>On Tuesday, October 19, 2004 6:54 PM MailScanner mailing list wrote:
>
> > Both.
> > For filename and filetype rules.conf files, MailScanner does
> > it if you have set "Maximum Archive Depth" to something other than 0.
> > For virus-scanning it's down to the virus scanners.
>
>Thought so. Strange thing: The VirusWarning message said only this:
>
>At Tue Oct 19 19:28:41 2004 the virus scanner said:
>    MailScanner: Executable DOS/Windows programs are dangerous in email
>(eicar.com)
>
>
>
>But the logfile shows that eicar _was_ detected and everything is fine:
>
>Oct 19 19:28:39 proxy MailScanner[23721]:
>[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR_Test_File
>[Libra]
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>virus EICAR_Test_File
>Oct 19 19:28:39 proxy MailScanner[23721]:
>[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR Test File
>[Orion]
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>virus EICAR Test File
>Oct 19 19:28:39 proxy MailScanner[23721]:
>[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR-Test-File
>[AVP]
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>virus EICAR-Test-File
>Oct 19 19:28:39 proxy MailScanner[23721]: Scan ended at Tue Oct 19
>19:28:39 2004
>Oct 19 19:28:39 proxy MailScanner[23721]: 5 files scanned
>Oct 19 19:28:39 proxy MailScanner[23721]: 1 file infected
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>1 infections
>Oct 19 19:28:40 proxy MailScanner[23721]:
>/1CJxmi-0008ip-GS/eicar_g0.zip/EICAR.COM        Found: EICAR test file
>NOT a virus.
>Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: McAfee found 1
>infections
>Oct 19 19:28:40 proxy MailScanner[23721]:
>/var/spool/MailScanner/incoming/23721/./1CJxmi-0008ip-GS/eicar_g0.zip:
>Eicar-Test-Signature FOUND
>Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: ClamAV found 1
>infections
>Oct 19 19:28:40 proxy MailScanner[23721]: ALERT: [Eicar-Test-Signature
>virus] ./1CJxmi-0008ip-GS/eicar_g0.zip -->
>  eicar.com <<< Contains code of the Eicar-Test-Signature virus
>
>
>Parsing problems?
>
>Regards,
>   JP
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at LISTS.COM.AR  Tue Oct 19 18:43:05 2004
From: mailscanner at LISTS.COM.AR (Leonardo Helman)
Date: Thu Jan 12 21:27:19 2006
Subject: ClamAV False positives on "Exploit.JPEG.Comment.1"?????
Message-ID: <mailman.3726.1137101239.24926.mailscanner@lists.mailscanner.info>

A little thing more about this:

The same as the other two threads happened here,
but before changing the clamscan from 0.80rc3 to 0.80
almost at 13:00 GMT, there was this update to the daily.cvd database:

-------------------------------------------------------------
ClamAV databases updated (2004.10.19 12:59 +0000): daily.cvd
version: 540

Submission: n/a
Sender: Trog
Updated: Exploit.JPEG.Comment.1
-------------------------------------------------------------

This update has caused some normal jpg's don't report as virus
with the 539 version of the database.

Anyway, I changed the clamav engine so I don't know if this
database solves everything.

Saludos
Leo

On Tue, Oct 19, 2004 at 11:12:13AM -0400, DNSAdmin wrote:
> Hello All,
>
> This morning I have two "regular" senders, one which on my servers, another
> from outside who regularly sends to a user on our servers. They've both
> sent multiple JPeG files (which is an unusual occurrence) and they all are
> tagged by ClamAV as:
>
>     Report: ClamAV: image006.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image007.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image008.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image001.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image003.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image004.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: image005.jpg contains Exploit.JPEG.Comment.1
>
> AND:
>
>     Report: ClamAV: msg-9197-33.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-34.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-35.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-36.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-31.jpg contains Exploit.JPEG.Comment.1
>     Report: ClamAV: msg-9197-32.jpg contains Exploit.JPEG.Comment.1
>
> I've pulled them out of the Quarantine and scanned them locally with Norton
> AV (I just checked Live Update and I'm good). They test negative. Any idea
> what is going on here?
>
> Thanks,
> Glenn
>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> http://www.sng.ecs.soton.ac.uk/mailscanner/
> Configuration by Glenn Parsons dnsadmin-at-1bigthink.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Tue Oct 19 19:02:17 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3727.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 01:55 PM 10/19/2004, Mike Tremaine wrote:
>On Tue, 2004-10-19 at 08:25, Matt Kettler wrote:
> > You might also want to enable MS's "Rebuild Bayes Every" option, and
> > disable bayes_auto_expire in SA's /etc/mail/spamassassin/local.cf. This
> > will make bayes expiry run when MS wants to run it, not as SA gets fed a
> > message.
>
>What do you set your bayes_auto_expire to? I've been wondering what
>other people set this as for awhile.

It's a numeric boolean, you can set it to 0 to turn it off, and 1 to turn
it on. I turned it off.

bayes_auto_expire       0

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mgt at STELLARCORE.NET  Tue Oct 19 19:09:15 2004
From: mgt at STELLARCORE.NET (Mike Tremaine)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3728.1137101239.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-10-19 at 11:02, Matt Kettler wrote:

> It's a numeric boolean, you can set it to 0 to turn it off, and 1 to turn
> it on. I turned it off.
>
> bayes_auto_expire       0
>

I'm sorry, apparently I need some coffee. I meant to ask what do you set
the Rebuild interval to?

Rebuild Bayes Every = xxx



--
Mike Tremaine
mgt@stellarcore.net
http://www.stellarcore.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Tue Oct 19 19:40:09 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3729.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:09 PM 10/19/2004, Mike Tremaine wrote:
>I'm sorry, apparently I need some coffee. I meant to ask what do you set
>the Rebuild interval to?
>
>Rebuild Bayes Every = xxx

It's in seconds. 86400 seconds (1 day) is a good starting point. If you use
the SA option to do bayes learning to the journal, you may want to do this
more frequently. (ie: 4 or 6 times a day)

Note that the rebuilds can take a bit of time, but generally run in the
range of 30 seconds to a minute and a half on my system.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mlm at LOANPROCESSING.NET  Tue Oct 19 19:46:29 2004
From: mlm at LOANPROCESSING.NET (Mike McMullen)
Date: Thu Jan 12 21:27:19 2006
Subject: Upgrading ClamAV after Installing MailScanner version 4.34.8
Message-ID: <mailman.3730.1137101239.24926.mailscanner@lists.mailscanner.info>

Hi All,

I have a freshly installed and updated FC2 server which I just installed
MailScanner 4.34.8 on using the RPMs. I then installed the RPM versions
of SA 3.0 and ClamAV from the MailScanner site.

I saw that the ClamAV version was 0.75.1.

I tried to update it using up2date and I get the following conflicts:

RPM package conflict error.  The message was:
Test install failed because of package conflicts:
file /etc/cron.daily/freshclam from install of clamav-0.80-1 conflicts with file from package
clamav-db-0.75.1-1.1.el3.dag
file /etc/logrotate.d/freshclam from install of clamav-0.80-1 conflicts with file from package
clamav-db-0.75.1-1.1.el3.dag

I tried removing clamav 0.75.1 but got the following message:

error: Failed dependencies:
        libclamav.so.1 is needed by (installed) perl-Mail-ClamAV-0.11-1

Is it ok to force the ClamAV .80 install? Or how should I proceed at this point.

Thanks!

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From tmyers2 at UNL.EDU  Tue Oct 19 19:28:11 2004
From: tmyers2 at UNL.EDU (Tim Myers)
Date: Thu Jan 12 21:27:19 2006
Subject: why rewrite From header?
Message-ID: <mailman.3731.1137101239.24926.mailscanner@lists.mailscanner.info>

Our web server uses DNS CNAME entries for its virtual hosts. Messages sent
from those virtual hosts are having their From: headers rewritten using the
A record hostname.

CNAME records are not IP spoofing, why are they being rewritten?

How can this be turned off?

Tim Myers
RHEL AS 3.0
MailScanner-4.29.7-1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mgt at STELLARCORE.NET  Tue Oct 19 18:55:57 2004
From: mgt at STELLARCORE.NET (Mike Tremaine)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3732.1137101239.24926.mailscanner@lists.mailscanner.info>

On Tue, 2004-10-19 at 08:25, Matt Kettler wrote:
> You might also want to enable MS's "Rebuild Bayes Every" option, and
> disable bayes_auto_expire in SA's /etc/mail/spamassassin/local.cf. This
> will make bayes expiry run when MS wants to run it, not as SA gets fed a
> message.

What do you set your bayes_auto_expire to? I've been wondering what
other people set this as for awhile.


--
Mike Tremaine
mgt at stellarcore.net
http://www.stellarcore.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Tue Oct 19 20:55:26 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:19 2006
Subject: why rewrite From header?
Message-ID: <mailman.3733.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:28 PM 10/19/2004, Tim Myers wrote:
>Our web server uses DNS CNAME entries for its virtual hosts. Messages sent
>from those virtual hosts are having their From: headers rewritten using the
>A record hostname.
>
>CNAME records are not IP spoofing, why are they being rewritten?

Are you sure they are being rewritten and aren't being written that way in
the first place? Are you sure they contained the cnamed hostname in the
From: header when they were queued?

Very few things will re-write the From header, unless the domain-name part
is missing entirely, in which case most MTA's will rewrite the header
automatically for correctness sake.   (ie: From: mkettler gets rewritten to
From: mkettler@xanadu.evi-inc.com, but From: mkettler@evi-inc.com does not
get rewritten)

My MailScanner/Sendmail setup handles multiple domains just fine without
rewriting anything, except the above "username only" case.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Tue Oct 19 20:52:56 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:19 2006
Subject: Upgrading ClamAV after Installing MailScanner version 4.34.8
Message-ID: <mailman.3734.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Mike McMullen wrote:
> Hi All,
> 
> I have a freshly installed and updated FC2 server which I just installed
> MailScanner 4.34.8 on using the RPMs. I then installed the RPM versions
> of SA 3.0 and ClamAV from the MailScanner site.
> 
> I saw that the ClamAV version was 0.75.1.
> 
> I tried to update it using up2date and I get the following conflicts:
> 
> RPM package conflict error.  The message was:
> Test install failed because of package conflicts:
> file /etc/cron.daily/freshclam from install of clamav-0.80-1 conflicts with file from package
> clamav-db-0.75.1-1.1.el3.dag
> file /etc/logrotate.d/freshclam from install of clamav-0.80-1 conflicts with file from package
> clamav-db-0.75.1-1.1.el3.dag
> 
> I tried removing clamav 0.75.1 but got the following message:
> 
> error: Failed dependencies:
>         libclamav.so.1 is needed by (installed) perl-Mail-ClamAV-0.11-1

Maybe you should try uninstalling pel-Mail-Clamav then retry with up2dateÉ

> 
> Is it ok to force the ClamAV .80 install? Or how should I proceed at this point.
> 
> Thanks!
> 
> Mike
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From james.ytterstene at MDH.SE  Tue Oct 19 21:28:47 2004
From: james.ytterstene at MDH.SE (James Ytterstene)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3735.1137101239.24926.mailscanner@lists.mailscanner.info>

Hello

I can't do that because our company has strict rules that dont alow us to
do that. Sofar i haw patched the source each time i make an upgrade but if
i could solve it with the config it would be much better.

Is there a way to make a new line in the config. Something like \n. I have
tried \n without success but maby there is an other way. I could then
write the config line like this

Spam Header = X-Spam-Flag: YES "new line" X-xyz-MailScanner-SpamCheck:

But i dont know if that is possibel. Anyone ho know ?

/James

On Tue, 19 Oct 2004, Martin Hepworth wrote:

> James
>
> OK..
>
> you could alway tag the subject line and use that to filter to...
>
> subject starts with {Spam?}
>
> ???
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> James Ytterstene wrote:
> > Hello
> >
> > The real name of the flag is "X-Spam-Flag: YES" which SpamAssassin inserts
> > into the mail. I have som badly written mail clients which need a clean
> > flag to filter on. When i use SpamAssassin standalone i get the flag but
> > not when using MailScanner as an frontend.
> >
> > I dont know why the header from SpamAssassin is left out, but if i could
> > dubble the "Spam Header" i could manually put it back. But i cant get it
> > to work.
> >
> > /James
> >
> > On Tue, 19 Oct 2004, Martin Hepworth wrote:
> >
> >
> >>James
> >>
> >>Apart from the strict I dn't see how this differs from the 'spam' part
> >>of the said header. Or maybe I'm being thick as usual..?
> >>
> >>You should be able to write rules for the MUA/procmail/whatever against
> >>either varient..
> >>
> >>
> >>--
> >>Martin Hepworth
> >>Snr Systems Administrator
> >>Solid State Logic
> >>Tel: +44 (0)1865 842300
> >>
> >>
> >>James Ytterstene wrote:
> >>
> >>>Hello
> >>>
> >>>My misstake. I ment that it was this header i would like to doubble. The
> >>>header "Spam Header = X-%org-name%-MailScanner-SpamCheck:" includes the
> >>>detailed information about the different scores from a spam mail. I need a
> >>>clean header with only the value "YES".
> >>>
> >>>So a correct look would be like this
> >>>------------------------------------
> >>>
> >>>X-spam: YES
> >>>X-My-Company-MailScanner-SpamCheck: spam, SpamAssassin (resultat=26.966, krav 5,
> >>>        autolearn=disabled, HTML_10_20 0.29, HTML_MESSAGE 0.00,
> >>>...
> >>>        X_MESSAGE_INFO 4.19)
> >>>X-My-Company-MailScanner-SpamScore: ssssssssssssssssssss
> >>>
> >>>-------------------------------------
> >>>
> >>>/James
> >>>
> >>>On Tue, 19 Oct 2004, Martin Hepworth wrote:
> >>>
> >>>
> >>>
> >>>>James
> >>>>Already there..
> >>>>
> >>>
> >>>>from MailScanner.conf
> >>>
> >>>># Add this extra header to all messages found to be spam.
> >>>># This can also be the filename of a ruleset.
> >>>>Spam Header = X-%org-name%-MailScanner-SpamCheck:
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>--
> >>>>Martin Hepworth
> >>>>Snr Systems Administrator
> >>>>Solid State Logic
> >>>>Tel: +44 (0)1865 842300
> >>>>
> >>>>
> >>>>James Ytterstene wrote:
> >>>>
> >>>>
> >>>>>Hello
> >>>>>
> >>>>>I would like to add an extra header to all mail that is spam.
> >>>>>There is an header named "Spam Score Header" that is inserted into mails
> >>>>>that are spam, but i would like to have two headers.
> >>>>>The first header is a static one and the second is the normal where i get
> >>>>>the detailed information. The result should look something like this
> >>>>>
> >>>>>X-spam: YES
> >>>>>X-My-Company-MailScanner-SpamScore: spam, bla bla
> >>>>>
> >>>>>It is this first extra line i would like to insert. I have tried
> >>>>>everyting i know. but cant get it to work. Can it be done with rulesets ?
> >>>>>
> >>>>>
> >>>>>/James Ytterstene
> >>>>>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 19 23:59:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: ZIP File problem
Message-ID: <mailman.3736.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:31 19/10/2004, you wrote:
>Thought so. Strange thing: The VirusWarning message said only this:
>
>At Tue Oct 19 19:28:41 2004 the virus scanner said:
>    MailScanner: Executable DOS/Windows programs are dangerous in email
>(eicar.com)
>
>
>
>But the logfile shows that eicar _was_ detected and everything is fine:
>
>Oct 19 19:28:39 proxy MailScanner[23721]:
>[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR_Test_File
>[Libra]
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>virus EICAR_Test_File
>Oct 19 19:28:39 proxy MailScanner[23721]:
>[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR Test File
>[Orion]
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>virus EICAR Test File
>Oct 19 19:28:39 proxy MailScanner[23721]:
>[./1CJxmi-0008ip-GS/eicar_g0.zip] eicar.com: Infected: EICAR-Test-File
>[AVP]
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>virus EICAR-Test-File
>Oct 19 19:28:39 proxy MailScanner[23721]: Scan ended at Tue Oct 19
>19:28:39 2004
>Oct 19 19:28:39 proxy MailScanner[23721]: 5 files scanned
>Oct 19 19:28:39 proxy MailScanner[23721]: 1 file infected
>Oct 19 19:28:39 proxy MailScanner[23721]: Virus Scanning: F-Secure found
>1 infections
>Oct 19 19:28:40 proxy MailScanner[23721]:
>/1CJxmi-0008ip-GS/eicar_g0.zip/EICAR.COM        Found: EICAR test file
>NOT a virus.
>Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: McAfee found 1
>infections
>Oct 19 19:28:40 proxy MailScanner[23721]:
>/var/spool/MailScanner/incoming/23721/./1CJxmi-0008ip-GS/eicar_g0.zip:
>Eicar-Test-Signature FOUND
>Oct 19 19:28:40 proxy MailScanner[23721]: Virus Scanning: ClamAV found 1
>infections
>Oct 19 19:28:40 proxy MailScanner[23721]: ALERT: [Eicar-Test-Signature
>virus] ./1CJxmi-0008ip-GS/eicar_g0.zip -->
>  eicar.com <<< Contains code of the Eicar-Test-Signature virus
>
>
>Parsing problems?

It turns out the filename report for the child (eicar.com) was masking the
virus report from the parent (eicar_g0.zip). If the filename report is
removed, all the virus scanner reports appear.

So there wasn't any chance of the virus slipping through, it was just the
reporting that was going astray.

After about 4 hours on this, I have finally found it and fixed it. Took
some real digging, that one.
It will be in the next release.

Many thanks for reporting it.

Now I can go to bed :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 00:05:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3737.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 21:28 19/10/2004, you wrote:
>Hello
>
>I can't do that because our company has strict rules that dont alow us to
>do that. Sofar i haw patched the source each time i make an upgrade but if
>i could solve it with the config it would be much better.
>
>Is there a way to make a new line in the config. Something like \n. I have
>tried \n without success but maby there is an other way. I could then
>write the config line like this
>
>Spam Header = X-Spam-Flag: YES "new line" X-xyz-MailScanner-SpamCheck:
>
>But i dont know if that is possibel. Anyone ho know ?

It's not as simple as that. MailScanner has to generate files correctly for
the queue design of each MTA, it's not simply writing out the text of the
message (in RFC822 format).

Is there really no easy way to do this with a simple global procmail
script, which looks for the spamcheck header and adds in a new header if
it's there?

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mlm at LOANPROCESSING.NET  Wed Oct 20 00:18:02 2004
From: mlm at LOANPROCESSING.NET (Mike McMullen)
Date: Thu Jan 12 21:27:19 2006
Subject: FIXED: Re: Upgrading ClamAV after Installing MailScanner version
    4.34.8
Message-ID: <mailman.3738.1137101239.24926.mailscanner@lists.mailscanner.info>

----- Original Message ----- 
From: "Ugo Bellavance" <ugob@CAMO-ROUTE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 19, 2004 12:52 PM
Subject: Re: Upgrading ClamAV after Installing MailScanner version 4.34.8


> Mike McMullen wrote:
> > Hi All,
> >
> > I have a freshly installed and updated FC2 server which I just installed
> > MailScanner 4.34.8 on using the RPMs. I then installed the RPM versions
> > of SA 3.0 and ClamAV from the MailScanner site.
> >
> > I saw that the ClamAV version was 0.75.1.
> >
> > I tried to update it using up2date and I get the following conflicts:
> >
> > RPM package conflict error.  The message was:
> > Test install failed because of package conflicts:
> > file /etc/cron.daily/freshclam from install of clamav-0.80-1 conflicts with file from package
> > clamav-db-0.75.1-1.1.el3.dag
> > file /etc/logrotate.d/freshclam from install of clamav-0.80-1 conflicts with file from package
> > clamav-db-0.75.1-1.1.el3.dag
> >
> > I tried removing clamav 0.75.1 but got the following message:
> >
> > error: Failed dependencies:
> >         libclamav.so.1 is needed by (installed) perl-Mail-ClamAV-0.11-1
>
> Maybe you should try uninstalling pel-Mail-Clamav then retry with up2dateÉ
>
I did various uninstalls and got everything happy.

Thanks,

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From tmyers2 at UNL.EDU  Wed Oct 20 00:17:49 2004
From: tmyers2 at UNL.EDU (Tim Myers)
Date: Thu Jan 12 21:27:19 2006
Subject: why rewrite From header?
Message-ID: <mailman.3739.1137101239.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Matt Kettler wrote:

> At 02:28 PM 10/19/2004, Tim Myers wrote:
>
>> Our web server uses DNS CNAME entries for its virtual hosts. Messages
>> sent
>> from those virtual hosts are having their From: headers rewritten
>> using the
>> A record hostname.
>
> Are you sure they are being rewritten and aren't being written that
> way in
> the first place? Are you sure they contained the cnamed hostname in the
> From: header when they were queued?

Yes, they are being rewritten. But, I just eliminated MailScanner as the
culprit. Something in sendmail is the only thing left to check.

I had several possible culprits and only posted when it was down to
sendmail and MailScanner. I just assumed that a vanilla install of
sendmail couldn't be the problem.

Sorry to bother everyone.

Tim Myers

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From james_gray at ocs.com  Tue Oct 19 23:27:57 2004
From: james_gray at ocs.com (James Gray)
Date: Thu Jan 12 21:27:19 2006
Subject: Add an aditional header to spam mail.
Message-ID: <mailman.3740.1137101239.24926.mailscanner@lists.mailscanner.info>

On Wed, 20 Oct 2004 06:28 am, James Ytterstene wrote:
> Hello
>
> I can't do that because our company has strict rules that dont alow us to
> do that. Sofar i haw patched the source each time i make an upgrade but if
> i could solve it with the config it would be much better.
>
> Is there a way to make a new line in the config. Something like \n. I have
> tried \n without success but maby there is an other way. I could then
> write the config line like this
>
> Spam Header = X-Spam-Flag: YES "new line" X-xyz-MailScanner-SpamCheck:
>
> But i dont know if that is possibel. Anyone ho know ?
>
> /James

We had the same problem as you we moved from just SA checks to the full
MailScanner solution.  The only work-around I could implement was to change
the "Spam Header" config option, then modify the languages.conf file.  I'm
not connected ATM (offline...on a train) but our setup looks something like
this:

Spam Header = X-Spam-Flag:

then in languages.conf (check these...not 100% sure of the tag names);
SPAM=YES
NOT_SPAM=NO

Also, in MailScanner.conf, we DONT include the "Spam Header" when the message
is clean (ham).  Unfortunately, with this configuration, you loose the extra
(useful) info about score and rules hit for ham/spam.  Spam reports handle
the false positives we occasionally get, but when spam slips through, I've
got to dig through logs for the message ID to see how the message was
processed - gah.  Lucky we get <0.01% false negatives :)

This setup is because some (nearly all) users simply check for the *existence*
of the "X-Spam-Flag" and ignore the yes/no status.  Despite much education,
lamenting and the odd LARTing, we're stuck with the users' inability to
modify Outlook rules to move their spam without direct assistance from IT
Ops! :(  Usually they end up deleting all incoming mail :P

Hope that gets you around the problem until another solution is devised.

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wlamore at MSN.COM  Wed Oct 20 02:57:59 2004
From: wlamore at MSN.COM (William Lamoreaux)
Date: Thu Jan 12 21:27:19 2006
Subject: Getting errors after loading
Message-ID: <mailman.3741.1137101239.24926.mailscanner@lists.mailscanner.info>

Ran the Clamavmodule for Solaris 9 (x86 solaris version) listed under
otherstuff. Used the non-rpm script as suggested to install perl modules and
Spamassassin 3.0.  Script ran and looked good until the very last part:

The error was:
version.h.pl: version.h.pl: version.h.pl: version.h.pl: version.h.pl:
version.h.pl: version.h.pl: Can't locate Digest/SHA1.pm in @INC (@INC
contains: ../lib /usr/perl5/5.6.1/lib/i86pc-solaris-64int
/usr/perl5/5.6.1/lib /usr/perl5/site_perl/5.6.1/i86pc-solaris-64int
/usr/perl5/site_perl/5.6.1 /usr/perl5/site_perl
/usr/perl5/vendor_perl/5.6.1/i86pc-solaris-64int
/usr/perl5/vendor_perl/5.6.1 /usr/perl5/vendor_perl .) at
../lib/Mail/SpamAssassin/EvalTests.pm line 33.
BEGIN failed--compilation aborted at ../lib/Mail/SpamAssassin/EvalTests.pm
line 33.
Compilation failed in require at ../lib/Mail/SpamAssassin/PerMsgStatus.pm
line 56.
BEGIN failed--compilation aborted at
../lib/Mail/SpamAssassin/PerMsgStatus.pm line 56.
Compilation failed in require at ../lib/Mail/SpamAssassin.pm line 74.
BEGIN failed--compilation aborted at ../lib/Mail/SpamAssassin.pm line 74.
Compilation failed in require at version.h.pl line 27.
*** Error code 2
make: Fatal error: Command failed for target `spamc/Makefile'

Tried to start MailScanner:
Starting MailScanner...
Can't locate MIME/Parser.pm in @INC (@INC contains: /opt/MailScanner/lib
/usr/perl5/5.6.1/lib/i86pc-solaris-64int /usr/perl5/5.6.1/lib
/usr/perl5/site_perl/5.6.1/i86pc-solaris-64int /usr/perl5/site_perl/5.6.1
/usr/perl5/site_perl /usr/perl5/vendor_perl/5.6.1/i86pc-solaris-64int
/usr/perl5/vendor_perl/5.6.1 /usr/perl5/vendor_perl . /opt/MailScanner/lib)
at /opt/MailScanner/lib/MailScanner/MCPMessage.pm line 40.
BEGIN failed--compilation aborted at
/opt/MailScanner/lib/MailScanner/MCPMessage.pm line 40.
Compilation failed in require at /opt/MailScanner/bin/MailScanner line 51.
BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner line 51.

Tried downloading Mime Parser and tools from CPAN Site but script still
calls for other modules?

Any ideas would be appreciated, could find little in the book to help with
Solaris installs or online.

Thanks
William Lamoreaux

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From markee at bandwidthco.com  Wed Oct 20 06:07:47 2004
From: markee at bandwidthco.com (Mark E. Donaldson)
Date: Thu Jan 12 21:27:19 2006
Subject: /tmp issue
Message-ID: <mailman.3742.1137101239.24926.mailscanner@lists.mailscanner.info>

I had the same problem as well on SuSE. To fix it, I had to change the
/etc/sysconfig/cron setting of  OWNER_TO_KEEP_IN_TMP="root" to "".

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Jeremy Huber
Sent: Tuesday, October 19, 2004 8:47 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: /tmp issue

I'm having the same problem (I have to nuke them about once a day or they
get out of control).  I'm not getting any SA timeouts, either.
Some of the info I've been finding online points to clamav causing them, not
SA.

Jeremy


Mailscanner seems to create a tmp directory in /tmp on one of our servers
for each and every e-mail.

It fills /tmp with tmp dirs that look like tmp0d864484 etc.

What is causing this??

How can we make it stop?

Versions:
SA 2.64
MS - latest stable
OS - Whitebox
MTA - sendmail
MailWatch is also installed, but has been heavily modified





########################################################
This message has been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.

postmaster@bandwidthco.com
MailScanner at bandwidthco.com is for your absolute protection.
########################################################

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 06:59:03 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: ZIP File problem
Message-ID: <mailman.3743.1137101239.24926.mailscanner@lists.mailscanner.info>

On Wednesday, October 20, 2004 12:59 AM MailScanner mailing list wrote:

> So there wasn't any chance of the virus slipping through, it
> was just the reporting that was going astray.

Correct.

> After about 4 hours on this, I have finally found it and
> fixed it. Took some real digging, that one.
> It will be in the next release.

Wow. It was nasty but not _that_ important... :-) You should go to bed
earlier. 

> Many thanks for reporting it.

My pleasure. Thanks for fixing it that fast!

> Now I can go to bed :-)

*g*

Deeply impressed as always,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 07:15:35 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3744.1137101240.24926.mailscanner@lists.mailscanner.info>

> i might be stupid..

No. Confused maybe but not stupid.

> but the update-command to update antivir is still:
> 
> antivir --update
> 
> and not just antivir..

I think noone said otherwise. The error was/is that the script tried to
find the file "antivir --update" which simply is not there. 

Julian: The current 4.38 tarball still contains the buggy version. I
will fix this for the FreeBSD port but can you please doublecheck the
tarball for the next release? Thanks!

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Uwe.Krause at FEP.FRAUNHOFER.DE  Wed Oct 20 07:56:47 2004
From: Uwe.Krause at FEP.FRAUNHOFER.DE (Krause, Dr. Uwe)
Date: Thu Jan 12 21:27:20 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3745.1137101240.24926.mailscanner@lists.mailscanner.info>

Hi,

> Julian: The current 4.38 tarball still contains the buggy version. I
> will fix this for the FreeBSD port but can you please doublecheck the
> tarball for the next release? Thanks!

Where can i find the new version of antivir-autoupdate ?

Uwe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Q.G.Campbell at NEWCASTLE.AC.UK  Wed Oct 20 08:23:59 2004
From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell)
Date: Thu Jan 12 21:27:20 2006
Subject: Re. ZIP File problem
Message-ID: <mailman.3746.1137101240.24926.mailscanner@lists.mailscanner.info>

Appended is a statement of the ZIP File "problem" in case others have
not seen it.

It seems that a short-term defence would be to block ZIP files but that
could be very disruptive here.

Could Julian please clarify whether MailScanner is vulnerable to this
problem? If so what do we need to do to work around it?

We use two A-V products, McAfee and Sophos, and both appear to be
vulnerable. :-( 

Will check their sites this morning to see if there is any progress on
fixes from them.

Quentin
---
PHONE: +44 191 222 8209    Information Systems and Services (ISS),
                           University of Newcastle,
                           Newcastle upon Tyne,
FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
------------------------------------------------------------------------
"Any opinion expressed above is mine. The University can get its own."

 
------------------------------------------------- cut here
Subject: Multiple anti-virus software evasion

>From the Internet Storm Center 

Handlers Diary October 19th 2004
Updated October 20th 2004 01:05 UTC (Handler: Jason Lam) 

Multiple Anti-virus software evasion
Anti-virus software from McAfee, Computer Associates, Kaspersky, Sophos,
Eset and RAV are known to be vulnerable to an evasion attack where the
attacker is able to craft a compressed file (zip) with malicious code
and evade the scanning by anti-virus software.


The problem is caused by incorrect handling of header information within
the zip file. Some anti-virus software would skip the scan for files
that has zero size as indicated by the header. The header size
information does not affect the decompression of the zip file. 


Reference:
http://www.idefense.com/application/poi/display?id=153&type=vulnerabilit
ies&flashstatus=true 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 09:13:34 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3747.1137101240.24926.mailscanner@lists.mailscanner.info>

On Wednesday, October 20, 2004 8:57 AM MailScanner mailing list wrote:

> Where can i find the new version of antivir-autoupdate ?

Once the port is committed: In the portstree. It probably will be
version 4.38_1.

If you are not using FreeBSD you can apply this diff:

--- antivir-autoupdate.sample   Fri Oct 15 16:36:45 2004
+++ antivir-autoupdate  Tue Oct 19 15:41:39 2004
@@ -9,7 +9,8 @@
 
 $PackageDir = shift || "/usr/lib/AntiVir";
 
-$AntiVirUpdateCommand = "$PackageDir/antivir --update";
+$AntiVirCommand = "$PackageDir/antivir";
+$AntiVirUpdateCommand = "$AntiVirCommand --update";
 
 $LockFile = "/tmp/AntiVirBusy.lock";
 
@@ -24,7 +25,7 @@
 BailOut("Installation dir \"$PackageDir\" does not exist!")
   unless $PackageDir ne "" && -d $PackageDir;
 
-if (-x $AntiVirUpdateCommand) {
+if (-x $AntiVirCommand) {
   # Timeout prevention
   $SIG{ALRM} = sub { die "timeout"};
 


This should work.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 09:23:34 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: Re. ZIP File problem
Message-ID: <mailman.3748.1137101240.24926.mailscanner@lists.mailscanner.info>

On Wednesday, October 20, 2004 9:24 AM MailScanner mailing list wrote:

> Could Julian please clarify whether MailScanner is vulnerable
> to this problem? 

He already did in this thread. It is not. BUT: The virus scanners you
are using might be. I tried with

clamav, F-Secure, McAfee and Antivir. 

clamav --> caught all
F-Secure --> caught all
McAfee --> only one variant
Antivir --> only one variant

> If so what do we need to do to work around it?

Upgrade your virus scanners/sigs. If not possible: Disable ZIP.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 09:19:08 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Getting errors after loading
Message-ID: <mailman.3749.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Have you got a C compiler installed? Download GCC from www.sunfreeware.com
and install it. Remove any "cc" link that is in /usr/local/bin and make
sure that /usr/local/bin is early on your path.

Digest::SHA1 failed to install, that's the problem. Look in the output from
the installation script to find why it went wrong there.

At 02:57 20/10/2004, you wrote:
>Ran the Clamavmodule for Solaris 9 (x86 solaris version) listed under
>otherstuff. Used the non-rpm script as suggested to install perl modules and
>Spamassassin 3.0.  Script ran and looked good until the very last part:
>
>The error was:
>version.h.pl: version.h.pl: version.h.pl: version.h.pl: version.h.pl:
>version.h.pl: version.h.pl: Can't locate Digest/SHA1.pm in @INC (@INC
>contains: ../lib /usr/perl5/5.6.1/lib/i86pc-solaris-64int
>/usr/perl5/5.6.1/lib /usr/perl5/site_perl/5.6.1/i86pc-solaris-64int
>/usr/perl5/site_perl/5.6.1 /usr/perl5/site_perl
>/usr/perl5/vendor_perl/5.6.1/i86pc-solaris-64int
>/usr/perl5/vendor_perl/5.6.1 /usr/perl5/vendor_perl .) at
>../lib/Mail/SpamAssassin/EvalTests.pm line 33.
>BEGIN failed--compilation aborted at ../lib/Mail/SpamAssassin/EvalTests.pm
>line 33.
>Compilation failed in require at ../lib/Mail/SpamAssassin/PerMsgStatus.pm
>line 56.
>BEGIN failed--compilation aborted at
>../lib/Mail/SpamAssassin/PerMsgStatus.pm line 56.
>Compilation failed in require at ../lib/Mail/SpamAssassin.pm line 74.
>BEGIN failed--compilation aborted at ../lib/Mail/SpamAssassin.pm line 74.
>Compilation failed in require at version.h.pl line 27.
>*** Error code 2
>make: Fatal error: Command failed for target `spamc/Makefile'
>
>Tried to start MailScanner:
>Starting MailScanner...
>Can't locate MIME/Parser.pm in @INC (@INC contains: /opt/MailScanner/lib
>/usr/perl5/5.6.1/lib/i86pc-solaris-64int /usr/perl5/5.6.1/lib
>/usr/perl5/site_perl/5.6.1/i86pc-solaris-64int /usr/perl5/site_perl/5.6.1
>/usr/perl5/site_perl /usr/perl5/vendor_perl/5.6.1/i86pc-solaris-64int
>/usr/perl5/vendor_perl/5.6.1 /usr/perl5/vendor_perl . /opt/MailScanner/lib)
>at /opt/MailScanner/lib/MailScanner/MCPMessage.pm line 40.
>BEGIN failed--compilation aborted at
>/opt/MailScanner/lib/MailScanner/MCPMessage.pm line 40.
>Compilation failed in require at /opt/MailScanner/bin/MailScanner line 51.
>BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner line 51.
>
>Tried downloading Mime Parser and tools from CPAN Site but script still
>calls for other modules?
>
>Any ideas would be appreciated, could find little in the book to help with
>Solaris installs or online.
>
>Thanks
>William Lamoreaux
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 09:24:32 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Re. ZIP File problem
Message-ID: <mailman.3750.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 08:23 20/10/2004, you wrote:
>Appended is a statement of the ZIP File "problem" in case others have
>not seen it.

I worked on this last night using Sophos as the virus scanner, and it
detected it just fine. So I don't agree with their comments.

Unpacking zip files for the purpose of virus scanning is all down to the
virus scanning engines, it's not MailScanner's fault. The decompression
Perl module that MailScanner uses for unpacking for other content checking
(in this case just the "filetype" checks) is partly vulnerable. However, as
a 0-length file is created, the filename checks will still work, so you
should still be protected by the virus scanner and the filename checks. So
I don't consider this to be a serious problem that I need/can do much about.

>------------------------------------------------- cut here
>Subject: Multiple anti-virus software evasion
>
> >From the Internet Storm Center
>
>Handlers Diary October 19th 2004
>Updated October 20th 2004 01:05 UTC (Handler: Jason Lam)
>
>Multiple Anti-virus software evasion
>Anti-virus software from McAfee, Computer Associates, Kaspersky, Sophos,
>Eset and RAV are known to be vulnerable to an evasion attack where the
>attacker is able to craft a compressed file (zip) with malicious code
>and evade the scanning by anti-virus software.
>
>
>The problem is caused by incorrect handling of header information within
>the zip file. Some anti-virus software would skip the scan for files
>that has zero size as indicated by the header. The header size
>information does not affect the decompression of the zip file.
>
>
>Reference:
>http://www.idefense.com/application/poi/display?id=153&type=vulnerabilit
>ies&flashstatus=true

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 09:20:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: antivir-autoupdate broken ? (bug found - Solved)
Message-ID: <mailman.3751.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 07:15 20/10/2004, you wrote:
> > i might be stupid..
>
>No. Confused maybe but not stupid.
>
> > but the update-command to update antivir is still:
> >
> > antivir --update
> >
> > and not just antivir..
>
>I think noone said otherwise. The error was/is that the script tried to
>find the file "antivir --update" which simply is not there.
>
>Julian: The current 4.38 tarball still contains the buggy version. I
>will fix this for the FreeBSD port but can you please doublecheck the
>tarball for the next release? Thanks!

If I didn't post yesterday that I had found and fixed this problem, I
certainly meant to. It will be in the next release.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 10:35:27 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: OT: Which SpamAssassin rulesets for 3.0.0?
Message-ID: <mailman.3752.1137101240.24926.mailscanner@lists.mailscanner.info>

Hi,

I know this is off topic. Sorry. I did not find anything on the SA list
and really found no better or more trusted place to put/ask this.

After updating to SpamAssassin version 3 I am not sure what rulesets to
use anymore and which of these rules have already been incorporated in
the standard rules for 3.0.


I currently use the following rulesets:

70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
70_sare_genlsubj0.cf
70_sare_header0.cf
70_sare_html0.cf
70_sare_oem.cf
70_sare_random.cf
70_sare_specific.cf
70_sare_spoof.cf
70_sare_unsub.cf
70_sare_uri.cf
72_sare_bml_post25x.cf
72_sare_redirect_post3.0.0.cf
99_sare_fraud_post25x.cf
antidrug.cf
bogus-virus-warnings.cf
evilnumbers.cf
tripwire.cf


Opinions?

Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ediaz at PK25.COM  Wed Oct 20 10:38:41 2004
From: ediaz at PK25.COM (Diaz Rodriguez, Eduardo)
Date: Thu Jan 12 21:27:20 2006
Subject: MailScanner and webmail
Message-ID: <mailman.3753.1137101240.24926.mailscanner@lists.mailscanner.info>

I use openwebmail

www.openwebmail.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rc at ITSS.NERC.AC.UK  Wed Oct 20 10:28:46 2004
From: rc at ITSS.NERC.AC.UK (Ron Campbell)
Date: Thu Jan 12 21:27:20 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the authors
Message-ID: <mailman.3754.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian

   I guess that "contact the authors" means you !!

  Since upgrading to Clam 0.80, we have started seeing
messages like the following in our /var/log/maillog


  MailScanner[32597]: ProcessClamAVOutput: unrecognised line
"moc_sisl.cpp". Please contact the authors!

Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
unrecognised line "buildrun.log". Please contact the authors!

Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
unrecognised line "sisl.h". Please contact the authors!

Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
unrecognised line "main.cpp". Please contact the authors!

Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
unrecognised line "chap2.pro". Please contact the authors!

Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
unrecognised line "Makefile". Please contact the authors!

Oct 18 17:12:36 mailr-w MailScanner[27601]: ProcessClamAVOutput:
unrecognised line "./new_sample/pol19980518-0518_bbSPM.8bit". Please
contact the authors!


  This is version 4.30.3 of MailScanner.


                   Sorry about this ..  Ron

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From drew at THEMARSHALLS.CO.UK  Wed Oct 20 11:21:02 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:20 2006
Subject: OT: Which SpamAssassin rulesets for 3.0.0?
Message-ID: <mailman.3755.1137101240.24926.mailscanner@lists.mailscanner.info>

On Wed, October 20, 2004 10:35, Jan-Peter Koopmann said:
> Hi,

Hi JP
>
> I know this is off topic. Sorry. I did not find anything on the SA list
> and really found no better or more trusted place to put/ask this.
>
> After updating to SpamAssassin version 3 I am not sure what rulesets to
> use anymore and which of these rules have already been incorporated in
> the standard rules for 3.0.
>

I'm not going to be a huge help but had a similar question. I found having
a read of the rule sets again at http://www.rulesemporium.com/rules.htm
and picked off the ones that were not marked as now obsolete.

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 11:39:02 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: OT: Which SpamAssassin rulesets for 3.0.0?
Message-ID: <mailman.3756.1137101240.24926.mailscanner@lists.mailscanner.info>

> found having a read of the rule sets again at
> http://www.rulesemporium.com/rules.htm

Guess where I got my list from... :-)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Wed Oct 20 12:15:46 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:20 2006
Subject: OT: Which SpamAssassin rulesets for 3.0.0?
Message-ID: <mailman.3757.1137101240.24926.mailscanner@lists.mailscanner.info>

On Wed, October 20, 2004 11:39, Jan-Peter Koopmann said:
>> found having a read of the rule sets again at
>> http://www.rulesemporium.com/rules.htm
>
> Guess where I got my list from... :-)

As I say, not much help really am I?! :-) We must stop thinking alike and
then I'd be of some use ;-)


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 14:35:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.3758.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Please upgrade to the latest MailScanner first, I well might have already
sorted this.

At 10:28 20/10/2004, you wrote:
>Julian
>
>   I guess that "contact the authors" means you !!
>
>  Since upgrading to Clam 0.80, we have started seeing
>messages like the following in our /var/log/maillog
>
>
>  MailScanner[32597]: ProcessClamAVOutput: unrecognised line
>"moc_sisl.cpp". Please contact the authors!
>
>Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
>unrecognised line "buildrun.log". Please contact the authors!
>
>
>  This is version 4.30.3 of MailScanner.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Wed Oct 20 15:07:58 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3759.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Michele

my ratware says..


# Version: 02.00.01
# Created: 2004-03-25
# Modified: 2004-09-16
# Changes: Discontinued. All rules moved to other rules files.
# License: Artistic - see http://www.rulesemporium.com/license.txt
# Current Maintainer: by committee - ratware@rulesemporium.com
# Current Home: http://www.rulesemporium.com/rules/70_sare_ratware.cf



and no rules seem to mention the forged outlook anymore.....


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Michele Neylon :: Blacknight Solutions wrote:
> Just came across this minor bug.
> It looks like a recent patch to MS Outlook 2003 has changed the headers
> slightly, so you may be seeing:
> FORGED_MUA_OUTLOOK 2.17
> Turning up on valid emails ...
>
> Simple fix (courtesty of the fast thinking SA users list)
> In /etc/MailScanner/spam.assassin.prefs.conf
>
> Add in a line:
> score   FORGED_MUA_OUTLOOK 0.00
>
> Dirty hack but it will work
>
> Hopefully that will help someone else
>
> M
>
>
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Jan-Peter.Koopmann at SECEIDOS.DE  Wed Oct 20 16:23:08 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3760.1137101240.24926.mailscanner@lists.mailscanner.info>

> my ratware says..

I think he was referring to SA3 and the 20_ratware.cf there. And that
version says

# Outlook versions that usually use "dollar signs"
header __OUTLOOK_DOLLARS_MUA    X-Mailer =~ /^Microsoft Outlook(?: 8|
CWS, Build 9|, Build 10)\./
header __OUTLOOK_DOLLARS_OTHER  MESSAGEID =~ /^<\!\~\!/m
meta __FORGED_OUTLOOK_DOLLARS   (__OUTLOOK_DOLLARS_MUA &&
!__OUTLOOK_DOLLARS_MSGID && !__OUTLOOK_DOLLARS_OTHER && !__IMS_MSGID &&
!_
_UNUSABLE_MSGID)

# use new meta rules to implement FORGED_MUA_OUTLOOK rule from 2.60
meta FORGED_MUA_OUTLOOK         (__FORGED_OE ||
__FORGED_OUTLOOK_DOLLARS)
describe FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS
Outlook


etc.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct 20 16:17:23 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3761.1137101240.24926.mailscanner@lists.mailscanner.info>

> Michele
>
> my ratware says..
>
>
> # Version: 02.00.01
> # Created: 2004-03-25
> # Modified: 2004-09-16
> # Changes: Discontinued. All rules moved to other rules files.
> # License: Artistic - see http://www.rulesemporium.com/license.txt
> # Current Maintainer: by committee -
> ratware@rulesemporium.com # Current Home:
> http://www.rulesemporium.com/rules/70_sare_ratware.cf
>



Have a look in /usr/share/spamassassin

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Wed Oct 20 16:32:03 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3762.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
JP

ah yes Michele has moved over to the new stuff.

interesting that one of the newly included rules is causing problems -
mind you we had similar issues with a 2.x rule (the HABEAS signing abuse
by spammers), so nothing new I suppose.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Jan-Peter Koopmann wrote:
>>my ratware says..
>
>
> I think he was referring to SA3 and the 20_ratware.cf there. And that
> version says
>
> # Outlook versions that usually use "dollar signs"
> header __OUTLOOK_DOLLARS_MUA    X-Mailer =~ /^Microsoft Outlook(?: 8|
> CWS, Build 9|, Build 10)\./
> header __OUTLOOK_DOLLARS_OTHER  MESSAGEID =~ /^<\!\~\!/m
> meta __FORGED_OUTLOOK_DOLLARS   (__OUTLOOK_DOLLARS_MUA &&
> !__OUTLOOK_DOLLARS_MSGID && !__OUTLOOK_DOLLARS_OTHER && !__IMS_MSGID &&
> !_
> _UNUSABLE_MSGID)
>
> # use new meta rules to implement FORGED_MUA_OUTLOOK rule from 2.60
> meta FORGED_MUA_OUTLOOK         (__FORGED_OE ||
> __FORGED_OUTLOOK_DOLLARS)
> describe FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS
> Outlook
>
>
> etc.
>
> Regards,
>   JP
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From drew at THEMARSHALLS.CO.UK  Wed Oct 20 16:44:50 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3763.1137101240.24926.mailscanner@lists.mailscanner.info>

On Wed, October 20, 2004 16:32, Martin Hepworth said:
> interesting that one of the newly included rules is causing problems -
> mind you we had similar issues with a 2.x rule (the HABEAS signing abuse
> by spammers), so nothing new I suppose.

This has often happened to me with Outlook. Just about every time an
Outlook patch or new product is release the message id tag changes and
gets detected. For a while I had one sender keep triggering a similar rule
in SA 2.x. He was running Outlook 2002 and my SA version didn't like it.

So yes, nothing new ;-)

Drew


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From kte at NEXIS.BE  Wed Oct 20 14:43:22 2004
From: kte at NEXIS.BE (Koen Teugels)
Date: Thu Jan 12 21:27:20 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.3764.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I'm in the atest version of mailscannet en and rpm version of clamav
0.80.1 and I have the same messages.

Koen

Julian Field wrote:

> Please upgrade to the latest MailScanner first, I well might have already
> sorted this.
>
> At 10:28 20/10/2004, you wrote:
>
>> Julian
>>
>>   I guess that "contact the authors" means you !!
>>
>>  Since upgrading to Clam 0.80, we have started seeing
>> messages like the following in our /var/log/maillog
>>
>>
>>  MailScanner[32597]: ProcessClamAVOutput: unrecognised line
>> "moc_sisl.cpp". Please contact the authors!
>>
>> Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
>> unrecognised line "buildrun.log". Please contact the authors!
>>
>>
>>  This is version 4.30.3 of MailScanner.
>
>
> --
> Julian Field
> www.MailScanner.info
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct 20 14:59:37 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3765.1137101240.24926.mailscanner@lists.mailscanner.info>

Just came across this minor bug.
It looks like a recent patch to MS Outlook 2003 has changed the headers
slightly, so you may be seeing:
FORGED_MUA_OUTLOOK 2.17
Turning up on valid emails ...

Simple fix (courtesty of the fast thinking SA users list)
In /etc/MailScanner/spam.assassin.prefs.conf

Add in a line:
score   FORGED_MUA_OUTLOOK 0.00

Dirty hack but it will work

Hopefully that will help someone else

M


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mk at quadstone.com  Wed Oct 20 15:40:28 2004
From: mk at quadstone.com (Michael Keightley)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3766.1137101240.24926.mailscanner@lists.mailscanner.info>

Has anyone managed to get Mail-ClamAV-0.12 to work yet?
I can't get it to compile on Linux (SuSE 9.0 and 9.1, see error below).
Compiles OK on Solaris 8, but get this message from MailScanner in syslog:

Oct 20 11:18:22 mailhost MailScanner[21205]: Commercial virus checker failed with real error: Invalid function CL_ARCHIVE at /usr/local/lib/perl5/site_perl/5.6.1/sun4-solaris/Mail/ClamAV.pm line 83.

I had to revert to 0.11, which meant downgrading clamav to 0.75.1 from 0.80.

Error when compiling on Linux:


% make
/usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.12 blib/arch
Starting Build Prepocess Stage
Finished Build Prepocess Stage

Starting Build Parse Stage
Finished Build Parse Stage

Starting Build Glue 1 Stage
Finished Build Glue 1 Stage

Starting Build Glue 2 Stage
Finished Build Glue 2 Stage

Starting Build Glue 3 Stage
Finished Build Glue 3 Stage

Starting Build Compile Stage
  Starting "perl Makefile.PL" Stage
Writing Makefile for Mail::ClamAV
  Finished "perl Makefile.PL" Stage

  Starting "make" Stage
make[1]: Entering directory `/usr/local/src/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV'
/usr/bin/perl /usr/lib/perl5/5.8.1/ExtUtils/xsubpp  -typemap /usr/lib/perl5/5.8.1/ExtUtils/typemap   ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c
cc -c  -I/usr/local/src/Mail-ClamAV-0.12 -I/usr/local/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -fno-strict-aliasing -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -march=i586 -mcpu=i686 -fmessage-length=0 -Wall -pipe   -DVERSION=\"0.12\" -DXS_VERSION=\"0.12\" -fPIC "-I/usr/lib/perl5/5.8.1/i586-linux-thread-multi/CORE"   ClamAV.c
ClamAV.xs: In function `clamav_perl__scanbuff':
ClamAV.xs:166: warning: unused variable `ax'
ClamAV.xs:166: warning: unused variable `items'
ClamAV.xs:182: warning: statement with no effect
ClamAV.xs: In function `clamav_perl__scanfd':
ClamAV.xs:200: warning: unused variable `len'
ClamAV.xs:205: warning: unused variable `ax'
ClamAV.xs:205: warning: unused variable `items'
ClamAV.xs: In function `clamav_perl__scanfile':
ClamAV.xs:236: warning: unused variable `len'
ClamAV.xs:242: warning: unused variable `ax'
ClamAV.xs:242: warning: unused variable `items'
ClamAV.xs: In function `clamav_perl_constant':
ClamAV.xs:324: error: `CL_EFORMAT' undeclared (first use in this function)
ClamAV.xs:324: error: (Each undeclared identifier is reported only once
ClamAV.xs:324: error: for each function it appears in.)
ClamAV.xs:326: error: `CL_SCAN_RAW' undeclared (first use in this function)
ClamAV.xs:327: error: `CL_SCAN_ARCHIVE' undeclared (first use in this function)
ClamAV.xs:328: error: `CL_SCAN_MAIL' undeclared (first use in this function)
ClamAV.xs:329: error: `CL_SCAN_DISABLERAR' undeclared (first use in this function)
ClamAV.xs:330: error: `CL_SCAN_OLE2' undeclared (first use in this function)
ClamAV.xs:331: error: `CL_SCAN_BLOCKENCRYPTED' undeclared (first use in this function)
ClamAV.xs:332: error: `CL_SCAN_HTML' undeclared (first use in this function)
ClamAV.xs:333: error: `CL_SCAN_PE' undeclared (first use in this function)
ClamAV.xs:334: error: `CL_SCAN_BLOCKBROKEN' undeclared (first use in this function)
ClamAV.xs:335: error: `CL_SCAN_MAILURL' undeclared (first use in this function)
ClamAV.xs:336: error: `CL_SCAN_BLOCKMAX' undeclared (first use in this function)
ClamAV.xs:338: error: `CL_SCAN_STDOPT' undeclared (first use in this function)
make[1]: *** [ClamAV.o] Error 1
make[1]: Leaving directory `/usr/local/src/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV'

A problem was encountered while attempting to compile and install your Inline
C code. The command that failed was:
  make

The build directory was:
/usr/local/src/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV

To debug the problem, cd to the build directory, and inspect the output files.

 at /usr/local/src/Mail-ClamAV-0.12/blib/lib/Mail/ClamAV.pm line 164
BEGIN failed--compilation aborted at /usr/local/src/Mail-ClamAV-0.12/blib/lib/Mail/ClamAV.pm line 503.
Compilation failed in require.
BEGIN failed--compilation aborted.
make: *** [ClamAV.inl] Error 2
--
Michael Keightley <Michael.Keightley@quadstone.com>    Tel: +44 131 240 3137
Systems Manager, Quadstone Limited,                    Fax: +44 131 220 4492
16 Chester Street, Edinburgh EH3 7RA, Scotland         http://www.quadstone.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rcooper at DWFORD.COM  Wed Oct 20 16:32:50 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3767.1137101240.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Michael Keightley
> Sent: Wednesday, October 20, 2004 9:40 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Problems with latest Mail::ClamAV
>
>
> Has anyone managed to get Mail-ClamAV-0.12 to work yet?
> I can't get it to compile on Linux (SuSE 9.0 and 9.1, see error below).
> Compiles OK on Solaris 8, but get this message from MailScanner in syslog:
>
> Oct 20 11:18:22 mailhost MailScanner[21205]: Commercial virus
> checker failed with real error: Invalid function CL_ARCHIVE at
> /usr/local/lib/perl5/site_perl/5.6.1/sun4-solaris/Mail/ClamAV.pm line 83.
>
> I had to revert to 0.11, which meant downgrading clamav to 0.75.1
> from 0.80.
>
> Error when compiling on Linux:
>
>

I can't give you a direct patch to fix this because of other patches I have
on SweepViruses.pm but if you change the following:

CL_ARCHIVE      to CL_SCAN_ARCHIVE
CL_OLE2 to CL_SCAN_OLE2
CL_ENCRYPTED to CL_SCAN_BLOCKENCRYPTED

in /opt/MailScanner/lib/MailScanner/SweepViruses.pm

and reinstall Mail::ClamAV 0.12 you should be up and running. There is NO
backward compatablity between Mail::ClamAV 0.11 and 0.12 and you MUST have
clam 0.80 installed prior to installing Mail::ClamAV 0.12

As a note, I have encoutered problems with installing Mail::ClamAV 0.12 on
Fedora Core2, the make completes correctly without error but there is a
problem with the make test run. It "says" it can't find the file
/usr/local/lib/libclamav.so.1, which is right there where it's supposed to
be. Will be a week before I can look into it further, but tests from this
morning suggest it works regardless of the make test results.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From martinh at SOLID-STATE-LOGIC.COM  Wed Oct 20 16:41:51 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:20 2006
Subject: Headsup - 20_ratware.cf Outlook 2003
Message-ID: <mailman.3768.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Michele

I'm still running 2.64 so it's not there, mines in
/etc/mail/spamassassin as a userland add-in.

I forgot you were running mainly 3.0...


BTW I'm curious how you pronouce your name - Micheal, Mishell or
something something completely different..


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Michele Neylon :: Blacknight Solutions wrote:
>>Michele
>>
>>my ratware says..
>>
>>
>># Version: 02.00.01
>># Created: 2004-03-25
>># Modified: 2004-09-16
>># Changes: Discontinued. All rules moved to other rules files.
>># License: Artistic - see http://www.rulesemporium.com/license.txt
>># Current Maintainer: by committee -
>>ratware@rulesemporium.com # Current Home:
>>http://www.rulesemporium.com/rules/70_sare_ratware.cf
>>
>
>
>
>
> Have a look in /usr/share/spamassassin
>
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rcooper at DWFORD.COM  Wed Oct 20 17:30:31 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:20 2006
Subject: Mail::ClamAV 0.12 and Fedora Core 2
Message-ID: <mailman.3769.1137101240.24926.mailscanner@lists.mailscanner.info>

Just a note regarding my post mentioning a problem with the "make test" on
Fedora Core 2... the problem was obvious and ignorant. /usr/local/lib was
missing from /etc/ld.so.conf. Added the path, ran ldconfig and voila! make
test now completes without error.

FYI for anyone else running into this problem.

 Rick Cooper


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 18:02:23 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: ProcessClamAVOutput: unrecognised line ...    contact the
    authors
Message-ID: <mailman.3770.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have just tried this with the latest stable clamav and the latest
MailScanner and I can't reproduce your output.

Please can you do

/usr/lib/MailScanner/clamav-wrapper /usr/local -r --disable-summary --stdout .

Don't forget the "." on the end.
The "/usr/local" is the directory specified for clamav in
virus.scanners.conf, you might need to change this for your installation.

I get output like this:
/usr/local/etc/./clamav.conf: OK
/usr/local/etc/./freshclam.conf: OK
/usr/local/etc/./clamd.conf: OK
as I ran it from in /usr/local/etc.

At 14:43 20/10/2004, you wrote:
>I'm in the atest version of mailscannet en and rpm version of clamav
>0.80.1 and I have the same messages.
>
>Koen
>
>Julian Field wrote:
>
>>Please upgrade to the latest MailScanner first, I well might have already
>>sorted this.
>>
>>At 10:28 20/10/2004, you wrote:
>>
>>>Julian
>>>
>>>   I guess that "contact the authors" means you !!
>>>
>>>  Since upgrading to Clam 0.80, we have started seeing
>>>messages like the following in our /var/log/maillog
>>>
>>>
>>>  MailScanner[32597]: ProcessClamAVOutput: unrecognised line
>>>"moc_sisl.cpp". Please contact the authors!
>>>
>>>Oct 17 12:27:28 mailr-w MailScanner[32597]: ProcessClamAVOutput:
>>>unrecognised line "buildrun.log". Please contact the authors!
>>>
>>>
>>>  This is version 4.30.3 of MailScanner.
>>
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From billa at STERLING.NET  Wed Oct 20 18:18:32 2004
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3771.1137101240.24926.mailscanner@lists.mailscanner.info>

Hi,

I have been doing some digging on trying to understand how to fix my
"Unknown User" issue where Mailscanner is used as a gateway to other mail
servers.  My problem is that spam email destined to an unknown user on
another server serviced by my gateway, ends up piling up in my queues and I
end up sending an undeliverable message to innocent bystanders who are
unlucky enough to be in the forged from address.

I have seen several solutions mentioned in this list, however, none of them
quite fit my environment.  I am running Mailscanner and sendmail as a
gateway.  The gateway serves as a spam and virus filter for several diverse
/ non-integrated mail servers.  Here is what I have found as possible
solutions, but for some reason or another it doesnt quite solve my solution
in all cases.

1)  LDAP - many of the the servers don't support LDAP.  The ability to build
a comprehnsive LDAP server is outside of our scope.

2)  accessdb - can be done, but very time consuming trying to coordinate
with the other admins to get a complete list.

3)  Use something else other than sendmail - sendmail is all I have and
changing would be verrrrrry difficult.

Ok now that I have ruled out all of my options does anyone else have any
other ideas?  Here are some things I think I could use, but not sure if
Mailscanner or sendmail can do it.

1)  Is there anyway I can tell MailScanner and/or sendmail to not respond to
a 550 unknown user error?  Bascially Mailscanner tries to deliver an email
to an unknown user.  Once it gets the 550 error, it drops it.  I know the
downside of what if it was an honest mistake, the sender would not be
notified.  I would like to do this on a domain by domain basis.

2) Can I talk to multiple LDAP databases depending on what domain the
address is destined to.

3) Can the accessdb be integrated and used alongside the 2 items above?

Basically I need to do a combination of all 3 on the same server.  Any help
would be much appreciated.

Bill Anderson

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 18:27:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3772.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
There is a tweak on option (1). You can use the LDAP routing setup, without
*actually* using LDAP to build it. So you could have a script run from cron
that queried each of the servers somehow, and built a local db file of all
the valid addresses it should accept mail for. Then you use the LDAP
routing setup to use this local db file.

At 18:18 20/10/2004, you wrote:
>1)  LDAP - many of the the servers don't support LDAP.  The ability to build
>a comprehnsive LDAP server is outside of our scope.
>
>1)  Is there anyway I can tell MailScanner and/or sendmail to not respond to
>a 550 unknown user error?  Bascially Mailscanner tries to deliver an email
>to an unknown user.  Once it gets the 550 error, it drops it.  I know the
>downside of what if it was an honest mistake, the sender would not be
>notified.  I would like to do this on a domain by domain basis.
>
>2) Can I talk to multiple LDAP databases depending on what domain the
>address is destined to.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From billa at STERLING.NET  Wed Oct 20 18:47:54 2004
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3773.1137101240.24926.mailscanner@lists.mailscanner.info>

When you say local db file, are you refering to the accessdb file in
sendmail?  So, if I can paraphrase what you just said.  Using some sort of
script that get's a list of emails from the various email servers, some
LDAP, some not.  Compile this list into an accessdb file for use by
sendmail?

Is there anyway to have sendmail / mailscanner drop 550 errors it receives
from the other mail servers?  I want to fix my short term problem.

Thanks.


----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 20, 2004 10:27 AM
Subject: Re: Unknown user again


> There is a tweak on option (1). You can use the LDAP routing setup,
without
> *actually* using LDAP to build it. So you could have a script run from
cron
> that queried each of the servers somehow, and built a local db file of all
> the valid addresses it should accept mail for. Then you use the LDAP
> routing setup to use this local db file.
>
> At 18:18 20/10/2004, you wrote:
> >1)  LDAP - many of the the servers don't support LDAP.  The ability to
build
> >a comprehnsive LDAP server is outside of our scope.
> >
> >1)  Is there anyway I can tell MailScanner and/or sendmail to not respond
to
> >a 550 unknown user error?  Bascially Mailscanner tries to deliver an
email
> >to an unknown user.  Once it gets the 550 error, it drops it.  I know the
> >downside of what if it was an honest mistake, the sender would not be
> >notified.  I would like to do this on a domain by domain basis.
> >
> >2) Can I talk to multiple LDAP databases depending on what domain the
> >address is destined to.
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From admin at thenamegame.com  Wed Oct 20 18:49:53 2004
From: admin at thenamegame.com (Michael Freeman)
Date: Thu Jan 12 21:27:20 2006
Subject: Im still get db errors from 4.3.38 & SA3.0
Message-ID: <mailman.3774.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-html>
<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman";}
a:link, span.MsoHyperlink
        {color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-compose;
        font-family:Arial;
        color:windowtext;}
@page Section1
        {size:8.5in 11.0in;
        margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
        {page:Section1;}
-->
</style>

</head>

<body lang=EN-US link=blue vlink=purple>

<div class=Section1>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Im running Spamassassin 3.0 and MailScanner on all boxes.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>All my other servers are running MailScanner 4.31.6 and do
not have db issues and perl 5.81<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>We are running MailScanner 4.3.38 and perl 5.8.4 on only one
server at the moment and consistently keep get errors saying<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>MailScanner E-Mail Virus Scanner version 4.34.8 starting... <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Oct 20 13:40:49 srv08 spamd[7878]: bayes: bayes db version 0
is not able to be used, aborting! at
/usr/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin/BayesStore/DBM.pm line 160.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Is this an incompatibility between perl or SA3.0 or is this
an issue with MailScanner 4.34.8 and SA3.0 + Perl 5.8.4.<o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I just don&#8217;t understand why we cannot stabilize this
error message. <o:p></o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p>&nbsp;</o:p></span></font></p>

</div>

</body>

</html>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From ssilva at SGVWATER.COM  Wed Oct 20 18:23:47 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:20 2006
Subject: why rewrite From header?
Message-ID: <mailman.3775.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tim Myers wrote:
| Matt Kettler wrote:
|
|> At 02:28 PM 10/19/2004, Tim Myers wrote:
|>
|>> Our web server uses DNS CNAME entries for its virtual hosts. Messages
|>> sent
|>> from those virtual hosts are having their From: headers rewritten
|>> using the
|>> A record hostname.
|>
|>
|> Are you sure they are being rewritten and aren't being written that
|> way in
|> the first place? Are you sure they contained the cnamed hostname in the
|> From: header when they were queued?
|
|
| Yes, they are being rewritten. But, I just eliminated MailScanner as the
| culprit. Something in sendmail is the only thing left to check.
|
| I had several possible culprits and only posted when it was down to
| sendmail and MailScanner. I just assumed that a vanilla install of
| sendmail couldn't be the problem.
|
| Sorry to bother everyone.
|
Look at your sendmail.mc file. It is one of the "Masquerade" features.
There are 3 or 4 in there.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBdp8jRADw9lziUqQRAg/8AJ9m83iPxBauffQidI0xoKFxYsjuGwCfVcCB
DddWNbDDfEknoDqmPwPa1zc=
=TO1y
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 19:02:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Im still get db errors from 4.3.38 & SA3.0
Message-ID: <mailman.3776.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:49 20/10/2004, you wrote:
>Im running Spamassassin 3.0 and MailScanner on all boxes.
>
>All my other servers are running MailScanner 4.31.6 and do not have db
>issues and perl 5.81
>
>We are running MailScanner 4.3.38 and perl 5.8.4 on only one server at the
>moment and consistently keep get errors saying
>
>MailScanner E-Mail Virus Scanner version 4.34.8 starting...
>Oct 20 13:40:49 srv08 spamd[7878]: bayes: bayes db version 0 is not able
>to be used, aborting! at
>/usr/lib/perl5/site_perl/5.8.4/Mail/SpamAssassin/BayesStore/DBM.pm line 160.

Make sure you have the Perl module DB_File installed and that you have done
an "sa-learn --sync" to convert the database to the new SA3 format.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 19:01:36 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3777.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:47 20/10/2004, you wrote:
>When you say local db file, are you refering to the accessdb file in
>sendmail?

No, a separate one created for the job.

>   So, if I can paraphrase what you just said.  Using some sort of
>script that get's a list of emails from the various email servers, some
>LDAP, some not.  Compile this list into an accessdb file for use by
>sendmail?

Not into an accessdb, but into a db file that describes where to send email
for all of your users. It's basically all in the FAQ at
http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
The setup described there is for getting a routing database out of an
Exchange server running Active Directory, but the sendmail setup is exactly
the same.

>Is there anyway to have sendmail / mailscanner drop 550 errors it receives
>from the other mail servers?  I want to fix my short term problem.

Yes, by doing this. If the rcpt address isn't in the ldap (but actually a
db file) routing table, the message gets rejected at SMTP time.

>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Wednesday, October 20, 2004 10:27 AM
>Subject: Re: Unknown user again
>
>
> > There is a tweak on option (1). You can use the LDAP routing setup,
>without
> > *actually* using LDAP to build it. So you could have a script run from
>cron
> > that queried each of the servers somehow, and built a local db file of all
> > the valid addresses it should accept mail for. Then you use the LDAP
> > routing setup to use this local db file.
> >
> > At 18:18 20/10/2004, you wrote:
> > >1)  LDAP - many of the the servers don't support LDAP.  The ability to
>build
> > >a comprehnsive LDAP server is outside of our scope.
> > >
> > >1)  Is there anyway I can tell MailScanner and/or sendmail to not respond
>to
> > >a 550 unknown user error?  Bascially Mailscanner tries to deliver an
>email
> > >to an unknown user.  Once it gets the 550 error, it drops it.  I know the
> > >downside of what if it was an honest mistake, the sender would not be
> > >notified.  I would like to do this on a domain by domain basis.
> > >
> > >2) Can I talk to multiple LDAP databases depending on what domain the
> > >address is destined to.
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From billa at STERLING.NET  Wed Oct 20 19:21:41 2004
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3778.1137101240.24926.mailscanner@lists.mailscanner.info>

Thank you for the responses so far.  I apologize for being  a little dense,
so please bear with me.

I think I have the LDAP part down.

My other question is somewhat different of the LDAP question above.  I think
I understand that doing the LDAP routing piece will fix my problem, however,
it will take some time to get it going.  The short term fix I was looking
for is the ability to have mailscanner or sendmail after it has tried to
relay an email to another server where the user does not exist, to not try
and reply back to the sender that the address does not exist.  Basically my
servers are accepting all email for a domain, scanning it, then forwarding
it on.  In 50% of the cases, the email is destined to a non-existant address
and I get a 550 message, so I try to send it back to the sender.  For now I
just want to drop all of those when I get the 550 back.  I still will accept
and scan all email destined for that domain.  I know it is not perfect, but
I will stop spamming others with my "unknown user" replies.

Thanks for bearing with me.

bill anderson

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 20, 2004 11:01 AM
Subject: Re: Unknown user again


> At 18:47 20/10/2004, you wrote:
> >When you say local db file, are you refering to the accessdb file in
> >sendmail?
>
> No, a separate one created for the job.
>
> >   So, if I can paraphrase what you just said.  Using some sort of
> >script that get's a list of emails from the various email servers, some
> >LDAP, some not.  Compile this list into an accessdb file for use by
> >sendmail?
>
> Not into an accessdb, but into a db file that describes where to send
email
> for all of your users. It's basically all in the FAQ at
> http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
> The setup described there is for getting a routing database out of an
> Exchange server running Active Directory, but the sendmail setup is
exactly
> the same.
>
> >Is there anyway to have sendmail / mailscanner drop 550 errors it
receives
> >from the other mail servers?  I want to fix my short term problem.
>
> Yes, by doing this. If the rcpt address isn't in the ldap (but actually a
> db file) routing table, the message gets rejected at SMTP time.
>
> >----- Original Message -----
> >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> >To: <MAILSCANNER@JISCMAIL.AC.UK>
> >Sent: Wednesday, October 20, 2004 10:27 AM
> >Subject: Re: Unknown user again
> >
> >
> > > There is a tweak on option (1). You can use the LDAP routing setup,
> >without
> > > *actually* using LDAP to build it. So you could have a script run from
> >cron
> > > that queried each of the servers somehow, and built a local db file of
all
> > > the valid addresses it should accept mail for. Then you use the LDAP
> > > routing setup to use this local db file.
> > >
> > > At 18:18 20/10/2004, you wrote:
> > > >1)  LDAP - many of the the servers don't support LDAP.  The ability
to
> >build
> > > >a comprehnsive LDAP server is outside of our scope.
> > > >
> > > >1)  Is there anyway I can tell MailScanner and/or sendmail to not
respond
> >to
> > > >a 550 unknown user error?  Bascially Mailscanner tries to deliver an
> >email
> > > >to an unknown user.  Once it gets the 550 error, it drops it.  I know
the
> > > >downside of what if it was an honest mistake, the sender would not be
> > > >notified.  I would like to do this on a domain by domain basis.
> > > >
> > > >2) Can I talk to multiple LDAP databases depending on what domain the
> > > >address is destined to.
> > >
> > > --
> > > Julian Field
> > > www.MailScanner.info
> > > Professional Support Services at www.MailScanner.biz
> > > MailScanner thanks transtec Computers for their support
> > > Buy the MailScanner book at www.MailScanner.info/store
> > >
> > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> > >
> > > ------------------------ MailScanner list ------------------------
> > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > 'leave mailscanner' in the body of the email.
> > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > >
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 19:37:27 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3779.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Okay, there's a different approach you could use for what you explain below.

What you can do is write a tiny little Custom Function in MailScanner that
looks at the subject line of the message, and if it is along the lines of
"Returned mail: see transcript for details" or "Delivery Status
Notification \(Failure\)" then put the outgoing message in a queue you
never deliver. There are many ways of achieving the same effect in
MailScanner, this just happens to be very similar to one I wrote earlier
this week for my own site.

What I wanted to do was to put all delivery failure messages in a queue
that is run a lot slower than the main outgoing queue.

You could use the same thing, but with a cron job that just deletes all the
files in the extra queue every hour or so.

If you want to see how to do that, reply to this and confirm that this will
solve your problem for now. I don't want to post (and write) a whole bunch
of code and setup for you if it's not what you want.

At 19:21 20/10/2004, you wrote:
>Thank you for the responses so far.  I apologize for being  a little dense,
>so please bear with me.
>
>I think I have the LDAP part down.
>
>My other question is somewhat different of the LDAP question above.  I think
>I understand that doing the LDAP routing piece will fix my problem, however,
>it will take some time to get it going.  The short term fix I was looking
>for is the ability to have mailscanner or sendmail after it has tried to
>relay an email to another server where the user does not exist, to not try
>and reply back to the sender that the address does not exist.  Basically my
>servers are accepting all email for a domain, scanning it, then forwarding
>it on.  In 50% of the cases, the email is destined to a non-existant address
>and I get a 550 message, so I try to send it back to the sender.  For now I
>just want to drop all of those when I get the 550 back.  I still will accept
>and scan all email destined for that domain.  I know it is not perfect, but
>I will stop spamming others with my "unknown user" replies.
>
>Thanks for bearing with me.
>
>bill anderson
>
>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Wednesday, October 20, 2004 11:01 AM
>Subject: Re: Unknown user again
>
>
> > At 18:47 20/10/2004, you wrote:
> > >When you say local db file, are you refering to the accessdb file in
> > >sendmail?
> >
> > No, a separate one created for the job.
> >
> > >   So, if I can paraphrase what you just said.  Using some sort of
> > >script that get's a list of emails from the various email servers, some
> > >LDAP, some not.  Compile this list into an accessdb file for use by
> > >sendmail?
> >
> > Not into an accessdb, but into a db file that describes where to send
>email
> > for all of your users. It's basically all in the FAQ at
> > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
> > The setup described there is for getting a routing database out of an
> > Exchange server running Active Directory, but the sendmail setup is
>exactly
> > the same.
> >
> > >Is there anyway to have sendmail / mailscanner drop 550 errors it
>receives
> > >from the other mail servers?  I want to fix my short term problem.
> >
> > Yes, by doing this. If the rcpt address isn't in the ldap (but actually a
> > db file) routing table, the message gets rejected at SMTP time.
> >
> > >----- Original Message -----
> > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > >Sent: Wednesday, October 20, 2004 10:27 AM
> > >Subject: Re: Unknown user again
> > >
> > >
> > > > There is a tweak on option (1). You can use the LDAP routing setup,
> > >without
> > > > *actually* using LDAP to build it. So you could have a script run from
> > >cron
> > > > that queried each of the servers somehow, and built a local db file of
>all
> > > > the valid addresses it should accept mail for. Then you use the LDAP
> > > > routing setup to use this local db file.
> > > >
> > > > At 18:18 20/10/2004, you wrote:
> > > > >1)  LDAP - many of the the servers don't support LDAP.  The ability
>to
> > >build
> > > > >a comprehnsive LDAP server is outside of our scope.
> > > > >
> > > > >1)  Is there anyway I can tell MailScanner and/or sendmail to not
>respond
> > >to
> > > > >a 550 unknown user error?  Bascially Mailscanner tries to deliver an
> > >email
> > > > >to an unknown user.  Once it gets the 550 error, it drops it.  I know
>the
> > > > >downside of what if it was an honest mistake, the sender would not be
> > > > >notified.  I would like to do this on a domain by domain basis.
> > > > >
> > > > >2) Can I talk to multiple LDAP databases depending on what domain the
> > > > >address is destined to.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From billa at STERLING.NET  Wed Oct 20 19:40:22 2004
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3780.1137101240.24926.mailscanner@lists.mailscanner.info>

That is exaclty what I want!

Thanks.

bill anderson


----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 20, 2004 11:37 AM
Subject: Re: Unknown user again


> Okay, there's a different approach you could use for what you explain
below.
>
> What you can do is write a tiny little Custom Function in MailScanner that
> looks at the subject line of the message, and if it is along the lines of
> "Returned mail: see transcript for details" or "Delivery Status
> Notification \(Failure\)" then put the outgoing message in a queue you
> never deliver. There are many ways of achieving the same effect in
> MailScanner, this just happens to be very similar to one I wrote earlier
> this week for my own site.
>
> What I wanted to do was to put all delivery failure messages in a queue
> that is run a lot slower than the main outgoing queue.
>
> You could use the same thing, but with a cron job that just deletes all
the
> files in the extra queue every hour or so.
>
> If you want to see how to do that, reply to this and confirm that this
will
> solve your problem for now. I don't want to post (and write) a whole bunch
> of code and setup for you if it's not what you want.
>
> At 19:21 20/10/2004, you wrote:
> >Thank you for the responses so far.  I apologize for being  a little
dense,
> >so please bear with me.
> >
> >I think I have the LDAP part down.
> >
> >My other question is somewhat different of the LDAP question above.  I
think
> >I understand that doing the LDAP routing piece will fix my problem,
however,
> >it will take some time to get it going.  The short term fix I was looking
> >for is the ability to have mailscanner or sendmail after it has tried to
> >relay an email to another server where the user does not exist, to not
try
> >and reply back to the sender that the address does not exist.  Basically
my
> >servers are accepting all email for a domain, scanning it, then
forwarding
> >it on.  In 50% of the cases, the email is destined to a non-existant
address
> >and I get a 550 message, so I try to send it back to the sender.  For now
I
> >just want to drop all of those when I get the 550 back.  I still will
accept
> >and scan all email destined for that domain.  I know it is not perfect,
but
> >I will stop spamming others with my "unknown user" replies.
> >
> >Thanks for bearing with me.
> >
> >bill anderson
> >
> >----- Original Message -----
> >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> >To: <MAILSCANNER@JISCMAIL.AC.UK>
> >Sent: Wednesday, October 20, 2004 11:01 AM
> >Subject: Re: Unknown user again
> >
> >
> > > At 18:47 20/10/2004, you wrote:
> > > >When you say local db file, are you refering to the accessdb file in
> > > >sendmail?
> > >
> > > No, a separate one created for the job.
> > >
> > > >   So, if I can paraphrase what you just said.  Using some sort of
> > > >script that get's a list of emails from the various email servers,
some
> > > >LDAP, some not.  Compile this list into an accessdb file for use by
> > > >sendmail?
> > >
> > > Not into an accessdb, but into a db file that describes where to send
> >email
> > > for all of your users. It's basically all in the FAQ at
> > > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
> > > The setup described there is for getting a routing database out of an
> > > Exchange server running Active Directory, but the sendmail setup is
> >exactly
> > > the same.
> > >
> > > >Is there anyway to have sendmail / mailscanner drop 550 errors it
> >receives
> > > >from the other mail servers?  I want to fix my short term problem.
> > >
> > > Yes, by doing this. If the rcpt address isn't in the ldap (but
actually a
> > > db file) routing table, the message gets rejected at SMTP time.
> > >
> > > >----- Original Message -----
> > > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > > >Sent: Wednesday, October 20, 2004 10:27 AM
> > > >Subject: Re: Unknown user again
> > > >
> > > >
> > > > > There is a tweak on option (1). You can use the LDAP routing
setup,
> > > >without
> > > > > *actually* using LDAP to build it. So you could have a script run
from
> > > >cron
> > > > > that queried each of the servers somehow, and built a local db
file of
> >all
> > > > > the valid addresses it should accept mail for. Then you use the
LDAP
> > > > > routing setup to use this local db file.
> > > > >
> > > > > At 18:18 20/10/2004, you wrote:
> > > > > >1)  LDAP - many of the the servers don't support LDAP.  The
ability
> >to
> > > >build
> > > > > >a comprehnsive LDAP server is outside of our scope.
> > > > > >
> > > > > >1)  Is there anyway I can tell MailScanner and/or sendmail to not
> >respond
> > > >to
> > > > > >a 550 unknown user error?  Bascially Mailscanner tries to deliver
an
> > > >email
> > > > > >to an unknown user.  Once it gets the 550 error, it drops it.  I
know
> >the
> > > > > >downside of what if it was an honest mistake, the sender would
not be
> > > > > >notified.  I would like to do this on a domain by domain basis.
> > > > > >
> > > > > >2) Can I talk to multiple LDAP databases depending on what domain
the
> > > > > >address is destined to.
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at ZANKER.ORG  Wed Oct 20 20:00:47 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3781.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 20 October 2004 15:40 +0100 Michael Keightley <mk@QUADSTONE.COM>
wrote:

> I had to revert to 0.11, which meant downgrading clamav to 0.75.1
> from 0.80.

0.80 works fine for me with Mail::ClamAV 0.11.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From jaearick at COLBY.EDU  Wed Oct 20 20:01:32 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3782.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Rick,
    Many thanks for this pointer.  I went from Mail::ClamAV 0.11 to 0.12
today as a result of this message (I had installed clam 0.80 on Monday),
and had the same failures in Solaris 9.  Your tweaks to SweepViruses.pm
fixed the problem.

Julian,
    Maybe the next release of MS should require Mail::ClamAV 0.12 and
clam 0.80 (for the clam users)?

Jeff Earickson
Colby College

On Wed, 20 Oct 2004, Rick Cooper wrote:

>
> I can't give you a direct patch to fix this because of other patches I have
> on SweepViruses.pm but if you change the following:
>
> CL_ARCHIVE      to CL_SCAN_ARCHIVE
> CL_OLE2 to CL_SCAN_OLE2
> CL_ENCRYPTED to CL_SCAN_BLOCKENCRYPTED
>
> in /opt/MailScanner/lib/MailScanner/SweepViruses.pm
>
> and reinstall Mail::ClamAV 0.12 you should be up and running. There is NO
> backward compatablity between Mail::ClamAV 0.11 and 0.12 and you MUST have
> clam 0.80 installed prior to installing Mail::ClamAV 0.12
>
> As a note, I have encoutered problems with installing Mail::ClamAV 0.12 on
> Fedora Core2, the make completes correctly without error but there is a
> problem with the make test run. It "says" it can't find the file
> /usr/local/lib/libclamav.so.1, which is right there where it's supposed to
> be. Will be a week before I can look into it further, but tests from this
> morning suggest it works regardless of the make test results.
>
> Rick
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sanjay.patel at REXWIRE.COM  Wed Oct 20 20:38:36 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:20 2006
Subject: Quick way to stop SpamD
Message-ID: <mailman.3783.1137101240.24926.mailscanner@lists.mailscanner.info>

Does anyone have a quick command to stop SpamD. If I kill the spamD pid it
just generates another.

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From billa at STERLING.NET  Wed Oct 20 20:41:26 2004
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3784.1137101240.24926.mailscanner@lists.mailscanner.info>

I don't know if you need this, but we are running version 4.28.6 of
MailScanner.

bill anderson
----- Original Message -----
From: "Bill Anderson" <billa@STERLING.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 20, 2004 11:40 AM
Subject: Re: Unknown user again


> That is exaclty what I want!
>
> Thanks.
>
> bill anderson
>
>
> ----- Original Message -----
> From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Wednesday, October 20, 2004 11:37 AM
> Subject: Re: Unknown user again
>
>
> > Okay, there's a different approach you could use for what you explain
> below.
> >
> > What you can do is write a tiny little Custom Function in MailScanner
that
> > looks at the subject line of the message, and if it is along the lines
of
> > "Returned mail: see transcript for details" or "Delivery Status
> > Notification \(Failure\)" then put the outgoing message in a queue you
> > never deliver. There are many ways of achieving the same effect in
> > MailScanner, this just happens to be very similar to one I wrote earlier
> > this week for my own site.
> >
> > What I wanted to do was to put all delivery failure messages in a queue
> > that is run a lot slower than the main outgoing queue.
> >
> > You could use the same thing, but with a cron job that just deletes all
> the
> > files in the extra queue every hour or so.
> >
> > If you want to see how to do that, reply to this and confirm that this
> will
> > solve your problem for now. I don't want to post (and write) a whole
bunch
> > of code and setup for you if it's not what you want.
> >
> > At 19:21 20/10/2004, you wrote:
> > >Thank you for the responses so far.  I apologize for being  a little
> dense,
> > >so please bear with me.
> > >
> > >I think I have the LDAP part down.
> > >
> > >My other question is somewhat different of the LDAP question above.  I
> think
> > >I understand that doing the LDAP routing piece will fix my problem,
> however,
> > >it will take some time to get it going.  The short term fix I was
looking
> > >for is the ability to have mailscanner or sendmail after it has tried
to
> > >relay an email to another server where the user does not exist, to not
> try
> > >and reply back to the sender that the address does not exist.
Basically
> my
> > >servers are accepting all email for a domain, scanning it, then
> forwarding
> > >it on.  In 50% of the cases, the email is destined to a non-existant
> address
> > >and I get a 550 message, so I try to send it back to the sender.  For
now
> I
> > >just want to drop all of those when I get the 550 back.  I still will
> accept
> > >and scan all email destined for that domain.  I know it is not perfect,
> but
> > >I will stop spamming others with my "unknown user" replies.
> > >
> > >Thanks for bearing with me.
> > >
> > >bill anderson
> > >
> > >----- Original Message -----
> > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > >Sent: Wednesday, October 20, 2004 11:01 AM
> > >Subject: Re: Unknown user again
> > >
> > >
> > > > At 18:47 20/10/2004, you wrote:
> > > > >When you say local db file, are you refering to the accessdb file
in
> > > > >sendmail?
> > > >
> > > > No, a separate one created for the job.
> > > >
> > > > >   So, if I can paraphrase what you just said.  Using some sort of
> > > > >script that get's a list of emails from the various email servers,
> some
> > > > >LDAP, some not.  Compile this list into an accessdb file for use by
> > > > >sendmail?
> > > >
> > > > Not into an accessdb, but into a db file that describes where to
send
> > >email
> > > > for all of your users. It's basically all in the FAQ at
> > > > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
> > > > The setup described there is for getting a routing database out of
an
> > > > Exchange server running Active Directory, but the sendmail setup is
> > >exactly
> > > > the same.
> > > >
> > > > >Is there anyway to have sendmail / mailscanner drop 550 errors it
> > >receives
> > > > >from the other mail servers?  I want to fix my short term problem.
> > > >
> > > > Yes, by doing this. If the rcpt address isn't in the ldap (but
> actually a
> > > > db file) routing table, the message gets rejected at SMTP time.
> > > >
> > > > >----- Original Message -----
> > > > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > > > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > > > >Sent: Wednesday, October 20, 2004 10:27 AM
> > > > >Subject: Re: Unknown user again
> > > > >
> > > > >
> > > > > > There is a tweak on option (1). You can use the LDAP routing
> setup,
> > > > >without
> > > > > > *actually* using LDAP to build it. So you could have a script
run
> from
> > > > >cron
> > > > > > that queried each of the servers somehow, and built a local db
> file of
> > >all
> > > > > > the valid addresses it should accept mail for. Then you use the
> LDAP
> > > > > > routing setup to use this local db file.
> > > > > >
> > > > > > At 18:18 20/10/2004, you wrote:
> > > > > > >1)  LDAP - many of the the servers don't support LDAP.  The
> ability
> > >to
> > > > >build
> > > > > > >a comprehnsive LDAP server is outside of our scope.
> > > > > > >
> > > > > > >1)  Is there anyway I can tell MailScanner and/or sendmail to
not
> > >respond
> > > > >to
> > > > > > >a 550 unknown user error?  Bascially Mailscanner tries to
deliver
> an
> > > > >email
> > > > > > >to an unknown user.  Once it gets the 550 error, it drops it.
I
> know
> > >the
> > > > > > >downside of what if it was an honest mistake, the sender would
> not be
> > > > > > >notified.  I would like to do this on a domain by domain basis.
> > > > > > >
> > > > > > >2) Can I talk to multiple LDAP databases depending on what
domain
> the
> > > > > > >address is destined to.
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dbird at SGHMS.AC.UK  Wed Oct 20 20:42:54 2004
From: dbird at SGHMS.AC.UK (Daniel Bird)
Date: Thu Jan 12 21:27:20 2006
Subject: Quick way to stop SpamD
Message-ID: <mailman.3785.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Sanjay K. Patel wrote:

>Does anyone have a quick command to stop SpamD. If I kill the spamD pid it
>just generates another.
>
>
>
pkill -9 spamd

but why is it running in the first place? MailScanner doesn't use spamd.

Dan

>-SKP
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ugob at CAMO-ROUTE.COM  Wed Oct 20 20:48:40 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:20 2006
Subject: Quick way to stop SpamD
Message-ID: <mailman.3786.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Sanjay K. Patel wrote:
> Does anyone have a quick command to stop SpamD. If I kill the spamD pid it
> just generates another.

What OS?

Is there a script in /etc/init.d/ ?

>
> -SKP
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 20:05:18 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3787.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:01 20/10/2004, you wrote:
>Julian,
>    Maybe the next release of MS should require Mail::ClamAV 0.12 and
>clam 0.80 (for the clam users)?

I will make sure that Mail::ClamAV is at least 0.12.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 21:17:29 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3788.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Does Mail::ClamAV 0.12 work with ClamAV 0.75?
If not, I'm going to have to wait for Dag Wieers to produce RPMs for ClamAV
0.80.

I now don't support Mail::ClamAV 0.11 any more. You will get a fatal error
if you try to use "clamavmodule" with Mail::ClamAV 0.11 or less.

Thanks to Rick Cooper for supplying the info below.

At 20:01 20/10/2004, you wrote:
>Rick,
>    Many thanks for this pointer.  I went from Mail::ClamAV 0.11 to 0.12
>today as a result of this message (I had installed clam 0.80 on Monday),
>and had the same failures in Solaris 9.  Your tweaks to SweepViruses.pm
>fixed the problem.
>
>Julian,
>    Maybe the next release of MS should require Mail::ClamAV 0.12 and
>clam 0.80 (for the clam users)?
>
>Jeff Earickson
>Colby College
>
>On Wed, 20 Oct 2004, Rick Cooper wrote:
>
>>
>>I can't give you a direct patch to fix this because of other patches I have
>>on SweepViruses.pm but if you change the following:
>>
>>CL_ARCHIVE      to CL_SCAN_ARCHIVE
>>CL_OLE2 to CL_SCAN_OLE2
>>CL_ENCRYPTED to CL_SCAN_BLOCKENCRYPTED
>>
>>in /opt/MailScanner/lib/MailScanner/SweepViruses.pm
>>
>>and reinstall Mail::ClamAV 0.12 you should be up and running. There is NO
>>backward compatablity between Mail::ClamAV 0.11 and 0.12 and you MUST have
>>clam 0.80 installed prior to installing Mail::ClamAV 0.12
>>
>>As a note, I have encoutered problems with installing Mail::ClamAV 0.12 on
>>Fedora Core2, the make completes correctly without error but there is a
>>problem with the make test run. It "says" it can't find the file
>>/usr/local/lib/libclamav.so.1, which is right there where it's supposed to
>>be. Will be a week before I can look into it further, but tests from this
>>morning suggest it works regardless of the make test results.
>>
>>Rick

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Wed Oct 20 20:09:56 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3789.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Okay, here goes.

In /etc/MailScanner/MailScanner.conf, put this
Outgoing Queue Dir = &OutgoingQueue

In /usr/lib/MailScanner/MailScanner/CustomConfig.pm, add this near the top
-----SNIP-----
my $DefaultQueue = '/var/spool/mqueue';
my $SlowQueue    = '/var/spool/mqueue.slow';

sub InitOutgoingQueue {
   # No initialisation needs doing here at all.
   MailScanner::Log::InfoLog("Initialising OutgoingQueue");
}

sub EndOutgoingQueue {
   # No shutdown code needed here at all.
   # This function could log total stats, close databases, etc.
   MailScanner::Log::InfoLog("Ending OutgoingQueue");
}

# This will return 1 for all messages except those generated by this
# computer.
sub OutgoingQueue {
   my($message) = @_;

   return $DefaultQueue unless $message; # Default if no message passed in

   # Put the crap in the slow queue
   return $SlowQueue
     if $message->{subject} =~ /^Returned mail: see transcript for details/i ||
        $message->{subject} =~ /^Delivery Status Notification \(Failure\)/i  ||
        $message->{subject} =~ /^Warning: could not send message for past/i;

   # Put everything else in the fast queue
   return $DefaultQueue;
}
-----SNIP-----

Then set up a cron job in /etc/cron.hourly to do this

-----SNIP-----
#!/bin/sh
logger -p mail.notice 'Cleaning out slow queue'
rm -f /var/spool/mqueue.slow/*
exit 0
-----SNIP-----

Then just stop and restart MailScanner.

At 19:40 20/10/2004, you wrote:
>That is exaclty what I want!
>
>Thanks.
>
>bill anderson
>
>
>----- Original Message -----
>From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
>To: <MAILSCANNER@JISCMAIL.AC.UK>
>Sent: Wednesday, October 20, 2004 11:37 AM
>Subject: Re: Unknown user again
>
>
> > Okay, there's a different approach you could use for what you explain
>below.
> >
> > What you can do is write a tiny little Custom Function in MailScanner that
> > looks at the subject line of the message, and if it is along the lines of
> > "Returned mail: see transcript for details" or "Delivery Status
> > Notification \(Failure\)" then put the outgoing message in a queue you
> > never deliver. There are many ways of achieving the same effect in
> > MailScanner, this just happens to be very similar to one I wrote earlier
> > this week for my own site.
> >
> > What I wanted to do was to put all delivery failure messages in a queue
> > that is run a lot slower than the main outgoing queue.
> >
> > You could use the same thing, but with a cron job that just deletes all
>the
> > files in the extra queue every hour or so.
> >
> > If you want to see how to do that, reply to this and confirm that this
>will
> > solve your problem for now. I don't want to post (and write) a whole bunch
> > of code and setup for you if it's not what you want.
> >
> > At 19:21 20/10/2004, you wrote:
> > >Thank you for the responses so far.  I apologize for being  a little
>dense,
> > >so please bear with me.
> > >
> > >I think I have the LDAP part down.
> > >
> > >My other question is somewhat different of the LDAP question above.  I
>think
> > >I understand that doing the LDAP routing piece will fix my problem,
>however,
> > >it will take some time to get it going.  The short term fix I was looking
> > >for is the ability to have mailscanner or sendmail after it has tried to
> > >relay an email to another server where the user does not exist, to not
>try
> > >and reply back to the sender that the address does not exist.  Basically
>my
> > >servers are accepting all email for a domain, scanning it, then
>forwarding
> > >it on.  In 50% of the cases, the email is destined to a non-existant
>address
> > >and I get a 550 message, so I try to send it back to the sender.  For now
>I
> > >just want to drop all of those when I get the 550 back.  I still will
>accept
> > >and scan all email destined for that domain.  I know it is not perfect,
>but
> > >I will stop spamming others with my "unknown user" replies.
> > >
> > >Thanks for bearing with me.
> > >
> > >bill anderson
> > >
> > >----- Original Message -----
> > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > >Sent: Wednesday, October 20, 2004 11:01 AM
> > >Subject: Re: Unknown user again
> > >
> > >
> > > > At 18:47 20/10/2004, you wrote:
> > > > >When you say local db file, are you refering to the accessdb file in
> > > > >sendmail?
> > > >
> > > > No, a separate one created for the job.
> > > >
> > > > >   So, if I can paraphrase what you just said.  Using some sort of
> > > > >script that get's a list of emails from the various email servers,
>some
> > > > >LDAP, some not.  Compile this list into an accessdb file for use by
> > > > >sendmail?
> > > >
> > > > Not into an accessdb, but into a db file that describes where to send
> > >email
> > > > for all of your users. It's basically all in the FAQ at
> > > > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
> > > > The setup described there is for getting a routing database out of an
> > > > Exchange server running Active Directory, but the sendmail setup is
> > >exactly
> > > > the same.
> > > >
> > > > >Is there anyway to have sendmail / mailscanner drop 550 errors it
> > >receives
> > > > >from the other mail servers?  I want to fix my short term problem.
> > > >
> > > > Yes, by doing this. If the rcpt address isn't in the ldap (but
>actually a
> > > > db file) routing table, the message gets rejected at SMTP time.
> > > >
> > > > >----- Original Message -----
> > > > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > > > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > > > >Sent: Wednesday, October 20, 2004 10:27 AM
> > > > >Subject: Re: Unknown user again
> > > > >
> > > > >
> > > > > > There is a tweak on option (1). You can use the LDAP routing
>setup,
> > > > >without
> > > > > > *actually* using LDAP to build it. So you could have a script run
>from
> > > > >cron
> > > > > > that queried each of the servers somehow, and built a local db
>file of
> > >all
> > > > > > the valid addresses it should accept mail for. Then you use the
>LDAP
> > > > > > routing setup to use this local db file.
> > > > > >
> > > > > > At 18:18 20/10/2004, you wrote:
> > > > > > >1)  LDAP - many of the the servers don't support LDAP.  The
>ability
> > >to
> > > > >build
> > > > > > >a comprehnsive LDAP server is outside of our scope.
> > > > > > >
> > > > > > >1)  Is there anyway I can tell MailScanner and/or sendmail to not
> > >respond
> > > > >to
> > > > > > >a 550 unknown user error?  Bascially Mailscanner tries to deliver
>an
> > > > >email
> > > > > > >to an unknown user.  Once it gets the 550 error, it drops it.  I
>know
> > >the
> > > > > > >downside of what if it was an honest mistake, the sender would
>not be
> > > > > > >notified.  I would like to do this on a domain by domain basis.
> > > > > > >
> > > > > > >2) Can I talk to multiple LDAP databases depending on what domain
>the
> > > > > > >address is destined to.
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Professional Support Services at www.MailScanner.biz
> > MailScanner thanks transtec Computers for their support
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Wed Oct 20 21:23:18 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:20 2006
Subject: Quick way to stop SpamD
Message-ID: <mailman.3790.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 03:38 PM 10/20/2004, Sanjay K. Patel wrote:
>Does anyone have a quick command to stop SpamD. If I kill the spamD pid it
>just generates another.

I suspect you're ending up killing a spamd child, not the root process for
spamd.

Killing the forked workers spamd makes won't stop spamd, as the root
process will just fork more. This applies to pretty much all forking
servers (sendmail, httpd, named, etc).

If you started spamd with the -r parameter, you can use the resulting
pidfile to know which process ID is the root one. (Most people that use
this put it in something like /var/run/spamd.pid)

Otherwise, you'll have to find the oldest spamd in your ps listings and
kill that, or use killall if your OS has it.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From billa at STERLING.NET  Wed Oct 20 21:25:25 2004
From: billa at STERLING.NET (Bill Anderson)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3791.1137101240.24926.mailscanner@lists.mailscanner.info>

Thank you very much.

- bill anderson
----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Wednesday, October 20, 2004 12:09 PM
Subject: Re: Unknown user again


> Okay, here goes.
>
> In /etc/MailScanner/MailScanner.conf, put this
> Outgoing Queue Dir = &OutgoingQueue
>
> In /usr/lib/MailScanner/MailScanner/CustomConfig.pm, add this near the top
> -----SNIP-----
> my $DefaultQueue = '/var/spool/mqueue';
> my $SlowQueue    = '/var/spool/mqueue.slow';
>
> sub InitOutgoingQueue {
>    # No initialisation needs doing here at all.
>    MailScanner::Log::InfoLog("Initialising OutgoingQueue");
> }
>
> sub EndOutgoingQueue {
>    # No shutdown code needed here at all.
>    # This function could log total stats, close databases, etc.
>    MailScanner::Log::InfoLog("Ending OutgoingQueue");
> }
>
> # This will return 1 for all messages except those generated by this
> # computer.
> sub OutgoingQueue {
>    my($message) = @_;
>
>    return $DefaultQueue unless $message; # Default if no message passed in
>
>    # Put the crap in the slow queue
>    return $SlowQueue
>      if $message->{subject} =~ /^Returned mail: see transcript for
details/i ||
>         $message->{subject} =~ /^Delivery Status Notification
\(Failure\)/i  ||
>         $message->{subject} =~ /^Warning: could not send message for
past/i;
>
>    # Put everything else in the fast queue
>    return $DefaultQueue;
> }
> -----SNIP-----
>
> Then set up a cron job in /etc/cron.hourly to do this
>
> -----SNIP-----
> #!/bin/sh
> logger -p mail.notice 'Cleaning out slow queue'
> rm -f /var/spool/mqueue.slow/*
> exit 0
> -----SNIP-----
>
> Then just stop and restart MailScanner.
>
> At 19:40 20/10/2004, you wrote:
> >That is exaclty what I want!
> >
> >Thanks.
> >
> >bill anderson
> >
> >
> >----- Original Message -----
> >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> >To: <MAILSCANNER@JISCMAIL.AC.UK>
> >Sent: Wednesday, October 20, 2004 11:37 AM
> >Subject: Re: Unknown user again
> >
> >
> > > Okay, there's a different approach you could use for what you explain
> >below.
> > >
> > > What you can do is write a tiny little Custom Function in MailScanner
that
> > > looks at the subject line of the message, and if it is along the lines
of
> > > "Returned mail: see transcript for details" or "Delivery Status
> > > Notification \(Failure\)" then put the outgoing message in a queue you
> > > never deliver. There are many ways of achieving the same effect in
> > > MailScanner, this just happens to be very similar to one I wrote
earlier
> > > this week for my own site.
> > >
> > > What I wanted to do was to put all delivery failure messages in a
queue
> > > that is run a lot slower than the main outgoing queue.
> > >
> > > You could use the same thing, but with a cron job that just deletes
all
> >the
> > > files in the extra queue every hour or so.
> > >
> > > If you want to see how to do that, reply to this and confirm that this
> >will
> > > solve your problem for now. I don't want to post (and write) a whole
bunch
> > > of code and setup for you if it's not what you want.
> > >
> > > At 19:21 20/10/2004, you wrote:
> > > >Thank you for the responses so far.  I apologize for being  a little
> >dense,
> > > >so please bear with me.
> > > >
> > > >I think I have the LDAP part down.
> > > >
> > > >My other question is somewhat different of the LDAP question above.
I
> >think
> > > >I understand that doing the LDAP routing piece will fix my problem,
> >however,
> > > >it will take some time to get it going.  The short term fix I was
looking
> > > >for is the ability to have mailscanner or sendmail after it has tried
to
> > > >relay an email to another server where the user does not exist, to
not
> >try
> > > >and reply back to the sender that the address does not exist.
Basically
> >my
> > > >servers are accepting all email for a domain, scanning it, then
> >forwarding
> > > >it on.  In 50% of the cases, the email is destined to a non-existant
> >address
> > > >and I get a 550 message, so I try to send it back to the sender.  For
now
> >I
> > > >just want to drop all of those when I get the 550 back.  I still will
> >accept
> > > >and scan all email destined for that domain.  I know it is not
perfect,
> >but
> > > >I will stop spamming others with my "unknown user" replies.
> > > >
> > > >Thanks for bearing with me.
> > > >
> > > >bill anderson
> > > >
> > > >----- Original Message -----
> > > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > > >Sent: Wednesday, October 20, 2004 11:01 AM
> > > >Subject: Re: Unknown user again
> > > >
> > > >
> > > > > At 18:47 20/10/2004, you wrote:
> > > > > >When you say local db file, are you refering to the accessdb file
in
> > > > > >sendmail?
> > > > >
> > > > > No, a separate one created for the job.
> > > > >
> > > > > >   So, if I can paraphrase what you just said.  Using some sort
of
> > > > > >script that get's a list of emails from the various email
servers,
> >some
> > > > > >LDAP, some not.  Compile this list into an accessdb file for use
by
> > > > > >sendmail?
> > > > >
> > > > > Not into an accessdb, but into a db file that describes where to
send
> > > >email
> > > > > for all of your users. It's basically all in the FAQ at
> > > > > http://www.sng.ecs.soton.ac.uk/mailscanner/serve/cache/270.html
> > > > > The setup described there is for getting a routing database out of
an
> > > > > Exchange server running Active Directory, but the sendmail setup
is
> > > >exactly
> > > > > the same.
> > > > >
> > > > > >Is there anyway to have sendmail / mailscanner drop 550 errors it
> > > >receives
> > > > > >from the other mail servers?  I want to fix my short term
problem.
> > > > >
> > > > > Yes, by doing this. If the rcpt address isn't in the ldap (but
> >actually a
> > > > > db file) routing table, the message gets rejected at SMTP time.
> > > > >
> > > > > >----- Original Message -----
> > > > > >From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
> > > > > >To: <MAILSCANNER@JISCMAIL.AC.UK>
> > > > > >Sent: Wednesday, October 20, 2004 10:27 AM
> > > > > >Subject: Re: Unknown user again
> > > > > >
> > > > > >
> > > > > > > There is a tweak on option (1). You can use the LDAP routing
> >setup,
> > > > > >without
> > > > > > > *actually* using LDAP to build it. So you could have a script
run
> >from
> > > > > >cron
> > > > > > > that queried each of the servers somehow, and built a local db
> >file of
> > > >all
> > > > > > > the valid addresses it should accept mail for. Then you use
the
> >LDAP
> > > > > > > routing setup to use this local db file.
> > > > > > >
> > > > > > > At 18:18 20/10/2004, you wrote:
> > > > > > > >1)  LDAP - many of the the servers don't support LDAP.  The
> >ability
> > > >to
> > > > > >build
> > > > > > > >a comprehnsive LDAP server is outside of our scope.
> > > > > > > >
> > > > > > > >1)  Is there anyway I can tell MailScanner and/or sendmail to
not
> > > >respond
> > > > > >to
> > > > > > > >a 550 unknown user error?  Bascially Mailscanner tries to
deliver
> >an
> > > > > >email
> > > > > > > >to an unknown user.  Once it gets the 550 error, it drops it.
I
> >know
> > > >the
> > > > > > > >downside of what if it was an honest mistake, the sender
would
> >not be
> > > > > > > >notified.  I would like to do this on a domain by domain
basis.
> > > > > > > >
> > > > > > > >2) Can I talk to multiple LDAP databases depending on what
domain
> >the
> > > > > > > >address is destined to.
> > >
> > > --
> > > Julian Field
> > > www.MailScanner.info
> > > Professional Support Services at www.MailScanner.biz
> > > MailScanner thanks transtec Computers for their support
> > > Buy the MailScanner book at www.MailScanner.info/store
> > >
> > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> > >
> > > ------------------------ MailScanner list ------------------------
> > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > 'leave mailscanner' in the body of the email.
> > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > >
> >
> >------------------------ MailScanner list ------------------------
> >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >'leave mailscanner' in the body of the email.
> >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Wed Oct 20 21:07:00 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:20 2006
Subject: Sm-client.pid:  permission error
Message-ID: <mailman.3792.1137101240.24926.mailscanner@lists.mailscanner.info>

What permission should this have? Since this file is dynamically created
every time I start MailScanner where does it get its permission info from?
There must a place in sendmail that I can edit to fix this

sm-msp-queue[32015]: unable to write pid to /var/run/sm-client.pid:
Permission denied

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sanjay.patel at REXWIRE.COM  Wed Oct 20 21:11:58 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:20 2006
Subject: Quick way to stop SpamD
Message-ID: <mailman.3793.1137101240.24926.mailscanner@lists.mailscanner.info>

I am running Mandrake 10.1, but I took Daniels advice and killed it since
MailScanner does not use it. I was not aware of that.

Thanks for the help.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Ugo Bellavance
Sent: Wednesday, October 20, 2004 3:49 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Quick way to stop SpamD

Sanjay K. Patel wrote:
> Does anyone have a quick command to stop SpamD. If I kill the spamD
> pid it just generates another.

What OS?

Is there a script in /etc/init.d/ ?

>
> -SKP
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rcooper at DWFORD.COM  Wed Oct 20 22:08:00 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3794.1137101240.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Mike Zanker
> Sent: Wednesday, October 20, 2004 2:01 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problems with latest Mail::ClamAV
>
>
> On 20 October 2004 15:40 +0100 Michael Keightley <mk@QUADSTONE.COM>
> wrote:
>
> > I had to revert to 0.11, which meant downgrading clamav to 0.75.1
> > from 0.80.
>
> 0.80 works fine for me with Mail::ClamAV 0.11.
>

The problems will appear when you install Mail::ClamAV 0.12, or you try and
do a new install of Mail::ClamAV 0.11 with clamav 0.8. Since you already
have the 0.11 stuff complied everything is fine. It's the changes in the
#defines in clamav.h that cause all the trouble. Trust me if you try and
install Mail::ClamAV 01.2 (the newest) and you don't fix SweepViruses.pm
your clammodule is going to die every time since none of the pre 0.11
exports are now valid

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at ZANKER.ORG  Wed Oct 20 22:23:18 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3795.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
On 20 October 2004 16:08 -0500 Rick Cooper <rcooper@DWFORD.COM> wrote:

> The problems will appear when you install Mail::ClamAV 0.12, or you
> try and do a new install of Mail::ClamAV 0.11 with clamav 0.8. Since
> you already have the 0.11 stuff complied everything is fine. It's the
> changes in the
># defines in clamav.h that cause all the trouble. Trust me if you try
># and
> install Mail::ClamAV 01.2 (the newest) and you don't fix
> SweepViruses.pm your clammodule is going to die every time since none
> of the pre 0.11 exports are now valid

Ah, OK - that makes sense.

Thanks,

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From gib at TMISNET.COM  Wed Oct 20 23:58:13 2004
From: gib at TMISNET.COM (Gib Gilbertson Jr.)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3796.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi.

At 10:18 AM 10/20/2004 -0700, you wrote:
>Hi,
>
>I have been doing some digging on trying to understand how to fix my
>"Unknown User" issue where Mailscanner is used as a gateway to other mail
>servers.  My problem is that spam email destined to an unknown user on
>another server serviced by my gateway, ends up piling up in my queues and I
>end up sending an undeliverable message to innocent bystanders who are
>unlucky enough to be in the forged from address.
>
>I have seen several solutions mentioned in this list, however, none of them
>quite fit my environment.  I am running Mailscanner and sendmail as a
>gateway.  The gateway serves as a spam and virus filter for several diverse
>/ non-integrated mail servers.  Here is what I have found as possible
>solutions, but for some reason or another it doesnt quite solve my solution
>in all cases.


You could also use milter-ahead with sendmail. This is what I did and it
cut e-mail going through the gateway from about 30k per day to under 10k
per day. You can find out about it here:

    http://www.milter.org/archives/001433.php

Good luck

gib


--

      Gib Gilbertson Jr.
     Tierramiga Info Systems
      619-287-8647 Support
      http://www.tmisnet.com
      San Diego's "Friendly ISP"

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at CAMAROSS.NET  Thu Oct 21 00:04:21 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:20 2006
Subject: Unknown user again
Message-ID: <mailman.3797.1137101240.24926.mailscanner@lists.mailscanner.info>

Gib Gilbertson Jr. wrote:
> Hi.
>
> At 10:18 AM 10/20/2004 -0700, you wrote:
>> Hi,
>>
>> I have been doing some digging on trying to understand how to fix my
>> "Unknown User" issue where Mailscanner is used as a gateway to other
>> mail servers.  My problem is that spam email destined to an unknown
>> user on another server serviced by my gateway, ends up piling up in
>> my queues and I end up sending an undeliverable message to innocent
>> bystanders who are unlucky enough to be in the forged from address.
>>
>> I have seen several solutions mentioned in this list, however, none
>> of them quite fit my environment.  I am running Mailscanner and
>> sendmail as a gateway.  The gateway serves as a spam and virus
>> filter for several diverse / non-integrated mail servers.  Here is
>> what I have found as possible solutions, but for some reason or
>> another it doesnt quite solve my solution in all cases.
>
>
> You could also use milter-ahead with sendmail. This is what I did and
> it cut e-mail going through the gateway from about 30k per day to
> under 10k per day. You can find out about it here:
>
>     http://www.milter.org/archives/001433.php
>
> Good luck
>
> gib

milter-sender also offers the call-ahead feature in addition to verifying
the sending email address is valid/deliverable.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From rcooper at DWFORD.COM  Thu Oct 21 04:16:37 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3798.1137101240.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Julian Field
> Sent: Wednesday, October 20, 2004 3:17 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problems with latest Mail::ClamAV
>
>
> Does Mail::ClamAV 0.12 work with ClamAV 0.75?
> If not, I'm going to have to wait for Dag Wieers to produce RPMs
> for ClamAV
> 0.80.
<snip>

No, the Mail::ClamAV program info (readme, etc) specifically states it is
not backward compatible. Two exports are missing altogether and the third is
misspelled in the "backward compatibility" section of clamav.h (which is
what killed the 0.80rc3+ compatibility)

I believe 0.8rc3 is the earliest version Mail::ClamAV 0.12 will work with.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Thu Oct 21 04:03:00 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:20 2006
Subject: Quick way to stop SpamD
Message-ID: <mailman.3799.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Sanjay K. Patel wrote:
> I am running Mandrake 10.1, but I took Daniels advice and killed it since
> MailScanner does not use it. I was not aware of that.
>
> Thanks for the help.

but it will be restarted at boot, probably.  I don't remember the
command to edit startup services on mandrake.  Should be obvious if
you've got a graphical interface, though.

>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Ugo Bellavance
> Sent: Wednesday, October 20, 2004 3:49 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Quick way to stop SpamD
>
> Sanjay K. Patel wrote:
>
>>Does anyone have a quick command to stop SpamD. If I kill the spamD
>>pid it just generates another.
>
>
> What OS?
>
> Is there a script in /etc/init.d/ ?
>
>
>>-SKP
>>
>>------------------------ MailScanner list ------------------------ To
>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From kfliong at WOFS.COM  Thu Oct 21 05:19:55 2004
From: kfliong at WOFS.COM (kfliong)
Date: Thu Jan 12 21:27:20 2006
Subject: Mail::ClamAV compilation problem with perl
Message-ID: <mailman.3800.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi,

I am getting this error trying to install Mail::ClamAV with perl CPAN
shell. When i go into shell, I get this error :

perl -MCPAN -e shell
Undefined value assigned to typeglob at (eval 16) line 15, <RC> line 11.
Warning [/etc/inputrc line 11]:
   Invalid variable `mark-symlinked-directories'

cpan shell -- CPAN exploration and modules installation (v1.7601)
ReadLine support enabled

-----------------------------------
the in type : install Mail::ClamAV

..
..
..
..
Starting Build Compile Stage
   Starting "perl Makefile.PL" Stage
Writing Makefile for Mail::ClamAV
   Finished "perl Makefile.PL" Stage

   Starting "make" Stage
make[1]: Entering directory
`/root/.cpan/build/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV'
/usr/bin/perl /usr/lib/perl5/5.8.1/ExtUtils/xsubpp  -typemap
/usr/lib/perl5/5.8.1/ExtUtils/typemap   ClamAV.xs > ClamAV.xsc && mv
ClamAV.xsc ClamAV.c
gcc -c  -I/root/.cpan/build/Mail-ClamAV-0.12 -I/usr/local/include
-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING
-fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386
-mcpu=i686   -DVERSION=\"0.12\" -DXS_VERSION=\"0.12\" -fPIC
"-I/usr/lib/perl5/5.8.1/i386-linux-thread-multi/CORE"   ClamAV.c
ClamAV.xs: In function `clamav_perl_constant':
ClamAV.xs:324: error: `CL_EFORMAT' undeclared (first use in this function)
ClamAV.xs:324: error: (Each undeclared identifier is reported only once
ClamAV.xs:324: error: for each function it appears in.)
ClamAV.xs:326: error: `CL_SCAN_RAW' undeclared (first use in this function)
ClamAV.xs:327: error: `CL_SCAN_ARCHIVE' undeclared (first use in this function)
ClamAV.xs:328: error: `CL_SCAN_MAIL' undeclared (first use in this function)
ClamAV.xs:329: error: `CL_SCAN_DISABLERAR' undeclared (first use in this
function)
ClamAV.xs:330: error: `CL_SCAN_OLE2' undeclared (first use in this function)
ClamAV.xs:331: error: `CL_SCAN_BLOCKENCRYPTED' undeclared (first use in
this function)
ClamAV.xs:332: error: `CL_SCAN_HTML' undeclared (first use in this function)
ClamAV.xs:333: error: `CL_SCAN_PE' undeclared (first use in this function)
ClamAV.xs:334: error: `CL_SCAN_BLOCKBROKEN' undeclared (first use in this
function)
ClamAV.xs:335: error: `CL_SCAN_MAILURL' undeclared (first use in this function)
ClamAV.xs:336: error: `CL_SCAN_BLOCKMAX' undeclared (first use in this
function)
ClamAV.xs:338: error: `CL_SCAN_STDOPT' undeclared (first use in this function)
make[1]: *** [ClamAV.o] Error 1
make[1]: Leaving directory
`/root/.cpan/build/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV'
A problem was encountered while attempting to compile and install your Inline
C code. The command that failed was:
   make

The build directory was:
/root/.cpan/build/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV

To debug the problem, cd to the build directory, and inspect the output files.

  at /root/.cpan/build/Mail-ClamAV-0.12/blib/lib/Mail/ClamAV.pm line 164
BEGIN failed--compilation aborted at
/root/.cpan/build/Mail-ClamAV-0.12/blib/lib/Mail/ClamAV.pm line 503.
Compilation failed in require.
BEGIN failed--compilation aborted.
make: *** [ClamAV.inl] Error 2
   /usr/bin/make  -- NOT OK
Running make test
   Can't test without successful make
Running make install
   make had returned bad status, install seems impossible

-------------------------------

I already tried install Bundle::CPAN and all is up-to-date.

Could it be related to the first error when i go into shell?

Using perl 5.8.1 and fedora1. Kernel 2.4.20-24.7

Thanks in advance.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dh at UPTIME.AT  Thu Oct 21 07:05:38 2004
From: dh at UPTIME.AT (David HXXhn)
Date: Thu Jan 12 21:27:20 2006
Subject: RFC: Is anyone already storing Mailscanner.conf in LDAP?
Message-ID: <mailman.3801.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Hello Folks.

I know I am a lazy bone, but I was wondering if any of you store the
Mailscanner.conf in a LDAP tree already. I would be very much interested
in an LDIFF of that if it is at all possible.

Thanks

- -d

- --
nee anata wo mitsukete soshite nidoto wasurezu
~      donna ni munega itakutemo soba ni iru no
~                         zutto...zutto...zutto
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBd1GyPMoaMn4kKR4RAxrsAJsHKyaR2yFZsqfwfZg3faaECloyhgCbB5lm
n+/vfqT8+FrLLguco+OUHNw=
=DIxM
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Jan-Peter.Koopmann at SECEIDOS.DE  Thu Oct 21 07:17:41 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3802.1137101240.24926.mailscanner@lists.mailscanner.info>

On Wednesday, October 20, 2004 9:05 PM MailScanner mailing list wrote:

> I will make sure that Mail::ClamAV is at least 0.12.

I just updated the FreeBSD port of p5-Mail-ClamAV. When will the next MailScanner version be out that support 0.12? Can you provide an "official" patch to MailScanner that will make 0.12 work so I can put it in the FreeBSD port as well?

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ricardo.canavate at nozar.es  Thu Oct 21 07:49:16 2004
From: ricardo.canavate at nozar.es (Ricardo Luis CaXavate)
Date: Thu Jan 12 21:27:20 2006
Subject: Vispan
Message-ID: <mailman.3803.1137101240.24926.mailscanner@lists.mailscanner.info>

Someone knows how to configure and run vispan?

I downloaded from the web site and I configured /etc/Vispan.conf as I
thought.

I can see the reports, but I receive a cron messages with the executing
frequency that said:
"No IP Address"

Thanks for all


 Ricardo Luis Cañavate García
Dpto. Informática
NOZAR Grupo Inmobiliario
Tel: 91 758 96 30 | Fax: 91 559 85 82
www.nozar.es


=========================================================================
Usted recibe este mensaje porque su dirección e-mail se encuentra en 
nuestra base de datos al haber tenido contactos anteriores con nosotros, 
por lo que entendemos que contamos con su autorización para enviarle 
información profesional. No obstante, si no desea seguir recibiéndola 
basta con hacérnoslo saber.
Este mensaje se dirige exclusivamente a su destinatario y puede contener 
información privilegiada o confidencial. Si no es vd. el destinatario 
indicado, queda notificado de que la utilización, divulgación y/o copia 
sin autorización está prohibida en virtud de la legislación vigente. 
Si ha recibido este mensaje por error, le rogamos que nos lo comunique 
inmediatamente por esta misma vía y proceda a su destrucción.


You are receiving this message because your e-mail address is listed in 
our database due to previous communications with us, 
so we have assumed that we have your permission to send you professional 
information. However, if you do not wish to continue to receive such 
information then please let us know.
This message is intended exclusively for its addressee and may contain 
information that is CONFIDENTIAL and protected by professional privilege. 
If you are not the intended recipient you are hereby notified that any 
dissemination, copy or disclosure of this communication is strictly 
prohibited by law. If this message has been received in error, please 
immediately notify us via e-mail and delete it.
=======================================================================

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From danielk at AVALONPUB.COM  Thu Oct 21 07:57:59 2004
From: danielk at AVALONPUB.COM (Daniel Kleinsinger)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3804.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Rick Cooper wrote:

> I can't give you a direct patch to fix this because of other patches I
> have
>
>on SweepViruses.pm but if you change the following:
>
>CL_ARCHIVE      to CL_SCAN_ARCHIVE
>CL_OLE2 to CL_SCAN_OLE2
>CL_ENCRYPTED to CL_SCAN_BLOCKENCRYPTED
>
>in /opt/MailScanner/lib/MailScanner/SweepViruses.pm
>
>and reinstall Mail::ClamAV 0.12 you should be up and running. There is NO
>backward compatablity between Mail::ClamAV 0.11 and 0.12 and you MUST have
>clam 0.80 installed prior to installing Mail::ClamAV 0.12
>
I patched it manually and made a diff off a clean SweepViruses.pm from
MailScanner 4.34.8...  As stated, only works with ClamAV 0.80.  Seems to
be working just fine, thanks Rick.

Daniel


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>
987c987
<       #$results = $Clam->scan("$dirname/$childname/$filename", Mail::ClamAV::CL_ARCHIVE());
---
>       #$results = $Clam->scan("$dirname/$childname/$filename", Mail::ClamAV::CL_SCAN_ARCHIVE());
989c989
<         $results = $Clam->scan("$dirname/$childname/$filename", Mail::ClamAV::CL_ARCHIVE() | Mail::ClamAV::CL_OLE2());
---
>         $results = $Clam->scan("$dirname/$childname/$filename", Mail::ClamAV::CL_SCAN_ARCHIVE() | Mail::ClamAV::CL_SCAN_OLE2());
991c991
<         $results = $Clam->scan("$dirname/$childname/$filename", Mail::ClamAV::CL_ARCHIVE() | Mail::ClamAV::CL_ENCRYPTED() | Mail::ClamAV::CL_OLE2());
---
>         $results = $Clam->scan("$dirname/$childname/$filename", Mail::ClamAV::CL_SCAN_ARCHIVE() | Mail::ClamAV::CL_SCAN_BLOCKENCRYPTED() | Mail::ClamAV::CL_SCAN_OLE2());

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From danielk at AVALONPUB.COM  Thu Oct 21 08:01:16 2004
From: danielk at AVALONPUB.COM (Daniel Kleinsinger)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3805.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Daniel Kleinsinger wrote:

> I patched it manually and made a diff off a clean SweepViruses.pm from
> MailScanner 4.34.8...  As stated, only works with ClamAV 0.80.  Seems to
> be working just fine, thanks Rick.

Ummm, the patch seems to have been signed by the mailing list software.
That part needs to be removed.

Daniel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 21 08:45:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: RFC: Is anyone already storing Mailscanner.conf in LDAP?
Message-ID: <mailman.3806.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Search the mailing list archive for LDIF.

At 07:05 21/10/2004, you wrote:
>I know I am a lazy bone, but I was wondering if any of you store the
>Mailscanner.conf in a LDAP tree already. I would be very much interested
>in an LDIFF of that if it is at all possible.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 21 08:44:41 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:20 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3807.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:16 21/10/2004, you wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> > Behalf Of Julian Field
> > Sent: Wednesday, October 20, 2004 3:17 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: Problems with latest Mail::ClamAV
> >
> >
> > Does Mail::ClamAV 0.12 work with ClamAV 0.75?
> > If not, I'm going to have to wait for Dag Wieers to produce RPMs
> > for ClamAV
> > 0.80.
><snip>
>
>No, the Mail::ClamAV program info (readme, etc) specifically states it is
>not backward compatible. Two exports are missing altogether and the third is
>misspelled in the "backward compatibility" section of clamav.h (which is
>what killed the 0.80rc3+ compatibility)
>
>I believe 0.8rc3 is the earliest version Mail::ClamAV 0.12 will work with.

In which case can someone please put a bit of very gentle pressure (in the
politest possible way) on Dag Wieers as I have to wait for his updated
RPM's before I can publish a new version of MailScanner.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From lists at dvd-goetsch.de  Thu Oct 21 11:10:21 2004
From: lists at dvd-goetsch.de (Sebastian Ruchti)
Date: Thu Jan 12 21:27:20 2006
Subject: Can't download beta for Suse
Message-ID: <mailman.3808.1137101240.24926.mailscanner@lists.mailscanner.info>

Hi all,

just tried to download the latest beta for Suse Linux, but I can't get it
(all the other downloads work?!)
Is it me, my conncetion or maybe a typo in the HTML-file?

Thanks in advance
.sebastian

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From michele at BLACKNIGHTSOLUTIONS.COM  Thu Oct 21 11:16:54 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:20 2006
Subject: Can't download beta for Suse
Message-ID: <mailman.3809.1137101240.24926.mailscanner@lists.mailscanner.info>

> just tried to download the latest beta for Suse Linux, but I
> can't get it (all the other downloads work?!) Is it me, my
> conncetion or maybe a typo in the HTML-file?

The directory with the downloads is browsable, so edit the url to see all of
the downloads available



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Thu Oct 21 13:02:14 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:20 2006
Subject: Vispan
Message-ID: <mailman.3810.1137101240.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Ricardo Luis Cañavate wrote:
> Someone knows how to configure and run vispan?
> 
> I downloaded from the web site and I configured /etc/Vispan.conf as I
> thought.
> 
> I can see the reports, but I receive a cron messages with the executing
> frequency that said:
> "No IP Address"
> 
> Thanks for all

There is a support forum on Vispan's web site.  I think you are better 
of posting there.

Btw, get rid of this incredibly long signature when you post on public 
mailing lists.

Thanks,

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From rcooper at DWFORD.COM  Thu Oct 21 12:49:21 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:20 2006
Subject: Mail::ClamAV compilation problem with perl
Message-ID: <mailman.3811.1137101240.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of kfliong
> Sent: Wednesday, October 20, 2004 11:20 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Mail::ClamAV compilation problem with perl
>
>
> Hi,
>
> I am getting this error trying to install Mail::ClamAV with perl CPAN
> shell. When i go into shell, I get this error :
>
> perl -MCPAN -e shell
> Undefined value assigned to typeglob at (eval 16) line 15, <RC> line 11.
> Warning [/etc/inputrc line 11]:
>    Invalid variable `mark-symlinked-directories'
>
> cpan shell -- CPAN exploration and modules installation (v1.7601)
> ReadLine support enabled
>
> -----------------------------------
> the in type : install Mail::ClamAV
>
> ..
> ..
> ..
> ..
> Starting Build Compile Stage
>    Starting "perl Makefile.PL" Stage
> Writing Makefile for Mail::ClamAV
>    Finished "perl Makefile.PL" Stage
>
>    Starting "make" Stage
> make[1]: Entering directory
> `/root/.cpan/build/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV'
> /usr/bin/perl /usr/lib/perl5/5.8.1/ExtUtils/xsubpp  -typemap
> /usr/lib/perl5/5.8.1/ExtUtils/typemap   ClamAV.xs > ClamAV.xsc && mv
> ClamAV.xsc ClamAV.c
> gcc -c  -I/root/.cpan/build/Mail-ClamAV-0.12 -I/usr/local/include
> -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING
> -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE
> -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386
> -mcpu=i686   -DVERSION=\"0.12\" -DXS_VERSION=\"0.12\" -fPIC
> "-I/usr/lib/perl5/5.8.1/i386-linux-thread-multi/CORE"   ClamAV.c
> ClamAV.xs: In function `clamav_perl_constant':
> ClamAV.xs:324: error: `CL_EFORMAT' undeclared (first use in this function)
> ClamAV.xs:324: error: (Each undeclared identifier is reported only once
> ClamAV.xs:324: error: for each function it appears in.)
> ClamAV.xs:326: error: `CL_SCAN_RAW' undeclared (first use in this
> function)
> ClamAV.xs:327: error: `CL_SCAN_ARCHIVE' undeclared (first use in
> this function)
> ClamAV.xs:328: error: `CL_SCAN_MAIL' undeclared (first use in
> this function)
> ClamAV.xs:329: error: `CL_SCAN_DISABLERAR' undeclared (first use in this
> function)
> ClamAV.xs:330: error: `CL_SCAN_OLE2' undeclared (first use in
> this function)
> ClamAV.xs:331: error: `CL_SCAN_BLOCKENCRYPTED' undeclared (first use in
> this function)
> ClamAV.xs:332: error: `CL_SCAN_HTML' undeclared (first use in
> this function)
> ClamAV.xs:333: error: `CL_SCAN_PE' undeclared (first use in this function)
> ClamAV.xs:334: error: `CL_SCAN_BLOCKBROKEN' undeclared (first use in this
> function)
> ClamAV.xs:335: error: `CL_SCAN_MAILURL' undeclared (first use in
> this function)
> ClamAV.xs:336: error: `CL_SCAN_BLOCKMAX' undeclared (first use in this
> function)
> ClamAV.xs:338: error: `CL_SCAN_STDOPT' undeclared (first use in
> this function)
> make[1]: *** [ClamAV.o] Error 1
> make[1]: Leaving directory
> `/root/.cpan/build/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV'
> A problem was encountered while attempting to compile and install
> your Inline
> C code. The command that failed was:
>    make
>
> The build directory was:
> /root/.cpan/build/Mail-ClamAV-0.12/_Inline/build/Mail/ClamAV
>
> To debug the problem, cd to the build directory, and inspect the
> output files.
>
>   at /root/.cpan/build/Mail-ClamAV-0.12/blib/lib/Mail/ClamAV.pm line 164
> BEGIN failed--compilation aborted at
> /root/.cpan/build/Mail-ClamAV-0.12/blib/lib/Mail/ClamAV.pm line 503.
> Compilation failed in require.
> BEGIN failed--compilation aborted.
> make: *** [ClamAV.inl] Error 2
>    /usr/bin/make  -- NOT OK
> Running make test
>    Can't test without successful make
> Running make install
>    make had returned bad status, install seems impossible
>
> -------------------------------
>
> I already tried install Bundle::CPAN and all is up-to-date.
>
> Could it be related to the first error when i go into shell?
>
> Using perl 5.8.1 and fedora1. Kernel 2.4.20-24.7
>
> Thanks in advance.
>

You don't mention what version of clam is installed? You should have elease
0.80 installed before you try and install Mail::ClamAV 0.12, that is very
important.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstuart at EDENPR.K12.MN.US  Thu Oct 21 15:59:30 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:21 2006
Subject: filename checking
Message-ID: <mailman.3812.1137101240.24926.mailscanner@lists.mailscanner.info>

Is there a way to control filename checking inside of zips?  I want
people to be able to send exe's inside of zips.

Thanks

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct 21 16:29:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: filename checking
Message-ID: <mailman.3813.1137101241.24926.mailscanner@lists.mailscanner.info>

Please read the MailScanner.conf file.

# The maximum depth to which zip archives will be unpacked, to allow for
# checking filenames and filetypes within zip archives.
# To disable this feature set this to 0.
# A common useful setting is this option = 0, and Allow Password-Protected
# Archives = no. That block password-protected archives but does not do
# any filename/filetype checks on the files within the archive.
Maximum Archive Depth = 0


On 21/10/04 3:59 pm, "Joe Stuart" <jstuart@EDENPR.K12.MN.US> wrote:

> Is there a way to control filename checking inside of zips?  I want
> people to be able to send exe's inside of zips.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dean at SAHRA.ARIZONA.EDU  Thu Oct 21 17:12:59 2004
From: dean at SAHRA.ARIZONA.EDU (Dean Jones)
Date: Thu Jan 12 21:27:21 2006
Subject: Random message corruption issue
Message-ID: <mailman.3814.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
First of all i'd like to say thanks to Julian for not only releasing a
great product (for free) but also for the huge amount of support on the
mailing list.

--

So i have been having a problem with random corrupted messages.
the frequency is really low, maybe 2-4 a day but i have not figured a
pattern out.
Most of the corrupted mails have an attachment, and Outlook messages
seem to be corrupted at a higher rate than Thunderbird or other clients.
(but the other clients still have some corruption)
A couple of times someone has mass emailed a few people here at work,
and only 1 of the 5 outgoing messages is corrupted, so it's not like the
message was invalid from the beginning.

The messages get put into the postfix/corrupt queue after they are
processed by MailScanner. I can tell because the header info from
MailScanner is in the corrupt message.

My guesses are basically pointing to either the MIME decoding or header
re-writing at some point in the process but as i said, a pattern has not
really emerged.


My system specs are:
solaris 9, postfix 2.1.5, MailScanner 4.34.8-4, Perl 5.8.4.
I am using the "Hold" header method with postfix.

if anyone has seen something similar or has any ideas, it would be great!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marcin.rozek at IOS.EDU.PL  Thu Oct 21 16:55:41 2004
From: marcin.rozek at IOS.EDU.PL (Marcin Rozek)
Date: Thu Jan 12 21:27:21 2006
Subject: Sm-client.pid: permission error
Message-ID: <mailman.3815.1137101241.24926.mailscanner@lists.mailscanner.info>

I have the same situation - when i (for this test only) set chmod o+w
/var/run  then i place a # on this line in /etc/init.d/MailScanner:
chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null
and start /etc/init.d/MailScanner then sendmail creates sm-client.pid as
follows:
-rw------- mail mail

If your sendmail tries to do the same then:
/etc/init.d/MailScanner stop
killall -9 sendmail
chown mail:mail /var/run/sm-client.pid
chmod 600 /var/run/sm-client.pid
/etc/init.d/MailScanner start

or/and change a line in /etc/init.d/MailScanner
chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null
to this
chown mail:mail /var/run/sm-client.pid 2>/dev/null
and add this line just after previous one:
chmod 600 /var/run/sm-client.pid

Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Thu Oct 21 19:09:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Sm-client.pid: permission error
Message-ID: <mailman.3816.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
What OS and version are you using? What distribution of MailScanner are you
using?

At 16:55 21/10/2004, you wrote:
>I have the same situation - when i (for this test only) set chmod o+w
>/var/run  then i place a # on this line in /etc/init.d/MailScanner:
>chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null
>and start /etc/init.d/MailScanner then sendmail creates sm-client.pid as
>follows:
>-rw------- mail mail
>
>If your sendmail tries to do the same then:
>/etc/init.d/MailScanner stop
>killall -9 sendmail
>chown mail:mail /var/run/sm-client.pid
>chmod 600 /var/run/sm-client.pid
>/etc/init.d/MailScanner start
>
>or/and change a line in /etc/init.d/MailScanner
>chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null
>to this
>chown mail:mail /var/run/sm-client.pid 2>/dev/null
>and add this line just after previous one:
>chmod 600 /var/run/sm-client.pid

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ree at THUNDERSTAR.NET  Thu Oct 21 19:25:16 2004
From: ree at THUNDERSTAR.NET (Ron E.)
Date: Thu Jan 12 21:27:21 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3817.1137101241.24926.mailscanner@lists.mailscanner.info>

Dear All,

        Hopefully someone has an idea for me - I have a server that
normally handles it's traffic load but this morning has started
backlogging - I ran MailScanner in debug mode and the only real point of
long delay I saw coming up repeatedly is:

debug: bayes: Can't use estimation method for expiry, something fishy,
calculating optimal atime delta (first pass)
debug: bayes: expiry max exponent: 9

The above messages I have only sometimes seen before when doing a bayes
database rebuild, but not always.

Anyone have any ideas why this is happening repeatedly within one
MailScanner batch and how I can alleviate it?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From jstuart at EDENPR.K12.MN.US  Thu Oct 21 19:31:37 2004
From: jstuart at EDENPR.K12.MN.US (Joe Stuart)
Date: Thu Jan 12 21:27:21 2006
Subject: filename checking
Message-ID: <mailman.3818.1137101241.24926.mailscanner@lists.mailscanner.info>

Sorry didnt see that, but thanks for the reply

>>> mailscanner@ECS.SOTON.AC.UK 10/21/04 10:29AM >>>
Please read the MailScanner.conf file.

# The maximum depth to which zip archives will be unpacked, to allow
for
# checking filenames and filetypes within zip archives.
# To disable this feature set this to 0.
# A common useful setting is this option = 0, and Allow
Password-Protected
# Archives = no. That block password-protected archives but does not
do
# any filename/filetype checks on the files within the archive.
Maximum Archive Depth = 0


On 21/10/04 3:59 pm, "Joe Stuart" <jstuart@EDENPR.K12.MN.US> wrote:

> Is there a way to control filename checking inside of zips?  I want
> people to be able to send exe's inside of zips.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From thom at CUSTOMNETWORKS.CA  Thu Oct 21 19:35:48 2004
From: thom at CUSTOMNETWORKS.CA (Thom Paine)
Date: Thu Jan 12 21:27:21 2006
Subject: Mcafee Time Out
Message-ID: <mailman.3819.1137101241.24926.mailscanner@lists.mailscanner.info>

I just installed MailScanner 4.34.8-4 on my new Dell PowerEdge 600SC. I
have RHEL 3 ES and after standard tweaking and installation, my mcafee
times out and I see in the log files denial of service attack in
message.

I quickly installed this last week, and haven't been at work much and
just noticed now that I have no mail. I then set virus scanners = none
in the /etc/MailScanner/MailScanner.conf file, and I seem to have mail
coming in again.

Mcafee seems to be working.....

[root@ns1 root]# /usr/local/uvscan/uvscan --version
Virus Scan for Linux v4.16.0
Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights
reserved.(408) 988-3832  LICENSED COPY - Nov 13 2001

Scan engine v4.3.20 for Linux.
Virus data file v4400 created Oct 20 2004
Scanning for 104507 viruses, trojans and variants.

Anyone else run into this? And where did all my mail go that didn't get
delivered? Did it get deleted? I don't see it in the quarantine.

Thanks.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ssilva at SGVWATER.COM  Thu Oct 21 19:26:51 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:21 2006
Subject: Problems with latest Mail::ClamAV
Message-ID: <mailman.3820.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Field wrote:
| At 04:16 21/10/2004, you wrote:
|
|> > -----Original Message-----
|> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
|> > Behalf Of Julian Field
|> > Sent: Wednesday, October 20, 2004 3:17 PM
|> > To: MAILSCANNER@JISCMAIL.AC.UK
|> > Subject: Re: Problems with latest Mail::ClamAV
|> >
|> >
|> > Does Mail::ClamAV 0.12 work with ClamAV 0.75?
|> > If not, I'm going to have to wait for Dag Wieers to produce RPMs
|> > for ClamAV
|> > 0.80.
|> <snip>
|>
|> No, the Mail::ClamAV program info (readme, etc) specifically states it is
|> not backward compatible. Two exports are missing altogether and the
|> third is
|> misspelled in the "backward compatibility" section of clamav.h (which is
|> what killed the 0.80rc3+ compatibility)
|>
|> I believe 0.8rc3 is the earliest version Mail::ClamAV 0.12 will work
|> with.
|
|
| In which case can someone please put a bit of very gentle pressure (in the
| politest possible way) on Dag Wieers as I have to wait for his updated
| RPM's before I can publish a new version of MailScanner.
Have you tried these RPMS?
http://crash.fce.vutbr.cz/crash-hat/2/clamav/

I just ran across them about 10 minutes ago.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBd/9rRADw9lziUqQRArq7AJ0YIUQB4WRjDMWuXGQzHdzR17H8DgCeOtsZ
CTcl4BpIfHXr0HeMmOu1Wsg=
=cDJZ
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sanjay.patel at REXWIRE.COM  Thu Oct 21 20:02:18 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:21 2006
Subject: Sm-client.pid: permission error
Message-ID: <mailman.3821.1137101241.24926.mailscanner@lists.mailscanner.info>

 I an running Mandrake 10.1 and MailScanner 4.38.8

-SKP

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Thursday, October 21, 2004 2:10 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Sm-client.pid: permission error

What OS and version are you using? What distribution of MailScanner are you
using?

At 16:55 21/10/2004, you wrote:
>I have the same situation - when i (for this test only) set chmod o+w
>/var/run  then i place a # on this line in /etc/init.d/MailScanner:
>chown $MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null and start
>/etc/init.d/MailScanner then sendmail creates sm-client.pid as
>follows:
>-rw------- mail mail
>
>If your sendmail tries to do the same then:
>/etc/init.d/MailScanner stop
>killall -9 sendmail
>chown mail:mail /var/run/sm-client.pid
>chmod 600 /var/run/sm-client.pid
>/etc/init.d/MailScanner start
>
>or/and change a line in /etc/init.d/MailScanner chown
>$MSPUSER:$MSPGROUP /var/run/sm-client.pid 2>/dev/null to this chown
>mail:mail /var/run/sm-client.pid 2>/dev/null and add this line just
>after previous one:
>chmod 600 /var/run/sm-client.pid

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcin.rozek at IOS.EDU.PL  Thu Oct 21 19:59:56 2004
From: marcin.rozek at IOS.EDU.PL ([ISO-8859-2] Marcin Ro¿ek)
Date: Thu Jan 12 21:27:21 2006
Subject: Sm-client.pid: permission error
Message-ID: <mailman.3822.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:
> What OS and version are you using? What distribution of MailScanner are you
> using?
Mandrake 10 Official.
rpm -q mailscanner  -> mailscanner-4.35.3-1

Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wright at CYBERVALE.COM  Thu Oct 21 18:58:30 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3823.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Can someone please provide me with rpm it refuses 
to build on my RH9 box, Perl Version 5.8</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>t/heuristic......FAILED test 
7<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Failed 1/15 tests, 93.33% 
okay<BR></FONT></DIV>
<DIV><FONT face=Arial size=2>TIA</DIV></FONT></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From raymond at PROLOCATION.NET  Thu Oct 21 20:22:01 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3824.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

> Can someone please provide me with rpm it refuses to build on my RH9
> box, Perl Version 5.8

What about the one thats inside your RedHat 9 distribution?

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mkettler at EVI-INC.COM  Thu Oct 21 20:20:57 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:21 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3825.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 02:25 PM 10/21/2004, Ron E. wrote:
>Dear All,
>
>         Hopefully someone has an idea for me - I have a server that
>normally handles it's traffic load but this morning has started
>backlogging - I ran MailScanner in debug mode and the only real point of
>long delay I saw coming up repeatedly is:
>
>debug: bayes: Can't use estimation method for expiry, something fishy,
>calculating optimal atime delta (first pass)
>debug: bayes: expiry max exponent: 9
>
>The above messages I have only sometimes seen before when doing a bayes
>database rebuild, but not always.
>
>Anyone have any ideas why this is happening repeatedly within one
>MailScanner batch and how I can alleviate it?

Any chance MS is timing SA out and killing it repeatedly? (this can happen
if SA does expiry and it takes too long for MailScanner's rather absurdly
short default timeout).

If this is the case, Re-quoting myself from a post to the SA user's list:
--------------------------------
In the short term, you can help by running a sa-learn --force-expire on
your bayes DB.

In the longer term, here's some suggestions I use on my own MailScanner
server: (I use all of these together)

1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60
seconds at least, I have mine set to 120.

2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400
seconds is a good start. This makes MailScanner invoke SA's bayes
housekeeping directly, rather than during a scan of a message.

3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will
keep SA from trying to run bayes expires (long and slow) during message
handling, but relies on #2 above to allow expiry to occur.

4) I also have a sa-learn --force-expire running as a daily cronjob. I have
tested the setup without this measure, and #2 is sufficient to cause expiry
to occur. Really this is just a fail-safe to allow expiry to occur even if
MailScanner's calls fail to run it properly for some reason.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ssilva at SGVWATER.COM  Thu Oct 21 20:33:28 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:21 2006
Subject: Mcafee Time Out
Message-ID: <mailman.3826.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thom Paine wrote:
| I just installed MailScanner 4.34.8-4 on my new Dell PowerEdge 600SC. I
| have RHEL 3 ES and after standard tweaking and installation, my mcafee
| times out and I see in the log files denial of service attack in
| message.
|
| I quickly installed this last week, and haven't been at work much and
| just noticed now that I have no mail. I then set virus scanners = none
| in the /etc/MailScanner/MailScanner.conf file, and I seem to have mail
| coming in again.
|
| Mcafee seems to be working.....
|
| [root@ns1 root]# /usr/local/uvscan/uvscan --version
| Virus Scan for Linux v4.16.0
| Copyright (c) 1992-2003 Networks Associates Technology Inc. All rights
| reserved.(408) 988-3832  LICENSED COPY - Nov 13 2001
|
| Scan engine v4.3.20 for Linux.
| Virus data file v4400 created Oct 20 2004
| Scanning for 104507 viruses, trojans and variants.
|
| Anyone else run into this? And where did all my mail go that didn't get
| delivered? Did it get deleted? I don't see it in the quarantine.
|
| Thanks.
Viruscan for Linux is currently at 4.32.0. You probably need to upgrade.
Even though the engine looks current, there is probably some other
problem with the older version interacting with the engine.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBeA8IRADw9lziUqQRApKYAJ9Nf6rekcYAyX7YdulhHdCxuxC5wgCfU6B/
9ayUMhZ9t48ofGU+I+VJOQI=
=Af55
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 21 21:26:09 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3827.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I have just released version 4.35.5.

This includes support for ClamAV 0.80 and Mail::ClamAV 0.12.
I have removed support for 0.75 and 0.11, as there is no reliable way of
supporting both due to changes in the ClamAV library definitions.

I have also published an updated install-ClamAV-SA.tar.gz as well, which
includes the new versions of ClamAV and Mail::ClamAV.

Download as usual from www.mailscanner.info.

The full Changelog is this:

* New Features and Improvements *
- SpamAssassin 3 SPF checks are now fully supported.
- Added Disposition-Notification-To and Return-Receipt-To to the list of
   headers I advise you to remove.
- Added "Log Silent Viruses" configuration option.
- Mandrake Linux 10 is now supported by the RPM installation script.
- Added new configuration option "Find Phishing Fraud". This will scan HTML
   messages for links which don't link to the site they appear to. This
   should catch most "phishing" fraud attacks. It uses new text in the
   languages.conf file, so you will need to add the extra lines to yours.
- Added support for F-Secure 4.6x.
- Removed pre-built tnef programs from bin directory of distribution.
- Moved "virusscan" from "First" to "All".
- Tweaked generic-autoupdate so it apparently does nothing.
- Support Mail::ClamAV 0.12 and upwards. Dropped support for 0.11.
- Support ClamAV 0.80 and upwards. Dropped support for 0.75 and earlier.

* Fixes *
- Fixed bug where filetype checks that matched no rules were not logged
   properly.
- Fixed problems with MIME::Base64 dependencies.
- Fixed bug with @INC path reversal when loading MIME::Base64 and
   MIME::QuotedPrint.
- Fixed bug where MCP files were quarantined with the wrong owner.
- Fixed bug where MCP files were incorrectly logged if they were also spam.
- Fixed issue where Postfix insisted (quite correctly) on having a space
   after "Subject:" in the headers.
- Moved Envelope-From header for SpamAssassin to the top of the headers sent
   to SpamAssassin.
- Fixed existence check bug in antivir-autoupdate.
- Fixed problem where some parent reports were masked by child reports.
- Fixed problem with rules with multiple results and multiple tests.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Thu Oct 21 21:28:46 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3828.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:20 21/10/2004, you wrote:
>Any chance MS is timing SA out and killing it repeatedly? (this can happen
>if SA does expiry and it takes too long for MailScanner's rather absurdly
>short default timeout).

What timeout would you consider less "absurd"?
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wright at CYBERVALE.COM  Thu Oct 21 20:34:06 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3829.1137101241.24926.mailscanner@lists.mailscanner.info>

I've got 1.21 and apparently SA doesn't like it

----- Original Message -----
From: "Raymond Dijkxhoorn" <raymond@PROLOCATION.NET>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Thursday, October 21, 2004 3:22 PM
Subject: Re: perl-URI-1.31.1.src.rpm


> Hi!
>
> > Can someone please provide me with rpm it refuses to build on my RH9
> > box, Perl Version 5.8
>
> What about the one thats inside your RedHat 9 distribution?
>
> Bye,
> Raymond.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jeff.Mills at POCOLD.COM.AU  Fri Oct 22 04:41:56 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3830.1137101241.24926.mailscanner@lists.mailscanner.info>

This beta version still will not run on my system.
4.33.3 is working fine.

./MailScanner --version
Can't locate MIME/Decoder/BinHex.pm in @INC (@INC contains: /opt/MailScanner/lib /etc/perl /usr/lib/perl5/site_perl/5.8.4/i686-linux /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.4/i686-linux /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.2/i686-linux /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl /usr/lib/perl5/5.8.4/i686-linux /usr/lib/perl5/5.8.4 /usr/local/lib/site_perl /usr/lib/perl5/site_perl/5.8.2/i686-linux /usr/lib/perl5/site_perl/5.8.2 . /opt/MailScanner/lib) at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
BEGIN failed--compilation aborted at /opt/MailScanner/lib/MailScanner/Message.pm line 42.
Compilation failed in require at ./MailScanner line 71.
BEGIN failed--compilation aborted at ./MailScanner line 71.

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Gerry Doris
> Sent: Friday, 22 October 2004 1:06 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner: Beta 4.35.5 released
> 
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wlamore at MSN.COM  Fri Oct 22 06:40:49 2004
From: wlamore at MSN.COM (Bill Lamoreaux)
Date: Thu Jan 12 21:27:21 2006
Subject: Solaris 9 Install
Message-ID: <mailman.3831.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>

<META content="MSHTML 6.00.2900.2523" name=GENERATOR></HEAD>
<BODY>
<DIV>&nbsp;</DIV>
<DIV><BR><SPAN class=378042505-22102004><FONT face=Arial size=2>In the 
installation guide for Solaris 9 a list of Perl Modules are listed to download 
and the site <A href="http://www.mailscanner.info">www.mailscanner.info</A> is 
listed as the site of the downloads.&nbsp;&nbsp; We could not locate the 
modules?&nbsp; Was this perhaps a misprint?</FONT></SPAN></DIV>
<DIV><SPAN class=378042505-22102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=378042505-22102004><FONT face=Arial size=2>Also is the ClamAv 
non-RPM&nbsp;(listed below)&nbsp;installation no longer part of the full install 
for MailScanner and SpamAssassin 3.0 for Solaris 9?&nbsp; &nbsp;A fresh install 
of Solaris 9 does not seem to have the basics needed to successfully get the two 
up and running to scan mail? </FONT></SPAN></DIV>
<DIV><SPAN class=378042505-22102004><FONT>&nbsp;</DIV>
<DIV><A 
href="http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/install-Clam-SA-0.80.tar.gz"></FONT><FONT 
face=Arial size=2>RPM and non-RPM installations</A><FONT face=Arial 
size=2> of all the modules required for ClamAV 0.80 (for the "clamavmodule" 0.12 
scanner) and SpamAssassin 3.0.0.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><SPAN class=378042505-22102004><FONT face=Arial 
size=2>Thanks</FONT></SPAN></DIV>
<DIV><SPAN class=378042505-22102004><FONT face=Arial size=2>William Lamoreaux 
</FONT></SPAN></DIV></FONT></SPAN>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV>Perl Modules<BR>============<BR>From www.mailscanner.info, 
download<BR>IO-stringy<BR>MIME-Base64<BR>MailTools<BR>File-Spec<BR>HTML-Tagset<BR>HTML-Parser<BR>MIME-tools<BR>patches 
1 - 4<BR>File-Temp<BR>TNEF-Convert<BR><BR>ln -s gcc 
/usr/local/bin/cc<BR><BR></DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV>&nbsp;</DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Oct 22 07:17:04 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3832.1137101241.24926.mailscanner@lists.mailscanner.info>

Hi Jeff,

> This beta version still will not run on my system.

what kind of system is "your" system? OS?


> ./MailScanner --version
> Can't locate MIME/Decoder/BinHex.pm in @INC (@INC contains:

Well then install the BinHex module (from RPM, CPAN whatever...) and all
will be fine.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Oct 22 07:26:19 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3833.1137101241.24926.mailscanner@lists.mailscanner.info>

Hi Julian,

> I have just released version 4.35.5.

FreeBSD port mailscanner-devel is submitted.

Regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jeff.Mills at POCOLD.COM.AU  Fri Oct 22 07:41:10 2004
From: Jeff.Mills at POCOLD.COM.AU (Jeff Mills)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3834.1137101241.24926.mailscanner@lists.mailscanner.info>

Sorry,
its a Gentoo Linux system.
I'm sure BinHex is installed, otherwise the old version wouldnt work either would it?

Will check on Monday.
Thanks.

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Jan-Peter Koopmann
> Sent: Friday, 22 October 2004 4:17 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner: Beta 4.35.5 released
> 
> 
> Hi Jeff,
> 
> > This beta version still will not run on my system.
> 
> what kind of system is "your" system? OS?
> 
> 
> > ./MailScanner --version
> > Can't locate MIME/Decoder/BinHex.pm in @INC (@INC contains:
> 
> Well then install the BinHex module (from RPM, CPAN 
> whatever...) and all
> will be fine.
> 
> Regards,
>   JP
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Oct 22 08:25:00 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3835.1137101241.24926.mailscanner@lists.mailscanner.info>

On Friday, October 22, 2004 8:41 AM MailScanner mailing list wrote:

> its a Gentoo Linux system.
> I'm sure BinHex is installed, otherwise the old version wouldnt work
> either would it? 

Well: It complains that it cannot find BinHex.pm which to me means that
it is either not installed or not installed correctly. Please recheck. 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Fri Oct 22 01:42:29 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:21 2006
Subject: Update MailScanner and Mail::ClamAV
Message-ID: <mailman.3836.1137101241.24926.mailscanner@lists.mailscanner.info>

OK ... Sorry for the waste of bandwidth ... This was already answered. I
have ClamAV 0.80 so I should now be able to install Mail::ClamAV 0.12.

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dave Filchak
Sent: Thursday, October 21, 2004 5:19 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: [MAILSCANNER] Update MailScanner and Mail::ClamAV

So, does one install the update to MailScanner first and then update
Mail::ClamAV or the other way 'round?

Dave

Dave Filchak - President
Zuka Inc. | ScreamingMedia
www.zuka.net | www.screamingmedia.ca

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Steve.Swaney at FSL.COM  Fri Oct 22 02:07:41 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3837.1137101241.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Julian Field
> Sent: Thursday, October 21, 2004 4:26 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: MailScanner: Beta 4.35.5 released
>
> I have just released version 4.35.5.
>
An I have just installed 4.35.5 on our Tao Linux and WhiteBox Linux test
systems after installing ClamAV 0.80.

Install went flawlessly and the really good news;

yum updates after the install also worked flawlessly :)
CPAN install of Mail::ClamAV also worked flawlessly :)

Mailscanner and SpamAssassin 3.0 are working as expected on both systems.

Many thanks for sorting the clamav & perl / up2date problems out. Not a
simple task.

Steve
Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at CAMAROSS.NET  Fri Oct 22 02:11:06 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3838.1137101241.24926.mailscanner@lists.mailscanner.info>

Terran Wright wrote:
> I've got 1.21 and apparently SA doesn't like it
>
> ----- Original Message -----
> From: "Raymond Dijkxhoorn" <raymond@PROLOCATION.NET>
> To: <MAILSCANNER@JISCMAIL.AC.UK>
> Sent: Thursday, October 21, 2004 3:22 PM
> Subject: Re: perl-URI-1.31.1.src.rpm
>
>
>> Hi!
>>
>>> Can someone please provide me with rpm it refuses to build on my RH9
>>> box, Perl Version 5.8
>>
>> What about the one thats inside your RedHat 9 distribution?
>>
>> Bye,
>> Raymond.


I'm running RHEL3 with perl-URI-1.21-7 with SA and it works fine.  What
problem is SA giving you?

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From gdoris at ROGERS.COM  Fri Oct 22 04:05:47 2004
From: gdoris at ROGERS.COM (Gerry Doris)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3839.1137101241.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-10-21 at 21:07, Steve Swaney wrote:
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Julian Field
> > Sent: Thursday, October 21, 2004 4:26 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: MailScanner: Beta 4.35.5 released
> >
> > I have just released version 4.35.5.
> >
> An I have just installed 4.35.5 on our Tao Linux and WhiteBox Linux test
> systems after installing ClamAV 0.80.
>
> Install went flawlessly and the really good news;
>
> yum updates after the install also worked flawlessly :)
> CPAN install of Mail::ClamAV also worked flawlessly :)
>
> Mailscanner and SpamAssassin 3.0 are working as expected on both systems.
>
> Many thanks for sorting the clamav & perl / up2date problems out. Not a
> simple task.
>
> Steve

Well, I have ClamAV 0.80 installed and had Mail::ClamAV 0.11 working.  I
tried upgrading to Mail::ClamAV 0.12 and it failed.  I have MS 4.35.5
installed.  Now MS can no longer find the clamav perl module.  I guess
I'll have to go back to just calling clamav until this is worked out.

I'm using Fedora Core 2.

--
Gerry Doris <gdoris@rogers.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ugob at CAMO-ROUTE.COM  Fri Oct 22 03:49:50 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3840.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Terran Wright wrote:
> Mike,
>
> I read that and tried 1.33, but I'm no better off. If I get the rpm I should
> be on my way.
>

Why don't you tell us what is wrong instead?  This is the purpose of
this list, after all...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From dfilchak at sympatico.ca  Thu Oct 21 22:19:28 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:21 2006
Subject: Update MailScanner and Mail::ClamAV
Message-ID: <mailman.3841.1137101241.24926.mailscanner@lists.mailscanner.info>

So, does one install the update to MailScanner first and then update
Mail::ClamAV or the other way 'round?

Dave

Dave Filchak - President
Zuka Inc. | ScreamingMedia
www.zuka.net | www.screamingmedia.ca

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mike at CAMAROSS.NET  Thu Oct 21 22:33:04 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3842.1137101241.24926.mailscanner@lists.mailscanner.info>

>From my first search return on Google, I found this:


"The version you are using is *not* the most recent version -- the author
has uploaded a v1.33 -- and (b) one of the changes he made in 1.33 was a
correction to the test in question in test file 'heuristic.t'.

So why not give v1.33 a try!"

Mike


________________________________

From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Terran Wright
Sent: Thursday, October 21, 2004 12:59 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: perl-URI-1.31.1.src.rpm


Can someone please provide me with rpm it refuses to build on my RH9 box,
Perl Version 5.8

t/heuristic......FAILED test 7
        Failed 1/15 tests, 93.33% okay

TIA
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wright at CYBERVALE.COM  Thu Oct 21 22:35:47 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3843.1137101241.24926.mailscanner@lists.mailscanner.info>

Mike,

I read that and tried 1.33, but I'm no better off. If I get the rpm I should
be on my way.

Thanks

> >From my first search return on Google, I found this:
>
>
> "The version you are using is *not* the most recent version -- the author
> has uploaded a v1.33 -- and (b) one of the changes he made in 1.33 was a
> correction to the test in question in test file 'heuristic.t'.
>
> So why not give v1.33 a try!"
>
> Mike
>
>
> Can someone please provide me with rpm it refuses to build on my RH9 box,
> Perl Version 5.8
>
> t/heuristic......FAILED test 7
>         Failed 1/15 tests, 93.33% okay
>
> TIA

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From peter at UCGBOOK.COM  Thu Oct 21 21:36:35 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:21 2006
Subject: Sys::Hostname::Long
Message-ID: <mailman.3844.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I'm testing SA3 on a Solaris 9 server. I installed SA from CPAN and it
didn't pull any prerequisites at all, SA2.64 was previously installed on
the server. If I do a version check with MS I don't have the
Sys::Hostname::Long module that caused trouble for those of us not
running GNU systems. It still works, at least it detects GTUBE and so on
and it doesn't complain when I run it from the prompt or in the mail log
when fed through MS.

So, does anyone know if that module is really necessary? Since it's
badly written I don't want it on my systems if I can avoid it.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ree at THUNDERSTAR.NET  Fri Oct 22 09:03:53 2004
From: ree at THUNDERSTAR.NET (Ron E.)
Date: Thu Jan 12 21:27:21 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3845.1137101241.24926.mailscanner@lists.mailscanner.info>

On Thu, 21 Oct 2004, Matt Kettler wrote:

> At 02:25 PM 10/21/2004, Ron E. wrote:
> >Dear All,
> >
> >         Hopefully someone has an idea for me - I have a server that
> >normally handles it's traffic load but this morning has started
> >backlogging - I ran MailScanner in debug mode and the only real point of
> >long delay I saw coming up repeatedly is:
> >
> >debug: bayes: Can't use estimation method for expiry, something fishy,
> >calculating optimal atime delta (first pass)
> >debug: bayes: expiry max exponent: 9
> >
> >The above messages I have only sometimes seen before when doing a bayes
> >database rebuild, but not always.
> >
> >Anyone have any ideas why this is happening repeatedly within one
> >MailScanner batch and how I can alleviate it?
>
> Any chance MS is timing SA out and killing it repeatedly? (this can happen
> if SA does expiry and it takes too long for MailScanner's rather absurdly
> short default timeout).
>
> If this is the case, Re-quoting myself from a post to the SA user's list:
> --------------------------------
> In the short term, you can help by running a sa-learn --force-expire on
> your bayes DB.
>
> In the longer term, here's some suggestions I use on my own MailScanner
> server: (I use all of these together)
>
> 1) Increase the spamassassin timeout in MailScanner.conf. Bring it to 60
> seconds at least, I have mine set to 120.
>
> 2) Set the "Rebuild Bayes Every" parameter in MailScanner.conf. 86400
> seconds is a good start. This makes MailScanner invoke SA's bayes
> housekeeping directly, rather than during a scan of a message.
>
> 3) in /etc/mail/spamassassin/local.cf set: bayes_auto_expire 0. This will
> keep SA from trying to run bayes expires (long and slow) during message
> handling, but relies on #2 above to allow expiry to occur.
>
> 4) I also have a sa-learn --force-expire running as a daily cronjob. I have
> tested the setup without this measure, and #2 is sufficient to cause expiry
> to occur. Really this is just a fail-safe to allow expiry to occur even if
> MailScanner's calls fail to run it properly for some reason.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

Hi Matt -

        Thanks very much - I think that is very likely what's happening
and actually it makes sense as that is probably the cause of some other
timeouts I've had trouble tracking down. As it happens after I posted the
above, I thought that I should probably do a rebuild manually which I did
in addition to the suggestions you make above. Anyway, looks good so far
and no more backlog.

Regards,

Ron

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Fri Oct 22 10:13:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Solaris 9 Install
Message-ID: <mailman.3846.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-html>
<HTML>
<HEAD>
<TITLE>Re: Solaris 9 Install</TITLE>
</HEAD>
<BODY>
<FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'>You can now do pretty much the entire installation by just downloading the Solaris distribution of MailScanner and running the ./install.sh script within it.<BR>
You will still need the sunfreeware.com stuff so that the installation can build itself. But &nbsp;you shouldn&#8217;t need to add any Perl modules to it.<BR>
<BR>
If you want to then install ClamAV and SpamAssassin, there is another package listed in the &#8220;Other Stuff&#8221; bit of the downloads page that will give you all that as well.<BR>
<BR>
Sorry the docs are out of date, I must fix that when I get time.<BR>
<BR>
Unless you fancy fixing the docs for me based on your setup? That would save me time :-)<BR>
<BR>
<BR>
On 22/10/04 6:40 am, &quot;Bill Lamoreaux&quot; &lt;wlamore@MSN.COM&gt; wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'> <BR>
<BR>
</SPAN></FONT><SPAN STYLE='font-size:12.0px'><FONT FACE="Arial">In the installation guide for Solaris 9 a list of Perl Modules are listed to download and the site www.mailscanner.info <a href="http://www.mailscanner.info">&lt;http://www.mailscanner.info&gt;</a> &nbsp;is listed as the site of the downloads. &nbsp;&nbsp;We could not locate the modules? &nbsp;Was this perhaps a misprint?<BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"> <BR>
</FONT><FONT FACE="Arial">Also is the ClamAv non-RPM (listed below) installation no longer part of the full install for MailScanner and SpamAssassin 3.0 for Solaris 9? &nbsp;&nbsp;A fresh install of Solaris 9 does not seem to have the basics needed to successfully get the two up and running to scan mail? <BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"> <BR>
</FONT><FONT FACE="Arial">RPM and non-RPM installations <a href="http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/install-Clam-SA-0.80.tar.gz">&lt;http://www.sng.ecs.soton.ac.uk/mailscanner/files/4/install-Clam-SA-0.80.tar.gz&gt;</a> &nbsp;of all the modules required for ClamAV 0.80 (for the &quot;clamavmodule&quot; 0.12 scanner) and SpamAssassin 3.0.0.<BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"> <BR>
</FONT><FONT FACE="Arial">Thanks<BR>
William Lamoreaux <BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"> <BR>
&nbsp;<BR>
&nbsp;<BR>
Perl Modules<BR>
============<BR>
From jaearick at COLBY.EDU  Fri Oct 22 13:57:35 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:21 2006
Subject: mystery Int/3Devils-a virus kills Sophos/MS
Message-ID: <mailman.3848.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Gang,

I had a strange incident yesterday where my mail server came to
an ugly halt when my (big) root partition filled up because of
core files in /var/spool/MailScanner/quarantine.   I had to blow
away things in this directory to get my problem fixed, so I
destroyed whatever evidence there was.  A study of syslogs after
the fact showed a bunch of entries like:

MailScanner[29997]: SophosSAVI::INFECTED:: Int/3Devils-a:: ./i9LCwNXc018783/core

So I've searched the Sophos website and googled for any information
on the Int/3Devils-a virus -- nothing.  I'm guessing that this thing
caused Sophos to core, causing my problem.  Has anybody else seen
mention of this virus in their system logs?  Got one quarantined?
I'm going to write to Sophos and ask them about this mystery virus.
Anybody else seen this?

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From BBerglund at TECHPRO.COM  Fri Oct 22 14:30:19 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:21 2006
Subject: LDAP connection question
Message-ID: <mailman.3849.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>I am trying to setup 
my postfix and use the getadsmtp.pl script that is on their website. 
</FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>Here is my dillema. 
</FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>I want to connect to 
a server that is connected to our vpn. </FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>The server is 
on</FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>172.26.55.1 network 
and i am on a 172.26.2.1 network. </FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>I need to add the 
domaincontroller.domain.com to a host file I would think so that when I tell the 
script to connect, it will connect over that ip. 
<BR>right?<BR></FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>Is anyone else 
setting this up?<BR></FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>Basically we are 
setting up a relay server for our clients exchange servers to block bullsh*t 
email addresses.</FONT></SPAN></DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=482322713-22102004><FONT face=Arial size=2>Does this make 
sense?<BR></DIV></FONT></SPAN>
<DIV>&nbsp;</DIV>
<DIV align=left>
<MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=3 direction=right behavior=slide loop=1 border="0">
<TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD>
      <DIV 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
      Berglund</DIV></TD>
    <TD></TD></TR>
  <TR>
    <TD>
      <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
      href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
<BR>
<MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=5 behavior=slide loop=1 border="2">
<TABLE cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
      src="cid:482322713@22102004-1785" width=110 border=0></A></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
      Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
      Boulevard<BR>Geneva, IL 60134 
</TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
<BR>
<TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD align=right colSpan=2><A 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
      href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
      m</A><BR></TD></TR></TBODY></TABLE>
<DIV style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
<DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
e-mail and any accompanying documents is confidential, may be privileged, and is 
intended solely for the person and/or entity to whom it is addressed (i.e. those 
identified in the "To" and "Cc" box). They are the property of TechPro, Inc. 
Unauthorized review, use, disclosure, or copying of this communication, or any 
part thereof, is strictly prohibited and may be unlawful. If you have received 
this e-mail in error, please return the e-mail and attachments to the sender and 
delete the e-mail and attachments and any copy from your system. TechPro, Inc. 
Thank you for your cooperation.</SPAN> </DIV>
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo10.gif: 00000001,147b0923,00000000,00000000

From BBerglund at TECHPRO.COM  Fri Oct 22 14:35:34 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:21 2006
Subject: getadsmtp.pl error
Message-ID: <mailman.3850.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=807053513-22102004><FONT face=Arial size=2>I installed the perl 
files. </FONT></SPAN></DIV>
<DIV><SPAN class=807053513-22102004><FONT face=Arial 
size=2>Net::LDAP</FONT></SPAN></DIV>
<DIV><SPAN class=807053513-22102004><FONT face=Arial 
size=2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=807053513-22102004><FONT face=Arial size=2>and I still get this 
error.&nbsp; How do I solve?<BR></FONT></SPAN></DIV>
<DIV><SPAN class=807053513-22102004><FONT face=Arial size=2>[root@linux-relay1 
postfix]# ./getadsmtp.pl<BR>Can't locate Net/LDAP.pm in @INC (@INC contains: 
/usr/lib/perl5/5.8.3/i386-linux-thread-multi /usr/lib/perl5/5.8.3 
/usr/lib/perl5/site_perl/5.8.3/i386-linux-thread-multi 
/usr/lib/perl5/site_perl/5.8.2/i386-linux-thread-multi 
/usr/lib/perl5/site_perl/5.8.1/i386-linux-thread-multi 
/usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi 
/usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2 
/usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0 
/usr/lib/perl5/site_perl 
/usr/lib/perl5/vendor_perl/5.8.3/i386-linux-thread-multi 
/usr/lib/perl5/vendor_perl/5.8.2/i386-linux-thread-multi 
/usr/lib/perl5/vendor_perl/5.8.1/i386-linux-thread-multi 
/usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi 
/usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2 
/usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0 
/usr/lib/perl5/vendor_perl) at ./getadsmtp.pl line 11.<BR>BEGIN 
failed--compilation aborted at ./getadsmtp.pl line 11.<BR></DIV></FONT></SPAN>
<DIV>&nbsp;</DIV>
<DIV align=left>
<MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=3 direction=right behavior=slide loop=1 border="0">
<TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD>
      <DIV 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
      Berglund</DIV></TD>
    <TD></TD></TR>
  <TR>
    <TD>
      <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
      href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
<BR>
<MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=5 behavior=slide loop=1 border="2">
<TABLE cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
      src="cid:807053513@22102004-178C" width=110 border=0></A></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
      Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
      Boulevard<BR>Geneva, IL 60134 
</TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
<BR>
<TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD align=right colSpan=2><A 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
      href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
      m</A><BR></TD></TR></TBODY></TABLE>
<DIV style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
<DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
e-mail and any accompanying documents is confidential, may be privileged, and is 
intended solely for the person and/or entity to whom it is addressed (i.e. those 
identified in the "To" and "Cc" box). They are the property of TechPro, Inc. 
Unauthorized review, use, disclosure, or copying of this communication, or any 
part thereof, is strictly prohibited and may be unlawful. If you have received 
this e-mail in error, please return the e-mail and attachments to the sender and 
delete the e-mail and attachments and any copy from your system. TechPro, Inc. 
Thank you for your cooperation.</SPAN> </DIV>
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo11.gif: 00000001,680b4c40,00000000,00000000

From rcooper at DWFORD.COM  Fri Oct 22 13:57:45 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner: Beta 4.35.5 released
Message-ID: <mailman.3851.1137101241.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Gerry Doris
> Sent: Thursday, October 21, 2004 10:06 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner: Beta 4.35.5 released
>
>
> On Thu, 2004-10-21 at 21:07, Steve Swaney wrote:
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > Behalf Of Julian Field
> > > Sent: Thursday, October 21, 2004 4:26 PM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: MailScanner: Beta 4.35.5 released
> > >
> > > I have just released version 4.35.5.
> > >
> > An I have just installed 4.35.5 on our Tao Linux and WhiteBox Linux test
> > systems after installing ClamAV 0.80.
> >
> > Install went flawlessly and the really good news;
> >
> > yum updates after the install also worked flawlessly :)
> > CPAN install of Mail::ClamAV also worked flawlessly :)
> >
> > Mailscanner and SpamAssassin 3.0 are working as expected on
> both systems.
> >
> > Many thanks for sorting the clamav & perl / up2date problems out. Not a
> > simple task.
> >
> > Steve
>
> Well, I have ClamAV 0.80 installed and had Mail::ClamAV 0.11 working.  I
> tried upgrading to Mail::ClamAV 0.12 and it failed.  I have MS 4.35.5
> installed.  Now MS can no longer find the clamav perl module.  I guess
> I'll have to go back to just calling clamav until this is worked out.
>
> I'm using Fedora Core 2.
>
> --

What was the failure with the Mail::ClamAV install? If it had to do with not
finding libclamav.so.1 (it will appear toward the top of the make test
output), then check /etc/ld.so.conf for the line /usr/local/lib (unless you
changed the standard install directories). If it's not there, add it and
then run ldconfig then "cpan -i Mail::ClamAV" and you should be set. I found
that in every Fedora Core 2 installation I had, the LD path for clamav was
not added properly even though it appeared to have been done during
installation.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From housey at TALK21.COM  Fri Oct 22 16:41:55 2004
From: housey at TALK21.COM (Paul Houselander)
Date: Thu Jan 12 21:27:21 2006
Subject: WhiteList & Blacklist in CustomConfig.pm
Message-ID: <mailman.3852.1137101241.24926.mailscanner@lists.mailscanner.info>

Hi

I have a domain that I know I will only recieve email
from a paticular set of IP addresses.

I want to block any mail for this domain that does not
come from these paticular IP addresses.

I was looking at using the whitelist/blacklist
function in CustomConfig.pm,

I would set up a whitelist in the whitelist directory
called domain.co.uk and add to it the IP addresses of
the servers I know I recieve mail from.

Then set up a blacklist in the blacklist directory
called domain.co.uk, my question is can I just use *
to indicate block everything?

Am I correct in saying that this gets looked at before
any virus/spamassasin scanning?

Thanks

Paul Houselander







___________________________________________________________ALL-NEW Yahoo! Messenger - all new features - even more fun!  http://uk.messenger.yahoo.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Fri Oct 22 20:18:42 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:21 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3853.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 04:28 PM 10/21/2004, Julian Field wrote:
> >Any chance MS is timing SA out and killing it repeatedly? (this can happen
> >if SA does expiry and it takes too long for MailScanner's rather absurdly
> >short default timeout).
>
>What timeout would you consider less "absurd"?

Well, the default is 40 seconds. Way too short given SA's tendency to
wander off and do some DB maintenance (journal sync, expiry, etc) whenever
it feels the need.

As I said in the previous mail, I'd consider 60 seconds a bare minimum, but
even that will result in quite a few timeouts if the auto expire feature
isn't turned off. Perhaps 90 would be better.

I use 120 seconds AND I have auto expire off.
(/etc/mail/spamassassin/local.cf:bayes_auto_expire 0)

Even then once in a rare while SA does an expiry during a message scan
anyway (bug in 2.64?), and MailScanner kills it, leaving a
bayes_toks.expire* file behind.

Did it just a couple days ago on the 20th. In general it's fairly rare.
Still bayes expiry is very slow in SA, and it's a behavior SA sometimes
engages in during message scans.

I have not seen MS kill SA for any reason other than bayes expiry in at
least a year or so. (ever since I set my DNS timeouts in SA to something
shorter than MailScanner's SA timeout, that's not been a problem, it's
always bayes expiry).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From Denis.Beauchemin at USHERBROOKE.CA  Fri Oct 22 20:34:53 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner book
Message-ID: <mailman.3854.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello,

I finally had some time to read my MS book.  So far it is a very good 
investment.  It made me check my syslog.conf settings on 2 of my new MS 
servers and I had forgotten to put the hyphen before 
/var/log/maillog...  needless to say that the servers were quite busy...

Two comments about RHEL installation:

   1. please tell people to install a firewall and let port 25 through.
   2. MySQL is still available, but it is on the Extras CD (must be
      installed after the initial OS install)

I was also surprised to see my name in the contributors section.  It is 
true I helped Steve out with the beta releases of the book...  
nonetheless it is good for the ego! ;-)

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From BBerglund at TECHPRO.COM  Fri Oct 22 20:54:11 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:21 2006
Subject: .local addresses with getadsmtp.pl
Message-ID: <mailman.3855.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=628205219-22102004><FONT face=Arial size=2>What is the filter 
to not grab certain email addresses?<BR></FONT></SPAN></DIV>
<DIV><SPAN class=628205219-22102004><FONT face=Arial size=2>Like I only want the 
.com addresses in my active directory.</DIV></FONT></SPAN>
<DIV>&nbsp;</DIV>
<DIV align=left>
<MARQUEE id=MarqueeTop style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=3 direction=right behavior=slide loop=1 border="0">
<TABLE id=Table1 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD>
      <DIV 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; FONT-FAMILY: Trebuchet MS">Brian 
      Berglund</DIV></TD>
    <TD></TD></TR>
  <TR>
    <TD>
      <DIV style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma">Engineer</DIV></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><A 
      href="mailto:bberglund@techpro.com"></B><B>bberglund@techpro.com</A><BR></TD></TR></TBODY></TABLE></MARQUEE></DIV>---------------------------------------------------------- 
<BR>
<MARQUEE id=MarqueeBottom style="WIDTH: 348px" trueSpeed scrollAmount=1 
scrollDelay=5 behavior=slide loop=1 border="2">
<TABLE cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD><A href="http://www.techpro.com/" target=_blank><IMG height=81 
      src="cid:628205219@22102004-17CB" width=110 border=0></A></TD>
    <TD 
    style="FONT-SIZE: 10pt; LINE-HEIGHT: 20px; FONT-FAMILY: arial; TEXT-ALIGN: right"><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Line</SPAN>:<B>&nbsp;630&nbsp;.938&nbsp;.5303</B><BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Direct 
      Fax</SPAN>:&nbsp;630&nbsp;.845&nbsp;.4603<BR><SPAN 
      style="FONT-WEIGHT: bold; COLOR: #f57900">Toll 
      Free</SPAN>:&nbsp;800&nbsp;.262&nbsp;.0537 ext.103<BR>318 Anderson 
      Boulevard<BR>Geneva, IL 60134 
</TD></TR></TBODY></TABLE></MARQUEE><BR>---------------------------------------------------------- 
<BR>
<TABLE id=Table2 cellPadding=0 width=348 border=0 cellspaing="0">
  <TBODY>
  <TR>
    <TD align=right colSpan=2><A 
      style="FONT-WEIGHT: bold; FONT-SIZE: 14pt; COLOR: #ababab; FONT-FAMILY: Trebuchet MS; text-underline: none" 
      href="http://www.techpro.com/" target=_blank>w w w . t e c h p r o . c o 
      m</A><BR></TD></TR></TBODY></TABLE>
<DIV style="FONT-SIZE: 7.5pt; FONT-FAMILY: Arial; TEXT-ALIGN: justify"><BR><BR>
<DIV style="COLOR: navy; TEXT-ALIGN: center">TechPro E-Mail 
Disclaimer</DIV><SPAN style="COLOR: gray">The information contained in this 
e-mail and any accompanying documents is confidential, may be privileged, and is 
intended solely for the person and/or entity to whom it is addressed (i.e. those 
identified in the "To" and "Cc" box). They are the property of TechPro, Inc. 
Unauthorized review, use, disclosure, or copying of this communication, or any 
part thereof, is strictly prohibited and may be unlawful. If you have received 
this e-mail in error, please return the e-mail and attachments to the sender and 
delete the e-mail and attachments and any copy from your system. TechPro, Inc. 
Thank you for your cooperation.</SPAN> </DIV>
<DIV>&nbsp;</DIV></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>
Embedded Content: techpro_email_logo12.gif: 00000001,1e1fc22f,00000000,00000000

From p.bos at LAKE.XS4ALL.NL  Fri Oct 22 21:17:29 2004
From: p.bos at LAKE.XS4ALL.NL (Piet Bos)
Date: Thu Jan 12 21:27:21 2006
Subject: Upgrade 4.34.8-4 and postfix 2.1.5
Message-ID: <mailman.3856.1137101241.24926.mailscanner@lists.mailscanner.info>

Hello all,
I've just completed the upgrade from ancient versions of both packages.
Just left me with a couple of questions.
1. SPAM is flagged in the subject, there are no s'ses or * in the header, is
that OK?
2. Sent and received mail is not singned anymore with
"This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean"
is that OK
3. And I've not installe McAfee and Generic virus scanners but
'update_virus_scanners' logs that Generic and McAfee are found im my
configuration, how come?

cheers Piet.
--
Piet Bos
p.bos@lake.ath.cx

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wright at CYBERVALE.COM  Fri Oct 22 20:41:15 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:21 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.3857.1137101241.24926.mailscanner@lists.mailscanner.info>

> Terran Wright wrote:
> > Mike,
> >
> > I read that and tried 1.33, but I'm no better off. If I get the rpm I
should
> > be on my way.
> >
>
> Why don't you tell us what is wrong instead?  This is the purpose of
> this list, after all...

Ugo, Mike,

Thanks and my apologies for being stubborn, I didn't want to include too
much detail as I figured I knew the exact problem. I didn't however.

Basically the rpmbuild fails because of the failure in the heuristic test
while using install-clam-sa package. I had perl-URI-1.21, then upgraded to
1.33, but it still tried to install 1.31 and complained. I let it run to
completion and the installation seems ok as spam checks are being done. I
just need to tweak sa now to filter out those that are still getting
through.

Thanks guys

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Fri Oct 22 22:23:26 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:21 2006
Subject: Upgrade 4.34.8-4 and postfix 2.1.5
Message-ID: <mailman.3858.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Piet Bos wrote:

>Hello all,
>I've just completed the upgrade from ancient versions of both packages.
>Just left me with a couple of questions.
>1. SPAM is flagged in the subject, there are no s'ses or * in the header, is
>that OK?
>
>
Is there a score instead? If so have a look in MailScanner.conf to set
your preference.

>2. Sent and received mail is not singned anymore with
>"This message has been scanned for viruses and dangerous content by
>MailScanner, and is believed to be clean"
>is that OK
>
>
Again it's a preference thing.

>3. And I've not installe McAfee and Generic virus scanners but
>'update_virus_scanners' logs that Generic and McAfee are found im my
>configuration, how come?
>
>
Generic is where you can put your own applications such as certain regex
files for virus detection (Not a function I have looked at yet so sorry
if I am vague or wrong!). Have you install McAfee on your machine
previously and forgotten? MS updates all virus scanner on your machine
not just those used and listed in MailScanner.conf

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 04:38:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner book
Message-ID: <mailman.3859.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:34 22/10/2004, you wrote:
>I finally had some time to read my MS book.  So far it is a very good
>investment.

That's really good news, I'm glad you like it and find it useful.

>   It made me check my syslog.conf settings on 2 of my new MS servers and
> I had forgotten to put the hyphen before /var/log/maillog...  needless to
> say that the servers were quite busy...
>
>Two comments about RHEL installation:
>
>   1. please tell people to install a firewall and let port 25 through.
>   2. MySQL is still available, but it is on the Extras CD (must be
>      installed after the initial OS install)

I have passed that on to Steve for his next revision of his text.

>I was also surprised to see my name in the contributors section.  It is
>true I helped Steve out with the beta releases of the book...
>nonetheless it is good for the ego! ;-)

I try to give credit where I can, your input was very useful.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 04:33:45 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: WhiteList & Blacklist in CustomConfig.pm
Message-ID: <mailman.3860.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 16:41 22/10/2004, you wrote:
>Hi
>
>I have a domain that I know I will only recieve email
>from a paticular set of IP addresses.
>
>I want to block any mail for this domain that does not
>come from these paticular IP addresses.
>
>I was looking at using the whitelist/blacklist
>function in CustomConfig.pm,
>
>I would set up a whitelist in the whitelist directory
>called domain.co.uk and add to it the IP addresses of
>the servers I know I recieve mail from.
>
>Then set up a blacklist in the blacklist directory
>called domain.co.uk, my question is can I just use *
>to indicate block everything?

You don't use "*", you use "default". This will be over-ridden by any other
entries in the blacklist file for that domain, but you can just have a
single line saying "default" to provide the default value for that domain.


>Am I correct in saying that this gets looked at before
>any virus/spamassasin scanning?

The per-domain black/whitelist code in CustomConfig.pm was intended to be
used for the "Is Definitely Spam" and "Is Definitely Not Spam"
configuration options, but you can apply the same Custom Function to other
(or just several) configuration options.


>Thanks
>
>Paul Houselander
>
>
>
>
>
>
>
>___________________________________________________________ALL-NEW Yahoo!
>Messenger - all new features - even more fun!  http://uk.messenger.yahoo.com
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 04:43:53 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Upgrade 4.34.8-4 and postfix 2.1.5
Message-ID: <mailman.3861.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 22:23 22/10/2004, you wrote:
>Piet Bos wrote:
>>3. And I've not installe McAfee and Generic virus scanners but
>>'update_virus_scanners' logs that Generic and McAfee are found im my
>>configuration, how come?
>>
>Generic is where you can put your own applications such as certain regex
>files for virus detection (Not a function I have looked at yet so sorry
>if I am vague or wrong!). Have you install McAfee on your machine
>previously and forgotten? MS updates all virus scanner on your machine
>not just those used and listed in MailScanner.conf

I have already tweaked the generic-autoupdate script so that by default it
does nothing. If you are up to writing your own "scanner engine" then you
are also capable of editing 1 line in the autoupdate script, as you will
probably want to change that script anyway.

The update_virus_scanners job looks for all your installed scanners on the
basis of the virus.scanners.conf locations. It really does think you have
McAfee installed, even if you aren't currently using it. The reason for
updating ones you aren't using is so that if you suddenly decide to add
another scanning engine to your MailScanner.conf, you can do so safely in
the knowledge that it is already up to date as soon as you start using it.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 04:37:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3862.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:18 22/10/2004, you wrote:
>At 04:28 PM 10/21/2004, Julian Field wrote:
>> >Any chance MS is timing SA out and killing it repeatedly? (this can happen
>> >if SA does expiry and it takes too long for MailScanner's rather absurdly
>> >short default timeout).
>>
>>What timeout would you consider less "absurd"?
>
>Well, the default is 40 seconds. Way too short given SA's tendency to
>wander off and do some DB maintenance (journal sync, expiry, etc) whenever
>it feels the need.
>
>As I said in the previous mail, I'd consider 60 seconds a bare minimum, but
>even that will result in quite a few timeouts if the auto expire feature
>isn't turned off. Perhaps 90 would be better.
>
>I use 120 seconds AND I have auto expire off.
>(/etc/mail/spamassassin/local.cf:bayes_auto_expire 0)

Matt,

Thanks for that. I originally kept the timeout short as genuine SA timeout
problems did cause difficulty when I first implemented. But SA has improved
enormously since I first supported it, and I suspect you are right that it
is now time to increase the timeout quite a bit. The last increase I did
was from 30 to 40 seconds so SA had a chance to timeout DNS lookups before
it could be totally killed by MailScanner.

Thanks for your opinion, as ever :-)
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From p.bos at LAKE.XS4ALL.NL  Sat Oct 23 09:07:22 2004
From: p.bos at LAKE.XS4ALL.NL (Piet Bos)
Date: Thu Jan 12 21:27:21 2006
Subject: Upgrade 4.34.8-4 and postfix 2.1.5
Message-ID: <mailman.3863.1137101241.24926.mailscanner@lists.mailscanner.info>

----- Original Message -----
From: Drew Marshall

>1. SPAM is flagged in the subject, there are no s'ses or * in the header,
is
>that OK?
>
>
Is there a score instead? If so have a look in MailScanner.conf to set
your preference.

No there is no score what so ever.

<------EXAMPLE ------->
Subject: {Spam?} Your $500 Christmas Shopping Spree!
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="----=_Part_6204503_19872480.1098486739626"
X-est3: rneggzzemsvlrlvnszemnleg svlnnnmgmavea lnwllesaen
X-lake.xs4all.nl-MailScanner-Information: Please contact the ISP for more
information
X-lake.xs4all.nl-MailScanner: Found to be clean
X-lake.xs4all.nl-MailScanner-SpamCheck: spam, SBL+XBL
X-MailScanner-From: bounce-snxxxybycjoc@vokallo.com
Status: RO
<------EXAMPLE ------->
There is only a Subject tag and the MailScanner-SpamCheck flag in the header
every hint is welcome.

cheers Piet



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From p.bos at LAKE.XS4ALL.NL  Sat Oct 23 12:55:05 2004
From: p.bos at LAKE.XS4ALL.NL (Piet Bos)
Date: Thu Jan 12 21:27:21 2006
Subject: still some difficulties (was:Upgrade 4.34.8-4 and postfix 2.1.5)
Message-ID: <mailman.3864.1137101241.24926.mailscanner@lists.mailscanner.info>

I've noticed that my spam.blacklist.rules and spam.whitelist.rules are not
interpreted or parsed by MailScanner.
Did I miss some config items?

My MailScanner.conf file contains the following lines.

# Rulesets directory containing your ".rules" files
%rules-dir% = /etc/MailScanner/rules

And the /etc/MailScanner/rules directory contains the necessary files I
think.

[root@mailgate rules]# pwd
/etc/MailScanner/rules
[root@mailgate rules]# ll
total 28
-rw-r--r--    1 root     root          707 Oct  6 17:48 bounce.rules
-rw-r--r--    1 root     root         2817 Oct  6 17:48 EXAMPLES
-rw-r--r--    1 root     root         2767 Oct  6 17:48 README
-rw-r--r--    1 root     root         8456 Oct 23 13:10 spam.blacklist.rules
-rw-r--r--    1 root     root         3345 Oct 23 13:04 spam.whitelist.rules

greetz Piet
--
Piet Bos
p.bos@lake.ath.cx



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From peter at UCGBOOK.COM  Sat Oct 23 13:00:40 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:21 2006
Subject: still some difficulties (was:Upgrade 4.34.8-4 and postfix
    2.1.5)
Message-ID: <mailman.3865.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Piet Bos wrote:
> I've noticed that my spam.blacklist.rules and spam.whitelist.rules are not
> interpreted or parsed by MailScanner.
> Did I miss some config items?
>
> My MailScanner.conf file contains the following lines.
>
> # Rulesets directory containing your ".rules" files
> %rules-dir% = /etc/MailScanner/rules
>
> And the /etc/MailScanner/rules directory contains the necessary files I
> think.
>
> [root@mailgate rules]# pwd
> /etc/MailScanner/rules
> [root@mailgate rules]# ll
> total 28
> -rw-r--r--    1 root     root          707 Oct  6 17:48 bounce.rules
> -rw-r--r--    1 root     root         2817 Oct  6 17:48 EXAMPLES
> -rw-r--r--    1 root     root         2767 Oct  6 17:48 README
> -rw-r--r--    1 root     root         8456 Oct 23 13:10 spam.blacklist.rules
> -rw-r--r--    1 root     root         3345 Oct 23 13:04 spam.whitelist.rules

That's fine but what are these two set to?

Is Definitely Not Spam =
Is Definitely Spam =

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From p.bos at LAKE.XS4ALL.NL  Sat Oct 23 13:09:27 2004
From: p.bos at LAKE.XS4ALL.NL (Piet Bos)
Date: Thu Jan 12 21:27:21 2006
Subject: still some difficulties (was:Upgrade 4.34.8-4 and postfix
    2.1.5)
Message-ID: <mailman.3866.1137101241.24926.mailscanner@lists.mailscanner.info>

> That's fine but what are these two set to?
>
> Is Definitely Not Spam =
> Is Definitely Spam =

[Blush mode on]
Is Definitely Not Spam = %rules-dir%/spam.whitelist.rules
Is Definitely Spam = no
[Blush mode off]

I've seem to have missed some (at least one) essential parameter.
corrected in:

Is Definitely Spam = %rules-dir%/spam.blacklist.rules

thnx for the info.

cheers Piet



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Sat Oct 23 15:49:23 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3867.1137101241.24926.mailscanner@lists.mailscanner.info>

Hello Again:

The custom function sounds like it would work, so I would first set my:

Non spam actions = somefile.rules

In somefile.rules I put the default, to be deliver , and for my per domain
would be:

From: *@domain.com      ?
FromOrTo:       default deliver

Please let me know what I would put here, and how to envoke a custom
function, and if possible what this might look like,

Thanks,

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Friday, October 15, 2004 12:24 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

At 17:07 15/10/2004, you wrote:
>Good day:
>
>I had sent previously but missed the reply, if any.
>
>We have an application where we would need to have the following to occur:
>
> >From *@domain.com ,
>Copy that entire SMTP message to /anypath/MESSAGEREF.inc
>Put a file to /anypath/MESSAGEREF.add which contains each recipient of the
>message on a separate line.
>
>Also, the message should stop there, i.e. not be sent out, as the
processing
>we have on those messages, will anylize then send those.
>
>Is there any way that MailScanner can be set up to do this?

You would probably need to write a Custom Function to do this, and probably
attach it to the "non-spam actions" configuration option. This could test
for the *@domain.com and write out the message in the files you want.

The alternative would be to archive mail using "Archive Mail" and a
ruleset, then have a cron job that ran every 5 or 10 minutes and processed
the archive entries to generate the processed data you want, then deleted
the original archive files so it didn't process the same mail twice.
--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 16:04:26 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3868.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Take a look in CustomConfig.pm. There are several examples in there,
including a commented-out skeleton of what you need to do. Your Custom
Function should return 'deliver' for all the messages except the ones you
are interested in, and copy the files where you want them for the
domain.com messages. You invoke it by putting
Non spam actions = &YourCustomFunctionName
in MailScanner.conf.

The alternative approach I suggested (involving the mail archive) may be
much easier for you to get working.

At 15:49 23/10/2004, you wrote:
>Hello Again:
>
>The custom function sounds like it would work, so I would first set my:
>
>Non spam actions = somefile.rules
>
>In somefile.rules I put the default, to be deliver , and for my per domain
>would be:
>
>From: *@domain.com      ?
>FromOrTo:       default deliver
>
>Please let me know what I would put here, and how to envoke a custom
>function, and if possible what this might look like,
>
>Thanks,
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Friday, October 15, 2004 12:24 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>At 17:07 15/10/2004, you wrote:
> >Good day:
> >
> >I had sent previously but missed the reply, if any.
> >
> >We have an application where we would need to have the following to occur:
> >
> > >From *@domain.com ,
> >Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> >Put a file to /anypath/MESSAGEREF.add which contains each recipient of the
> >message on a separate line.
> >
> >Also, the message should stop there, i.e. not be sent out, as the
>processing
> >we have on those messages, will anylize then send those.
> >
> >Is there any way that MailScanner can be set up to do this?
>
>You would probably need to write a Custom Function to do this, and probably
>attach it to the "non-spam actions" configuration option. This could test
>for the *@domain.com and write out the message in the files you want.
>
>The alternative would be to archive mail using "Archive Mail" and a
>ruleset, then have a cron job that ran every 5 or 10 minutes and processed
>the archive entries to generate the processed data you want, then deleted
>the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sconway at WLNET.COM  Sat Oct 23 16:31:36 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3869.1137101241.24926.mailscanner@lists.mailscanner.info>

Good day:

The problem with using the archive method, is that the archive only stores a
copy there, but the messages are then delivered to their final recipients.
What we need is for any mail from the domain to not be delivered , but
instead just copied to the location with the address file being generated.
Which function in customconfig would I need to use?

Thanks,

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Saturday, October 23, 2004 11:04 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

Take a look in CustomConfig.pm. There are several examples in there,
including a commented-out skeleton of what you need to do. Your Custom
Function should return 'deliver' for all the messages except the ones you
are interested in, and copy the files where you want them for the
domain.com messages. You invoke it by putting
Non spam actions = &YourCustomFunctionName
in MailScanner.conf.

The alternative approach I suggested (involving the mail archive) may be
much easier for you to get working.

At 15:49 23/10/2004, you wrote:
>Hello Again:
>
>The custom function sounds like it would work, so I would first set my:
>
>Non spam actions = somefile.rules
>
>In somefile.rules I put the default, to be deliver , and for my per domain
>would be:
>
>From: *@domain.com      ?
>FromOrTo:       default deliver
>
>Please let me know what I would put here, and how to envoke a custom
>function, and if possible what this might look like,
>
>Thanks,
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Friday, October 15, 2004 12:24 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>At 17:07 15/10/2004, you wrote:
> >Good day:
> >
> >I had sent previously but missed the reply, if any.
> >
> >We have an application where we would need to have the following to
occur:
> >
> > >From *@domain.com ,
> >Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> >Put a file to /anypath/MESSAGEREF.add which contains each recipient of
the
> >message on a separate line.
> >
> >Also, the message should stop there, i.e. not be sent out, as the
>processing
> >we have on those messages, will anylize then send those.
> >
> >Is there any way that MailScanner can be set up to do this?
>
>You would probably need to write a Custom Function to do this, and probably
>attach it to the "non-spam actions" configuration option. This could test
>for the *@domain.com and write out the message in the files you want.
>
>The alternative would be to archive mail using "Archive Mail" and a
>ruleset, then have a cron job that ran every 5 or 10 minutes and processed
>the archive entries to generate the processed data you want, then deleted
>the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 16:28:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Fwd: SpamAssassin 3.0.1 is released!
Message-ID: <mailman.3870.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
SA 3.0.1 is out. I will try it shortly.

>To: dev@spamassassin.apache.org, users@spamassassin.apache.org,
>    announce@spamassassin.apache.org
>Subject: SpamAssassin 3.0.1 is released!
>From: jm@jmason.org (Justin Mason)
>Date: Fri, 22 Oct 2004 20:09:10 -0700
>
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
>SpamAssassin 3.0.1 is released!  3.0.1 contains some important
>bugfixes, and is recommended.
>
>Highlights:
>
>   - excessive memory-usage fixes
>   - bug fixed which stopped DCC, Pyzor working with amavisd
>   - deprecate RCVD_IN_RFC_IPWHOIS
>   - user_prefs were staying active between different spamd users, fixed
>   - user_prefs blacklist entries were not working in spamd, fixed
>   - excessive time and memory consumption when ok_languages is used, fixed
>   - sa-learn -u switch to specify the username for virtual environments
>   - avoid bug in Sys::Hostname::Long that renames the hostname when "make
>     test" is run
>   - whitelist the top 125 queried SURBL domains common in nonspam
>
>Pick it up at http://spamassassin.apache.org/ !
>
>md5sum of archive files:
>   83f60f97c823d9b8df19309247fe33eb  Mail-SpamAssassin-3.0.1.tar.bz2
>   759e0486b07c4a03aa340d4a04e1d849  Mail-SpamAssassin-3.0.1.tar.gz
>   e42d4f6b7228f899efdfdce03b8851a0  Mail-SpamAssassin-3.0.1.zip
>
>sha1sum of archive files:
>   7ad929efc388ebdf26da052c6fca958c7541bb4f  Mail-SpamAssassin-3.0.1.tar.bz2
>   a3aebae1bf3c97830e540c42dc64791787d966c9  Mail-SpamAssassin-3.0.1.tar.gz
>   e4f23ad8251914bb240a4e42438310a263ca5056  Mail-SpamAssassin-3.0.1.zip
>
>
>The release files also have a .asc accompanying them.  The file serves
>as an external GPG signature for the given release file.  The signing
>key is available via the wwwkeys.pgp.net key server, as well as
>http://spamassassin.apache.org/released/GPG-SIGNING-KEY
>
>The key information is:
>
>pub  1024D/265FA05B 2003-06-09 SpamAssassin Signing Key
><release@spamassassin.org>
>      Key fingerprint =3D 26C9 00A4 6DD4 0CD5 AD24  F6D7 DEE0 1987 265F A05B
>
>- --j.
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.4 (GNU/Linux)
>Comment: Exmh CVS
>
>iD8DBQFBectWMJF5cimLx9ARAh2DAKCBru7brC0dtjD4G2/QGvAmWntURgCgoKBp
>J1C/3vGNxtuJcxuosscN+E4=
>=RAAd
>-----END PGP SIGNATURE-----

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 17:17:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3871.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
All you need to do to stop it delivering them is to use a 2-line ruleset
for Non spam actions, spam actions and high scoring spam actions.
From: domain.com delete
FromOrTo: default deliver

Then use a ruleset for Archive Mail that says
From: domain.com yes
FromOrTo: default no

At 16:31 23/10/2004, you wrote:
>Good day:
>
>The problem with using the archive method, is that the archive only stores a
>copy there, but the messages are then delivered to their final recipients.
>What we need is for any mail from the domain to not be delivered , but
>instead just copied to the location with the address file being generated.
>Which function in customconfig would I need to use?
>
>Thanks,
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Saturday, October 23, 2004 11:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>Take a look in CustomConfig.pm. There are several examples in there,
>including a commented-out skeleton of what you need to do. Your Custom
>Function should return 'deliver' for all the messages except the ones you
>are interested in, and copy the files where you want them for the
>domain.com messages. You invoke it by putting
>Non spam actions = &YourCustomFunctionName
>in MailScanner.conf.
>
>The alternative approach I suggested (involving the mail archive) may be
>much easier for you to get working.
>
>At 15:49 23/10/2004, you wrote:
> >Hello Again:
> >
> >The custom function sounds like it would work, so I would first set my:
> >
> >Non spam actions = somefile.rules
> >
> >In somefile.rules I put the default, to be deliver , and for my per domain
> >would be:
> >
> >From: *@domain.com      ?
> >FromOrTo:       default deliver
> >
> >Please let me know what I would put here, and how to envoke a custom
> >function, and if possible what this might look like,
> >
> >Thanks,
> >
> >Steve
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Friday, October 15, 2004 12:24 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >At 17:07 15/10/2004, you wrote:
> > >Good day:
> > >
> > >I had sent previously but missed the reply, if any.
> > >
> > >We have an application where we would need to have the following to
>occur:
> > >
> > > >From *@domain.com ,
> > >Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > >Put a file to /anypath/MESSAGEREF.add which contains each recipient of
>the
> > >message on a separate line.
> > >
> > >Also, the message should stop there, i.e. not be sent out, as the
> >processing
> > >we have on those messages, will anylize then send those.
> > >
> > >Is there any way that MailScanner can be set up to do this?
> >
> >You would probably need to write a Custom Function to do this, and probably
> >attach it to the "non-spam actions" configuration option. This could test
> >for the *@domain.com and write out the message in the files you want.
> >
> >The alternative would be to archive mail using "Archive Mail" and a
> >ruleset, then have a cron job that ran every 5 or 10 minutes and processed
> >the archive entries to generate the processed data you want, then deleted
> >the original archive files so it didn't process the same mail twice.
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Sat Oct 23 17:32:42 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:21 2006
Subject: Fwd: SpamAssassin 3.0.1 is released!
Message-ID: <mailman.3872.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:

> SA 3.0.1 is out. I will try it shortly.

Installed it this morning - no problems so far.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 17:49:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Fwd: SpamAssassin 3.0.1 is released!
Message-ID: <mailman.3873.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:32 23/10/2004, you wrote:
>Julian Field wrote:
>
>>SA 3.0.1 is out. I will try it shortly.
>
>Installed it this morning - no problems so far.

All working nicely on my systems too.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Sat Oct 23 17:51:50 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:21 2006
Subject: Spam whitelist
Message-ID: <mailman.3874.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Should messages which match against spam.whitelist.rules (i.e. "Is
Definitely Not Spam") still get run through SpamAssassin?

I'm seeing SA reports in supposedly white-listed messages...

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Sat Oct 23 17:56:08 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:21 2006
Subject: Spam whitelist
Message-ID: <mailman.3875.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Mike Zanker wrote:

> Should messages which match against spam.whitelist.rules (i.e. "Is
> Definitely Not Spam") still get run through SpamAssassin?
>
> I'm seeing SA reports in supposedly white-listed messages...

To answer my own question, it seems to depend whether you have "Always
Include SpamAssassin Report" defined or not. If it is defined,
white-listed e-mails are run through SA, if it is not defined, they are
not run through SA.

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 17:56:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Spam whitelist
Message-ID: <mailman.3876.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 17:51 23/10/2004, you wrote:
>Should messages which match against spam.whitelist.rules (i.e. "Is
>Definitely Not Spam") still get run through SpamAssassin?
>
>I'm seeing SA reports in supposedly white-listed messages...

Have you got Always Include SpamAssassin Report = yes ?
If so, it's doing what you told it to :-)

You might be better off applying the whitelist to the "Spam Checks"
configuration option instead.
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mike at ZANKER.ORG  Sat Oct 23 18:07:24 2004
From: mike at ZANKER.ORG (Mike Zanker)
Date: Thu Jan 12 21:27:21 2006
Subject: Spam whitelist
Message-ID: <mailman.3877.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian Field wrote:

> Have you got Always Include SpamAssassin Report = yes ?
> If so, it's doing what you told it to :-)
>
> You might be better off applying the whitelist to the "Spam Checks"
> configuration option instead.

Yes, I realised what was going on almost as soon as I'd asked :)

Thanks,

Mike.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From raymond at PROLOCATION.NET  Sat Oct 23 19:40:09 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:21 2006
Subject: Fwd: SpamAssassin 3.0.1 is released!
Message-ID: <mailman.3878.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

>> SA 3.0.1 is out. I will try it shortly.
>
> Installed it this morning - no problems so far.

Same here, only 'problem' i noticed was the lower load on our DNS servers,
since its doing no more lookups for the top xx SURBL whitelist domains. ;)

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From hden at KCBBS.GEN.NZ  Sat Oct 23 20:03:16 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:21 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3879.1137101241.24926.mailscanner@lists.mailscanner.info>

I'm currently tring to install spamassassin 3.0.1. All proceeds fine until
make test, where it hangs on this test..

 t/bayesdbm..................ok 37/44

How, what etc do I need to do to sort this?

Any/all advice appreciated,
Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sat Oct 23 20:01:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:21 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3880.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 20:03 23/10/2004, you wrote:
>I'm currently tring to install spamassassin 3.0.1. All proceeds fine until
>make test, where it hangs on this test..
>
>  t/bayesdbm..................ok 37/44
>
>How, what etc do I need to do to sort this?

Some of the bayes tests take a long time. Just type "make test" and go and
watch TV for a bit. It'll get there in the end.
Also, to speed up the testing, as MailScanner doesn't use spamc or spamd,
you can just remove those tests:
         rm -f t/spamc* t/spamd*
before you "make test".
--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wietse at BOUDISQUE.NL  Sat Oct 23 20:12:54 2004
From: wietse at BOUDISQUE.NL (Wietse Muizelaar)
Date: Thu Jan 12 21:27:21 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3881.1137101241.24926.mailscanner@lists.mailscanner.info>

Hi,

On Saturday, October 23, 2004 9:01 PM [GMT+1=CET],
Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:

> At 20:03 23/10/2004, you wrote:
>> I'm currently tring to install spamassassin 3.0.1. All proceeds fine
>> until make test, where it hangs on this test..
>>
>>  t/bayesdbm..................ok 37/44
>>
>> How, what etc do I need to do to sort this?
>
> Some of the bayes tests take a long time. Just type "make test" and
> go and watch TV for a bit. It'll get there in the end.
> Also, to speed up the testing, as MailScanner doesn't use spamc or
> spamd, you can just remove those tests:
>          rm -f t/spamc* t/spamd*
> before you "make test".

I had the install complaining about a missing 'Storage Module'; after
installing this one from CPAN, it worked. Weird thing was that I did'nt had
the 3.0.0-version complaing about this..

--
Wietse

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hden at KCBBS.GEN.NZ  Sat Oct 23 20:41:20 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:21 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3882.1137101241.24926.mailscanner@lists.mailscanner.info>

On Sat, Oct 23, 2004 at 08:01:35PM +0100, Julian Field wrote:
> At 20:03 23/10/2004, you wrote:
> >I'm currently tring to install spamassassin 3.0.1. All proceeds fine until
> >make test, where it hangs on this test..
> >
> > t/bayesdbm..................ok 37/44
> >
> >How, what etc do I need to do to sort this?
>
> Some of the bayes tests take a long time. Just type "make test" and go and
> watch TV for a bit. It'll get there in the end.
> [snip]

 Thanks! It did get there in the end. Appreciate the advice!

 Now, where can I download a truckload of patience from......

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Sat Oct 23 20:55:30 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:21 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3883.1137101241.24926.mailscanner@lists.mailscanner.info>

Hello:

I am now creating the archive, and also am 'deleting' the outgoing message,.
I have now a question about MailScanner rules, is there anyway that MS can
match on any other criteria, i.e. if a certain header exists in a message,
then do something?  Example, after my processes analyze the archive created
above, I must then re-send the messages to the Internet to the actual
recipients, but if I again put them through MS, they will again end up in
the archive, and a loop will be started.  I could send them via another
Sendmail process , or via another SMTP host but this involves running other
processes, or server..

After each process above, I put a header field into the messages 'X-FLTMAIL'
.  What I would like to know is if MS finds this header, then it should not
archive the message , and also bypass the 'delete' rule .

Any ideas on how this can be done?  In looking at ruleset syntax, it is
always 'from / To or Default' anyway to check for other fields / criteria?
Maybe through a custom function?

Thanks,

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Saturday, October 23, 2004 12:17 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

All you need to do to stop it delivering them is to use a 2-line ruleset
for Non spam actions, spam actions and high scoring spam actions.
From: domain.com delete
FromOrTo: default deliver

Then use a ruleset for Archive Mail that says
From: domain.com yes
FromOrTo: default no

At 16:31 23/10/2004, you wrote:
>Good day:
>
>The problem with using the archive method, is that the archive only stores
a
>copy there, but the messages are then delivered to their final recipients.
>What we need is for any mail from the domain to not be delivered , but
>instead just copied to the location with the address file being generated.
>Which function in customconfig would I need to use?
>
>Thanks,
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Saturday, October 23, 2004 11:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>Take a look in CustomConfig.pm. There are several examples in there,
>including a commented-out skeleton of what you need to do. Your Custom
>Function should return 'deliver' for all the messages except the ones you
>are interested in, and copy the files where you want them for the
>domain.com messages. You invoke it by putting
>Non spam actions = &YourCustomFunctionName
>in MailScanner.conf.
>
>The alternative approach I suggested (involving the mail archive) may be
>much easier for you to get working.
>
>At 15:49 23/10/2004, you wrote:
> >Hello Again:
> >
> >The custom function sounds like it would work, so I would first set my:
> >
> >Non spam actions = somefile.rules
> >
> >In somefile.rules I put the default, to be deliver , and for my per
domain
> >would be:
> >
> >From: *@domain.com      ?
> >FromOrTo:       default deliver
> >
> >Please let me know what I would put here, and how to envoke a custom
> >function, and if possible what this might look like,
> >
> >Thanks,
> >
> >Steve
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Friday, October 15, 2004 12:24 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >At 17:07 15/10/2004, you wrote:
> > >Good day:
> > >
> > >I had sent previously but missed the reply, if any.
> > >
> > >We have an application where we would need to have the following to
>occur:
> > >
> > > >From *@domain.com ,
> > >Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > >Put a file to /anypath/MESSAGEREF.add which contains each recipient of
>the
> > >message on a separate line.
> > >
> > >Also, the message should stop there, i.e. not be sent out, as the
> >processing
> > >we have on those messages, will anylize then send those.
> > >
> > >Is there any way that MailScanner can be set up to do this?
> >
> >You would probably need to write a Custom Function to do this, and
probably
> >attach it to the "non-spam actions" configuration option. This could test
> >for the *@domain.com and write out the message in the files you want.
> >
> >The alternative would be to archive mail using "Archive Mail" and a
> >ruleset, then have a cron job that ran every 5 or 10 minutes and
processed
> >the archive entries to generate the processed data you want, then deleted
> >the original archive files so it didn't process the same mail twice.
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vlad at MAZEK.COM  Sat Oct 23 23:07:18 2004
From: vlad at MAZEK.COM (Vlad Mazek)
Date: Thu Jan 12 21:27:21 2006
Subject: Spam whitelist
Message-ID: <mailman.3884.1137101241.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Mike Zanker wrote:

> Julian Field wrote:
>
>> Have you got Always Include SpamAssassin Report = yes ?
>> If so, it's doing what you told it to :-)
>>
>> You might be better off applying the whitelist to the "Spam Checks"
>> configuration option instead.
>
I actually happen to have a similar problem. I have that setting set as
a no (Always Include SpamAssassin Report = no) and my rules for
whitelisting the "From: and To:" are not being followed. Just the From:
and FromOrTo: are being taken into account so I may have the syntax
wrong. I have tried different variations, spaces, tabs, and it still
keeps on running them through the spamassassin:

For example, this entry in /etc/MailScanner/rules/spam.whitelist.rules
(as defined by MailScanner.conf) does not get whitelisted.
From: *@upromise.com and To: *@customer.tld       yes

Any ideas?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From gdoris at ROGERS.COM  Sun Oct 24 00:00:33 2004
From: gdoris at ROGERS.COM (Gerry Doris)
Date: Thu Jan 12 21:27:22 2006
Subject: Mail::ClamAV-0.12 and Fedora 2
Message-ID: <mailman.3885.1137101241.24926.mailscanner@lists.mailscanner.info>

I still can't find a way to get Mail::ClamAV version 0.12 to install on
Fedora Core 2.  I'm using ClamAV 0.80.  I know that others were having
problems too but I'm not sure if it is now supposed to work.

Was there a fix posted for this?

--
Gerry Doris <gdoris@rogers.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wogri at WOGRI.AT  Sun Oct 24 02:04:56 2004
From: wogri at WOGRI.AT (Wolfgang Hennerbichler)
Date: Thu Jan 12 21:27:22 2006
Subject: Kaspersky 5.0.x aveclient / server wrapper
Message-ID: <mailman.3886.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi MailScanner folks!

I've just written a quick and dirty wrapper for Kaspersky 5.0.x which
supports aveclient and aveserver (which seems to be much faster for our
high-load server). I think nobody did that before me (at least I didn't
find anything on the internet), so I did it.
Are you interested in building it into the distribution?

The wrapper calls a small c-program (C because of performance reasons)
which modifies the output of the aveclient to work with the
kaspersky4-5 parser. If you want to, I will send the wrapper and the
source of the c-program to anybody who will build it into the
distribution. If you don't care - I don't care either :)

wogri

--
wogri@wogri.at
http://www.wogri.at

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From rcooper at DWFORD.COM  Sun Oct 24 03:38:50 2004
From: rcooper at DWFORD.COM (Rick Cooper)
Date: Thu Jan 12 21:27:22 2006
Subject: Mail::ClamAV-0.12 and Fedora 2
Message-ID: <mailman.3887.1137101242.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
> Behalf Of Gerry Doris
> Sent: Saturday, October 23, 2004 6:01 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Mail::ClamAV-0.12 and Fedora 2
>
>
> I still can't find a way to get Mail::ClamAV version 0.12 to install on
> Fedora Core 2.  I'm using ClamAV 0.80.  I know that others were having
> problems too but I'm not sure if it is now supposed to work.
>
> Was there a fix posted for this?
>

I posted the fix (for my Fedora Core 2 installations) both here and in
answer to your question on the Clamav users list. Did you try it?

Goes like this:

Check /etc/ld.so.conf for the line /usr/local/lib if it's not there add it
then run the command ldconfig, it will take a few moments to run. Once
ldconfig is complete install Mail::ClamAV (cpan -i Mail::ClamAV) and the
test portion should now complete successfully.

BTW: You will need to get the latest MailScanner installed also otherwise it
will bomb with module errors from clamavmodule.

Rick


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From p.bos at LAKE.XS4ALL.NL  Sun Oct 24 10:04:09 2004
From: p.bos at LAKE.XS4ALL.NL (Piet Bos)
Date: Thu Jan 12 21:27:22 2006
Subject: blacklist/whiteliist questions.
Message-ID: <mailman.3888.1137101242.24926.mailscanner@lists.mailscanner.info>

Hi,
Am I right when I assume the following:
- Mail from an address thats on the whitelist is never marked as Spam.
- Mail form an address thats on the blacklist is always marked as Spam.
- There is no way to circumvent MailScanner, even when an address is white
listed.

What is the function of the bigevil.cf list, is it used by MailScanner.
Or only by Spamassassin when invoked by a script like .procmailrc?

please be gentle with me I'm only trying to understand the way MailScanner
works.
--
Piet Bos
p.bos@lake.xs4all.nl



--
This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Sun Oct 24 11:01:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: blacklist/whiteliist questions.
Message-ID: <mailman.3889.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 10:04 24/10/2004, you wrote:
>Hi,
>Am I right when I assume the following:
>- Mail from an address thats on the whitelist is never marked as Spam.
>- Mail form an address thats on the blacklist is always marked as Spam.

Correct.

>- There is no way to circumvent MailScanner, even when an address is white
>listed.

The spam.whitelist.rules and spam.blacklist.rules are just example rulesets
which are applied to the "Is Definitely Not Spam" and "Is Definitely Spam"
options. You can apply a ruleset to just about any configuration option, so
if you want to skip all spam checks for some addresses, add a ruleset to
the "Spam Checks" configuration option.

Rulesets are explained in the MAQ (www.mailscanner.biz/maq) and in the book
(www.mailscanner.info/store).

>What is the function of the bigevil.cf list, is it used by MailScanner.
>Or only by Spamassassin when invoked by a script like .procmailrc?

The bigevil.cf list is a set of rules for SpamAssassin, that will be used
by SpamAssassin regardless of how you call it (i.e. via MailScanner (easy)
or procmail (hard)).

The bigevil.cf list has been superceded now and you shouldn't be using it
any more. SpamAssassin 3 achieves the same result using a much faster, more
efficient method.

>please be gentle with me I'm only trying to understand the way MailScanner
>works.

We all had to start somewhere.
Sorry to plug it yet again, but you may find the book helps you get going.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Sun Oct 24 10:56:55 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Kaspersky 5.0.x aveclient / server wrapper
Message-ID: <mailman.3890.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Yes please. Please send it to me off-list (mailscanner@ecs.soton.ac.uk).
I'm busy so I may not get it sorted out quickly, but it will go on the list
of things to do :-)

At 02:04 24/10/2004, you wrote:
>Hi MailScanner folks!
>
>I've just written a quick and dirty wrapper for Kaspersky 5.0.x which
>supports aveclient and aveserver (which seems to be much faster for our
>high-load server). I think nobody did that before me (at least I didn't
>find anything on the internet), so I did it.
>Are you interested in building it into the distribution?
>
>The wrapper calls a small c-program (C because of performance reasons)
>which modifies the output of the aveclient to work with the
>kaspersky4-5 parser. If you want to, I will send the wrapper and the
>source of the c-program to anybody who will build it into the
>distribution. If you don't care - I don't care either :)
>
>wogri
>
>--
>wogri@wogri.at
>http://www.wogri.at
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From gdoris at ROGERS.COM  Mon Oct 25 01:43:26 2004
From: gdoris at ROGERS.COM (Gerry Doris)
Date: Thu Jan 12 21:27:22 2006
Subject: Mail::ClamAV-0.12 and Fedora 2
Message-ID: <mailman.3891.1137101242.24926.mailscanner@lists.mailscanner.info>

>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On
>> Behalf Of Gerry Doris
>> Sent: Saturday, October 23, 2004 6:01 PM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Mail::ClamAV-0.12 and Fedora 2
>>
>>
>> I still can't find a way to get Mail::ClamAV version 0.12 to install
on
>> Fedora Core 2.  I'm using ClamAV 0.80.  I know that others were
having
>> problems too but I'm not sure if it is now supposed to work.
>>
>> Was there a fix posted for this?
>>

>I posted the fix (for my Fedora Core 2 installations) both here and in
>answer to your question on the Clamav users list. Did you try it?
>
>Goes like this:
>
>Check /etc/ld.so.conf for the line /usr/local/lib if it's not there add
it
>then run the command ldconfig, it will take a few moments to run. Once
>ldconfig is complete install Mail::ClamAV (cpan -i Mail::ClamAV) and
the
>test portion should now complete successfully.
>
>BTW: You will need to get the latest MailScanner installed also
>otherwise it
>will bomb with module errors from clamavmodule.
>
>Rick


Thanks Rick!

Actually, I did see your message, tried it and it didn't work.  I went
back again to double check and I had made a typo!  Fixed it and
Mail::ClamAV went right in without a problem.

Lesson: do not attempt to make changes to a system(s) after 3:00am!

--
Gerry Doris <gdoris@rogers.com>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From BBerglund at TECHPRO.COM  Mon Oct 25 05:44:52 2004
From: BBerglund at TECHPRO.COM (Brian Berglund)
Date: Thu Jan 12 21:27:22 2006
Subject: Question about user's roles within Mailscanner
Message-ID: <mailman.3892.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><HTML DIR=ltr><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"></HEAD><BODY><DIV><FONT face='Arial' color=#000000 size=2>I want to know, is there a way to let the users know that 
they have had an email blocked by spam and then can they retrieve through like a 
webbased system.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>Like, I wanted to get an email that was blocked... 
How do I know it was blocked and how can I retrieve it without calling the 
administrator?<BR></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT>&nbsp;</DIV>
<DIV><FONT face=Arial size=2>&nbsp;</DIV></FONT></BODY></HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 08:52:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Question about user's roles within Mailscanner
Message-ID: <mailman.3893.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-html>
<HTML>
<HEAD>
<TITLE>Re: Question about user's roles within Mailscanner</TITLE>
</HEAD>
<BODY>
<FONT FACE="Verdana, Helvetica, Arial"><SPAN STYLE='font-size:12.0px'>On 25/10/04 5:44 am, &quot;Brian Berglund&quot; &lt;BBerglund@TECHPRO.COM&gt; wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><SPAN STYLE='font-size:12.0px'><FONT FACE="Arial">I want to know, is there a way to let the users know that they have had an email blocked by spam and then can they retrieve through like a webbased system.<BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"> <BR>
</FONT><FONT FACE="Arial">Like, I wanted to get an email that was blocked... How do I know it was blocked and how can I retrieve it without calling the administrator?<BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial"> <BR>
</FONT><FONT FACE="Arial"> <BR>
</FONT><FONT FACE="Verdana, Helvetica, Arial">------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:<BR>
'leave mailscanner' in the body of the email.<BR>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/)">http://www.mailscanner.biz/maq/)</a><BR>
and the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html).">http://www.jiscmail.ac.uk/lists/mailscanner.html).</a><BR>
</FONT></SPAN></BLOCKQUOTE><SPAN STYLE='font-size:12.0px'><FONT FACE="Verdana, Helvetica, Arial"><BR>
You sound like an ideal candidate for the &#8220;Quarantine Report&#8221; system, developed by Fortress Systems. It&#8217;s at www.fsl.com/support.<BR>
<BR>
Also, take a look at MailWatch, this is a very sophisticated application which provides a comprehensive web interface to MailScanner management.<BR>
-- <BR>
Julian Field<BR>
www.MailScanner.info<BR>
Buy the MailScanner book at www.MailScanner.info/store<BR>
<BR>
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654<BR>
</FONT></SPAN>
</BODY>
</HTML>

------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From steve.freegard at LBSLTD.CO.UK  Mon Oct 25 10:16:12 2004
From: steve.freegard at LBSLTD.CO.UK (Steve Freegard)
Date: Thu Jan 12 21:27:22 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3894.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi Hendrik,

Hendrik den Hartog wrote:
> I'm currently tring to install spamassassin 3.0.1. All proceeds fine until
> make test, where it hangs on this test..
>
>  t/bayesdbm..................ok 37/44
>
> How, what etc do I need to do to sort this?
>
> Any/all advice appreciated,
> Cheers!
> Hendrik
>

See http://wiki.apache.org/spamassassin/DbFileSleepBug - and see if this
  is affecting you.

Kind regards,
Steve.


--
This message has been scanned for viruses and dangerous content by MailScanner.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From michele at BLACKNIGHTSOLUTIONS.COM  Mon Oct 25 11:51:10 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:22 2006
Subject: Question about user's roles within Mailscanner
Message-ID: <mailman.3895.1137101242.24926.mailscanner@lists.mailscanner.info>

<quote who="Brian Berglund">
> I want to know, is there a way to let the users know that they have had an
> email blocked by spam and then can they retrieve through like a webbased
> system.
>
> Like, I wanted to get an email that was blocked... How do I know it was
> blocked and how can I retrieve it without calling the administrator?

Have a look through the archives as  a couple of scripts to help you
achieve this have been posted in recent weeks.
You might want to look at MailWatch as well.


--
Mr.Michele Neylon
Blacknight Solutions
Hosting, Co-location & Email solutions
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Mon Oct 25 13:58:16 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:22 2006
Subject: Still some mails around?
Message-ID: <mailman.3896.1137101242.24926.mailscanner@lists.mailscanner.info>

Hi there,

somehow it seems to me the list is very quiet now..

or am i no longer getting the mails?

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From marcel-ml at IRC-ADDICTS.DE  Mon Oct 25 14:54:15 2004
From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers)
Date: Thu Jan 12 21:27:22 2006
Subject: Still some mails around?
Message-ID: <mailman.3897.1137101242.24926.mailscanner@lists.mailscanner.info>

Hi,


> Seems to be a quiet day.  I suppose that most people are up and running
> properly. :)
>
ok..and thanks :)

thought my system got screwed ;)
and thank god it is not :)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ELIQUID.COM  Mon Oct 25 14:49:18 2004
From: mailscanner at ELIQUID.COM (Wess)
Date: Thu Jan 12 21:27:22 2006
Subject: Still some mails around?
Message-ID: <mailman.3898.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
  <META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
  <META NAME="GENERATOR" CONTENT="GtkHTML/3.0.10">
</HEAD>
<BODY>
Seems to be a quiet day.&nbsp; I suppose that most people are up and running properly. :)<BR>
<BR>
On Mon, 2004-10-25 at 08:58, Marcel Blenkers wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE><FONT COLOR="#737373"><I>Hi there,

somehow it seems to me the list is very quiet now..

or am i no longer getting the mails?

Marcel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (</FONT><A HREF="http://www.mailscanner.biz/maq/"></U><U>http://www.mailscanner.biz/maq/</A><FONT COLOR="#737373">) and
the archives (</FONT><A HREF="http://www.jiscmail.ac.uk/lists/mailscanner.html"></U><U>http://www.jiscmail.ac.uk/lists/mailscanner.html</A><FONT COLOR="#737373">).</I></FONT></PRE>
</BLOCKQUOTE>
<PRE><TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<PRE>--
Wess Bechard
Systems Administrator
eliquidMEDIA
International Inc.

wess@eliquid.com
519.973.1930 -1.800.561.7525</PRE>
</TD>
</TR>
</TABLE>
</PRE>
</BODY>
</HTML>
------------------------ MailScanner list ------------------------
To unsubscribe, email <a href="jiscmail@jiscmail.ac.uk">jiscmail@jiscmail.ac.uk</a>
with the words:<br>
'leave mailscanner' in the body of the email.<br>
Before posting, read the MAQ (<a href="http://www.mailscanner.biz/maq/">http://www.mailscanner.biz/maq/</a>)<br>and
the archives (<a href="http://www.jiscmail.ac.uk/lists/mailscanner.html">http://www.jiscmail.ac.uk/lists/mailscanner.html</a>).
</x-html>

From drew at THEMARSHALLS.CO.UK  Mon Oct 25 15:21:06 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:22 2006
Subject: Still some mails around?
Message-ID: <mailman.3899.1137101242.24926.mailscanner@lists.mailscanner.info>

On Mon, October 25, 2004 14:54, Marcel Blenkers said:
> Hi,
>
>
>> Seems to be a quiet day.  I suppose that most people are up and running
>> properly. :)
>>
> ok..and thanks :)
>
> thought my system got screwed ;)
> and thank god it is not :)
>
I know, it's unnerving. Let's hope it's not the quiet before the storm...


--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Mon Oct 25 15:48:28 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3900.1137101242.24926.mailscanner@lists.mailscanner.info>

Hello:

I have managed the following, and have one further issue:

I am now creating the archive, and also am 'deleting' the outgoing message,.
I have now a question about MailScanner rules, is there anyway that MS can
match on any other criteria, i.e. if a certain header exists in a message,
then do something?  Example, after my processes analyze the archive created
above, I must then re-send the messages to the Internet to the actual
recipients, but if I again put them through MS, they will again end up in
the archive, and a loop will be started.  I could send them via another
Sendmail process , or via another SMTP host but this involves running other
processes, or server..

After each process above, I put a header field into the messages 'X-FLTMAIL'
.  What I would like to know is if MS finds this header, then it should not
archive the message , and also bypass the 'delete' rule .

Any ideas on how this can be done?  In looking at ruleset syntax, it is
always 'from / To or Default' anyway to check for other fields / criteria?
Maybe through a custom function?

Thanks,

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Saturday, October 23, 2004 12:17 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

All you need to do to stop it delivering them is to use a 2-line ruleset
for Non spam actions, spam actions and high scoring spam actions.
From: domain.com delete
FromOrTo: default deliver

Then use a ruleset for Archive Mail that says
From: domain.com yes
FromOrTo: default no

At 16:31 23/10/2004, you wrote:
>Good day:
>
>The problem with using the archive method, is that the archive only stores
a
>copy there, but the messages are then delivered to their final recipients.
>What we need is for any mail from the domain to not be delivered , but
>instead just copied to the location with the address file being generated.
>Which function in customconfig would I need to use?
>
>Thanks,
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Saturday, October 23, 2004 11:04 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>Take a look in CustomConfig.pm. There are several examples in there,
>including a commented-out skeleton of what you need to do. Your Custom
>Function should return 'deliver' for all the messages except the ones you
>are interested in, and copy the files where you want them for the
>domain.com messages. You invoke it by putting
>Non spam actions = &YourCustomFunctionName
>in MailScanner.conf.
>
>The alternative approach I suggested (involving the mail archive) may be
>much easier for you to get working.
>
>At 15:49 23/10/2004, you wrote:
> >Hello Again:
> >
> >The custom function sounds like it would work, so I would first set my:
> >
> >Non spam actions = somefile.rules
> >
> >In somefile.rules I put the default, to be deliver , and for my per
domain
> >would be:
> >
> >From: *@domain.com      ?
> >FromOrTo:       default deliver
> >
> >Please let me know what I would put here, and how to envoke a custom
> >function, and if possible what this might look like,
> >
> >Thanks,
> >
> >Steve
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Friday, October 15, 2004 12:24 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >At 17:07 15/10/2004, you wrote:
> > >Good day:
> > >
> > >I had sent previously but missed the reply, if any.
> > >
> > >We have an application where we would need to have the following to
>occur:
> > >
> > > >From *@domain.com ,
> > >Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > >Put a file to /anypath/MESSAGEREF.add which contains each recipient of
>the
> > >message on a separate line.
> > >
> > >Also, the message should stop there, i.e. not be sent out, as the
> >processing
> > >we have on those messages, will anylize then send those.
> > >
> > >Is there any way that MailScanner can be set up to do this?
> >
> >You would probably need to write a Custom Function to do this, and
probably
> >attach it to the "non-spam actions" configuration option. This could test
> >for the *@domain.com and write out the message in the files you want.
> >
> >The alternative would be to archive mail using "Archive Mail" and a
> >ruleset, then have a cron job that ran every 5 or 10 minutes and
processed
> >the archive entries to generate the processed data you want, then deleted
> >the original archive files so it didn't process the same mail twice.
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 16:00:51 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3901.1137101242.24926.mailscanner@lists.mailscanner.info>

And what happens when a spammer starts sending you mail with that header in
it? You can't trust anything in the headers at all.

On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> Hello:
>
> I have managed the following, and have one further issue:
>
> I am now creating the archive, and also am 'deleting' the outgoing message,.
> I have now a question about MailScanner rules, is there anyway that MS can
> match on any other criteria, i.e. if a certain header exists in a message,
> then do something?  Example, after my processes analyze the archive created
> above, I must then re-send the messages to the Internet to the actual
> recipients, but if I again put them through MS, they will again end up in
> the archive, and a loop will be started.  I could send them via another
> Sendmail process , or via another SMTP host but this involves running other
> processes, or server..
>
> After each process above, I put a header field into the messages 'X-FLTMAIL'
> .  What I would like to know is if MS finds this header, then it should not
> archive the message , and also bypass the 'delete' rule .
>
> Any ideas on how this can be done?  In looking at ruleset syntax, it is
> always 'from / To or Default' anyway to check for other fields / criteria?
> Maybe through a custom function?
>
> Thanks,
>
> Steve
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
> Of Julian Field
> Sent: Saturday, October 23, 2004 12:17 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner Text File Creation
>
> All you need to do to stop it delivering them is to use a 2-line ruleset
> for Non spam actions, spam actions and high scoring spam actions.
> From: domain.com delete
> FromOrTo: default deliver
>
> Then use a ruleset for Archive Mail that says
> From: domain.com yes
> FromOrTo: default no
>
> At 16:31 23/10/2004, you wrote:
>> Good day:
>>
>> The problem with using the archive method, is that the archive only stores
> a
>> copy there, but the messages are then delivered to their final recipients.
>> What we need is for any mail from the domain to not be delivered , but
>> instead just copied to the location with the address file being generated.
>> Which function in customconfig would I need to use?
>>
>> Thanks,
>>
>> Steve
>>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
>> Of Julian Field
>> Sent: Saturday, October 23, 2004 11:04 AM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: MailScanner Text File Creation
>>
>> Take a look in CustomConfig.pm. There are several examples in there,
>> including a commented-out skeleton of what you need to do. Your Custom
>> Function should return 'deliver' for all the messages except the ones you
>> are interested in, and copy the files where you want them for the
>> domain.com messages. You invoke it by putting
>> Non spam actions = &YourCustomFunctionName
>> in MailScanner.conf.
>>
>> The alternative approach I suggested (involving the mail archive) may be
>> much easier for you to get working.
>>
>> At 15:49 23/10/2004, you wrote:
>>> Hello Again:
>>>
>>> The custom function sounds like it would work, so I would first set my:
>>>
>>> Non spam actions = somefile.rules
>>>
>>> In somefile.rules I put the default, to be deliver , and for my per
> domain
>>> would be:
>>>
>>> From: *@domain.com      ?
>>> FromOrTo:       default deliver
>>>
>>> Please let me know what I would put here, and how to envoke a custom
>>> function, and if possible what this might look like,
>>>
>>> Thanks,
>>>
>>> Steve
>>>
>>> -----Original Message-----
>>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> Behalf
>>> Of Julian Field
>>> Sent: Friday, October 15, 2004 12:24 PM
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: Re: MailScanner Text File Creation
>>>
>>> At 17:07 15/10/2004, you wrote:
>>>> Good day:
>>>>
>>>> I had sent previously but missed the reply, if any.
>>>>
>>>> We have an application where we would need to have the following to
>> occur:
>>>>
>>>>> From *@domain.com ,
>>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
>>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient of
>> the
>>>> message on a separate line.
>>>>
>>>> Also, the message should stop there, i.e. not be sent out, as the
>>> processing
>>>> we have on those messages, will anylize then send those.
>>>>
>>>> Is there any way that MailScanner can be set up to do this?
>>>
>>> You would probably need to write a Custom Function to do this, and
> probably
>>> attach it to the "non-spam actions" configuration option. This could test
>>> for the *@domain.com and write out the message in the files you want.
>>>
>>> The alternative would be to archive mail using "Archive Mail" and a
>>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> processed
>>> the archive entries to generate the processed data you want, then deleted
>>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Mon Oct 25 16:24:27 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:22 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3902.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 11:37 PM 10/22/2004, Julian Field wrote:
>Matt,
>
>Thanks for that. I originally kept the timeout short as genuine SA timeout
>problems did cause difficulty when I first implemented. But SA has improved
>enormously since I first supported it, and I suspect you are right that it
>is now time to increase the timeout quite a bit. The last increase I did
>was from 30 to 40 seconds so SA had a chance to timeout DNS lookups before
>it could be totally killed by MailScanner.
>
>Thanks for your opinion, as ever :-)

You're welcome Julian.

And thanks for making a great product, even if it does require the
occasional tweak as SA and virus scanners evolve :)

(Next product improvement request: psychic adaptive spamassassin interface
module, to keep abreast of unexpected changes in future versions of SA.)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 16:47:33 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Mail server backlogging - seems like a Bayes problem
Message-ID: <mailman.3903.1137101242.24926.mailscanner@lists.mailscanner.info>

On 25/10/04 4:24 pm, "Matt Kettler" <mkettler@EVI-INC.COM> wrote:

> At 11:37 PM 10/22/2004, Julian Field wrote:
>> Matt,
>>
>> Thanks for that. I originally kept the timeout short as genuine SA timeout
>> problems did cause difficulty when I first implemented. But SA has improved
>> enormously since I first supported it, and I suspect you are right that it
>> is now time to increase the timeout quite a bit. The last increase I did
>> was from 30 to 40 seconds so SA had a chance to timeout DNS lookups before
>> it could be totally killed by MailScanner.
>>
>> Thanks for your opinion, as ever :-)
>
> You're welcome Julian.

New config file says this:

# If SpamAssassin takes longer than this (in seconds), the check is
# abandoned and the timeout noted.
SpamAssassin Timeout = 75

# If SpamAssassin times out more times in a row than this, then it will be
# marked as "unavailable" until MailScanner next re-starts itself.
# This means that remote network failures causing SpamAssassin trouble will
# not mean your mail stops flowing.
Max SpamAssassin Timeouts = 10

I reckoned 75 was a perfect compromise between your suggestions of 60 and 90
:-)

> And thanks for making a great product, even if it does require the
> occasional tweak as SA and virus scanners evolve :)

Evolution is one of the major competitive advantages of the Open Source
model. Lots of eyes are watching out for effects and can help propose
solutions.

Which reminds me, I must get the book up to date with the phishing net code.
I'll have to find some time to do that.

Also, while I'm here: any volunteers to help get the rest of the
documentation on the website up to date please? Some of it is decidedly out
of date now, and I'm sure plenty of you are in a good position to be able to
help update it.

> (Next product improvement request: psychic adaptive spamassassin interface
> module, to keep abreast of unexpected changes in future versions of SA.)

Fortunately they didn't change the API too much, and they changed it in such
a way that it was easy to support both the old and the new in the same code.
If only all the virus scanning engines were that easy...


--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Mon Oct 25 17:00:17 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3904.1137101242.24926.mailscanner@lists.mailscanner.info>

Hello Again:

In this case, if somehow a Spammer managed to know what our custom header
was, and placed it into messages, these messages would be processed
normally, (i.e. by the MS SPAM blocking routines, and / or SPAM Assassin,
anti-virus, etc).  It would, in this case only by-pass our archiving rule
and also our delete rule.

In other words, since the message was already processed by MS, if I ran it
through Sendmail again, would MS capture it and archive it the second time?

All we are wondering , is if it can be done, and if so, how?

Thanks for any assistance.

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, October 25, 2004 11:01 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

And what happens when a spammer starts sending you mail with that header in
it? You can't trust anything in the headers at all.

On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> Hello:
>
> I have managed the following, and have one further issue:
>
> I am now creating the archive, and also am 'deleting' the outgoing
message,.
> I have now a question about MailScanner rules, is there anyway that MS can
> match on any other criteria, i.e. if a certain header exists in a message,
> then do something?  Example, after my processes analyze the archive
created
> above, I must then re-send the messages to the Internet to the actual
> recipients, but if I again put them through MS, they will again end up in
> the archive, and a loop will be started.  I could send them via another
> Sendmail process , or via another SMTP host but this involves running
other
> processes, or server..
>
> After each process above, I put a header field into the messages
'X-FLTMAIL'
> .  What I would like to know is if MS finds this header, then it should
not
> archive the message , and also bypass the 'delete' rule .
>
> Any ideas on how this can be done?  In looking at ruleset syntax, it is
> always 'from / To or Default' anyway to check for other fields / criteria?
> Maybe through a custom function?
>
> Thanks,
>
> Steve
>
> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
> Of Julian Field
> Sent: Saturday, October 23, 2004 12:17 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: MailScanner Text File Creation
>
> All you need to do to stop it delivering them is to use a 2-line ruleset
> for Non spam actions, spam actions and high scoring spam actions.
> From: domain.com delete
> FromOrTo: default deliver
>
> Then use a ruleset for Archive Mail that says
> From: domain.com yes
> FromOrTo: default no
>
> At 16:31 23/10/2004, you wrote:
>> Good day:
>>
>> The problem with using the archive method, is that the archive only
stores
> a
>> copy there, but the messages are then delivered to their final
recipients.
>> What we need is for any mail from the domain to not be delivered , but
>> instead just copied to the location with the address file being
generated.
>> Which function in customconfig would I need to use?
>>
>> Thanks,
>>
>> Steve
>>
>> -----Original Message-----
>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf
>> Of Julian Field
>> Sent: Saturday, October 23, 2004 11:04 AM
>> To: MAILSCANNER@JISCMAIL.AC.UK
>> Subject: Re: MailScanner Text File Creation
>>
>> Take a look in CustomConfig.pm. There are several examples in there,
>> including a commented-out skeleton of what you need to do. Your Custom
>> Function should return 'deliver' for all the messages except the ones you
>> are interested in, and copy the files where you want them for the
>> domain.com messages. You invoke it by putting
>> Non spam actions = &YourCustomFunctionName
>> in MailScanner.conf.
>>
>> The alternative approach I suggested (involving the mail archive) may be
>> much easier for you to get working.
>>
>> At 15:49 23/10/2004, you wrote:
>>> Hello Again:
>>>
>>> The custom function sounds like it would work, so I would first set my:
>>>
>>> Non spam actions = somefile.rules
>>>
>>> In somefile.rules I put the default, to be deliver , and for my per
> domain
>>> would be:
>>>
>>> From: *@domain.com      ?
>>> FromOrTo:       default deliver
>>>
>>> Please let me know what I would put here, and how to envoke a custom
>>> function, and if possible what this might look like,
>>>
>>> Thanks,
>>>
>>> Steve
>>>
>>> -----Original Message-----
>>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>> Behalf
>>> Of Julian Field
>>> Sent: Friday, October 15, 2004 12:24 PM
>>> To: MAILSCANNER@JISCMAIL.AC.UK
>>> Subject: Re: MailScanner Text File Creation
>>>
>>> At 17:07 15/10/2004, you wrote:
>>>> Good day:
>>>>
>>>> I had sent previously but missed the reply, if any.
>>>>
>>>> We have an application where we would need to have the following to
>> occur:
>>>>
>>>>> From *@domain.com ,
>>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
>>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient of
>> the
>>>> message on a separate line.
>>>>
>>>> Also, the message should stop there, i.e. not be sent out, as the
>>> processing
>>>> we have on those messages, will anylize then send those.
>>>>
>>>> Is there any way that MailScanner can be set up to do this?
>>>
>>> You would probably need to write a Custom Function to do this, and
> probably
>>> attach it to the "non-spam actions" configuration option. This could
test
>>> for the *@domain.com and write out the message in the files you want.
>>>
>>> The alternative would be to archive mail using "Archive Mail" and a
>>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> processed
>>> the archive entries to generate the processed data you want, then
deleted
>>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 18:07:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3905.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Yes, it can be done. It would need a Custom Function attached to the
Archive Mail option, and one attached to the non-spam actions option. This
could ask if the particular header was defined, and produce a different
result in this case, compared to the normal response.

But you will need some knowledge of perl to be able to write this.

At 17:00 25/10/2004, you wrote:
>Hello Again:
>
>In this case, if somehow a Spammer managed to know what our custom header
>was, and placed it into messages, these messages would be processed
>normally, (i.e. by the MS SPAM blocking routines, and / or SPAM Assassin,
>anti-virus, etc).  It would, in this case only by-pass our archiving rule
>and also our delete rule.
>
>In other words, since the message was already processed by MS, if I ran it
>through Sendmail again, would MS capture it and archive it the second time?
>
>All we are wondering , is if it can be done, and if so, how?
>
>Thanks for any assistance.
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Monday, October 25, 2004 11:01 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>And what happens when a spammer starts sending you mail with that header in
>it? You can't trust anything in the headers at all.
>
>On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> > Hello:
> >
> > I have managed the following, and have one further issue:
> >
> > I am now creating the archive, and also am 'deleting' the outgoing
>message,.
> > I have now a question about MailScanner rules, is there anyway that MS can
> > match on any other criteria, i.e. if a certain header exists in a message,
> > then do something?  Example, after my processes analyze the archive
>created
> > above, I must then re-send the messages to the Internet to the actual
> > recipients, but if I again put them through MS, they will again end up in
> > the archive, and a loop will be started.  I could send them via another
> > Sendmail process , or via another SMTP host but this involves running
>other
> > processes, or server..
> >
> > After each process above, I put a header field into the messages
>'X-FLTMAIL'
> > .  What I would like to know is if MS finds this header, then it should
>not
> > archive the message , and also bypass the 'delete' rule .
> >
> > Any ideas on how this can be done?  In looking at ruleset syntax, it is
> > always 'from / To or Default' anyway to check for other fields / criteria?
> > Maybe through a custom function?
> >
> > Thanks,
> >
> > Steve
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> > Of Julian Field
> > Sent: Saturday, October 23, 2004 12:17 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: MailScanner Text File Creation
> >
> > All you need to do to stop it delivering them is to use a 2-line ruleset
> > for Non spam actions, spam actions and high scoring spam actions.
> > From: domain.com delete
> > FromOrTo: default deliver
> >
> > Then use a ruleset for Archive Mail that says
> > From: domain.com yes
> > FromOrTo: default no
> >
> > At 16:31 23/10/2004, you wrote:
> >> Good day:
> >>
> >> The problem with using the archive method, is that the archive only
>stores
> > a
> >> copy there, but the messages are then delivered to their final
>recipients.
> >> What we need is for any mail from the domain to not be delivered , but
> >> instead just copied to the location with the address file being
>generated.
> >> Which function in customconfig would I need to use?
> >>
> >> Thanks,
> >>
> >> Steve
> >>
> >> -----Original Message-----
> >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf
> >> Of Julian Field
> >> Sent: Saturday, October 23, 2004 11:04 AM
> >> To: MAILSCANNER@JISCMAIL.AC.UK
> >> Subject: Re: MailScanner Text File Creation
> >>
> >> Take a look in CustomConfig.pm. There are several examples in there,
> >> including a commented-out skeleton of what you need to do. Your Custom
> >> Function should return 'deliver' for all the messages except the ones you
> >> are interested in, and copy the files where you want them for the
> >> domain.com messages. You invoke it by putting
> >> Non spam actions = &YourCustomFunctionName
> >> in MailScanner.conf.
> >>
> >> The alternative approach I suggested (involving the mail archive) may be
> >> much easier for you to get working.
> >>
> >> At 15:49 23/10/2004, you wrote:
> >>> Hello Again:
> >>>
> >>> The custom function sounds like it would work, so I would first set my:
> >>>
> >>> Non spam actions = somefile.rules
> >>>
> >>> In somefile.rules I put the default, to be deliver , and for my per
> > domain
> >>> would be:
> >>>
> >>> From: *@domain.com      ?
> >>> FromOrTo:       default deliver
> >>>
> >>> Please let me know what I would put here, and how to envoke a custom
> >>> function, and if possible what this might look like,
> >>>
> >>> Thanks,
> >>>
> >>> Steve
> >>>
> >>> -----Original Message-----
> >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >> Behalf
> >>> Of Julian Field
> >>> Sent: Friday, October 15, 2004 12:24 PM
> >>> To: MAILSCANNER@JISCMAIL.AC.UK
> >>> Subject: Re: MailScanner Text File Creation
> >>>
> >>> At 17:07 15/10/2004, you wrote:
> >>>> Good day:
> >>>>
> >>>> I had sent previously but missed the reply, if any.
> >>>>
> >>>> We have an application where we would need to have the following to
> >> occur:
> >>>>
> >>>>> From *@domain.com ,
> >>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> >>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient of
> >> the
> >>>> message on a separate line.
> >>>>
> >>>> Also, the message should stop there, i.e. not be sent out, as the
> >>> processing
> >>>> we have on those messages, will anylize then send those.
> >>>>
> >>>> Is there any way that MailScanner can be set up to do this?
> >>>
> >>> You would probably need to write a Custom Function to do this, and
> > probably
> >>> attach it to the "non-spam actions" configuration option. This could
>test
> >>> for the *@domain.com and write out the message in the files you want.
> >>>
> >>> The alternative would be to archive mail using "Archive Mail" and a
> >>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> > processed
> >>> the archive entries to generate the processed data you want, then
>deleted
> >>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sconway at WLNET.COM  Mon Oct 25 18:21:14 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3906.1137101242.24926.mailscanner@lists.mailscanner.info>

Hello:

I do know perl and am writing the functions, but I am looking now at the
Custom Function , the only problem I have, is that the Custom Function must
be called from within the config file, and not from within a ruleset.  If I
use custom functions, the one for the non SPAM actions is easy enough, but I
will also need to do all archiving things / criteria from a custom function
as well.  Or is it possible to do a custom action from within a ruleset?  If
not, this would be a great future additon to provide the option to run
custom actions from within a ruleset, in a similar fashion to the way you
have already from within the config file.

Thanks,

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, October 25, 2004 1:08 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

Yes, it can be done. It would need a Custom Function attached to the
Archive Mail option, and one attached to the non-spam actions option. This
could ask if the particular header was defined, and produce a different
result in this case, compared to the normal response.

But you will need some knowledge of perl to be able to write this.

At 17:00 25/10/2004, you wrote:
>Hello Again:
>
>In this case, if somehow a Spammer managed to know what our custom header
>was, and placed it into messages, these messages would be processed
>normally, (i.e. by the MS SPAM blocking routines, and / or SPAM Assassin,
>anti-virus, etc).  It would, in this case only by-pass our archiving rule
>and also our delete rule.
>
>In other words, since the message was already processed by MS, if I ran it
>through Sendmail again, would MS capture it and archive it the second time?
>
>All we are wondering , is if it can be done, and if so, how?
>
>Thanks for any assistance.
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Monday, October 25, 2004 11:01 AM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>And what happens when a spammer starts sending you mail with that header in
>it? You can't trust anything in the headers at all.
>
>On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> > Hello:
> >
> > I have managed the following, and have one further issue:
> >
> > I am now creating the archive, and also am 'deleting' the outgoing
>message,.
> > I have now a question about MailScanner rules, is there anyway that MS
can
> > match on any other criteria, i.e. if a certain header exists in a
message,
> > then do something?  Example, after my processes analyze the archive
>created
> > above, I must then re-send the messages to the Internet to the actual
> > recipients, but if I again put them through MS, they will again end up
in
> > the archive, and a loop will be started.  I could send them via another
> > Sendmail process , or via another SMTP host but this involves running
>other
> > processes, or server..
> >
> > After each process above, I put a header field into the messages
>'X-FLTMAIL'
> > .  What I would like to know is if MS finds this header, then it should
>not
> > archive the message , and also bypass the 'delete' rule .
> >
> > Any ideas on how this can be done?  In looking at ruleset syntax, it is
> > always 'from / To or Default' anyway to check for other fields /
criteria?
> > Maybe through a custom function?
> >
> > Thanks,
> >
> > Steve
> >
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> > Of Julian Field
> > Sent: Saturday, October 23, 2004 12:17 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: MailScanner Text File Creation
> >
> > All you need to do to stop it delivering them is to use a 2-line ruleset
> > for Non spam actions, spam actions and high scoring spam actions.
> > From: domain.com delete
> > FromOrTo: default deliver
> >
> > Then use a ruleset for Archive Mail that says
> > From: domain.com yes
> > FromOrTo: default no
> >
> > At 16:31 23/10/2004, you wrote:
> >> Good day:
> >>
> >> The problem with using the archive method, is that the archive only
>stores
> > a
> >> copy there, but the messages are then delivered to their final
>recipients.
> >> What we need is for any mail from the domain to not be delivered , but
> >> instead just copied to the location with the address file being
>generated.
> >> Which function in customconfig would I need to use?
> >>
> >> Thanks,
> >>
> >> Steve
> >>
> >> -----Original Message-----
> >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf
> >> Of Julian Field
> >> Sent: Saturday, October 23, 2004 11:04 AM
> >> To: MAILSCANNER@JISCMAIL.AC.UK
> >> Subject: Re: MailScanner Text File Creation
> >>
> >> Take a look in CustomConfig.pm. There are several examples in there,
> >> including a commented-out skeleton of what you need to do. Your Custom
> >> Function should return 'deliver' for all the messages except the ones
you
> >> are interested in, and copy the files where you want them for the
> >> domain.com messages. You invoke it by putting
> >> Non spam actions = &YourCustomFunctionName
> >> in MailScanner.conf.
> >>
> >> The alternative approach I suggested (involving the mail archive) may
be
> >> much easier for you to get working.
> >>
> >> At 15:49 23/10/2004, you wrote:
> >>> Hello Again:
> >>>
> >>> The custom function sounds like it would work, so I would first set
my:
> >>>
> >>> Non spam actions = somefile.rules
> >>>
> >>> In somefile.rules I put the default, to be deliver , and for my per
> > domain
> >>> would be:
> >>>
> >>> From: *@domain.com      ?
> >>> FromOrTo:       default deliver
> >>>
> >>> Please let me know what I would put here, and how to envoke a custom
> >>> function, and if possible what this might look like,
> >>>
> >>> Thanks,
> >>>
> >>> Steve
> >>>
> >>> -----Original Message-----
> >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >> Behalf
> >>> Of Julian Field
> >>> Sent: Friday, October 15, 2004 12:24 PM
> >>> To: MAILSCANNER@JISCMAIL.AC.UK
> >>> Subject: Re: MailScanner Text File Creation
> >>>
> >>> At 17:07 15/10/2004, you wrote:
> >>>> Good day:
> >>>>
> >>>> I had sent previously but missed the reply, if any.
> >>>>
> >>>> We have an application where we would need to have the following to
> >> occur:
> >>>>
> >>>>> From *@domain.com ,
> >>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> >>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient
of
> >> the
> >>>> message on a separate line.
> >>>>
> >>>> Also, the message should stop there, i.e. not be sent out, as the
> >>> processing
> >>>> we have on those messages, will anylize then send those.
> >>>>
> >>>> Is there any way that MailScanner can be set up to do this?
> >>>
> >>> You would probably need to write a Custom Function to do this, and
> > probably
> >>> attach it to the "non-spam actions" configuration option. This could
>test
> >>> for the *@domain.com and write out the message in the files you want.
> >>>
> >>> The alternative would be to archive mail using "Archive Mail" and a
> >>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> > processed
> >>> the archive entries to generate the processed data you want, then
>deleted
> >>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 18:31:19 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3907.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 18:21 25/10/2004, you wrote:
>Hello:
>
>I do know perl and am writing the functions, but I am looking now at the
>Custom Function , the only problem I have, is that the Custom Function must
>be called from within the config file, and not from within a ruleset.  If I
>use custom functions, the one for the non SPAM actions is easy enough, but I
>will also need to do all archiving things / criteria from a custom function
>as well.  Or is it possible to do a custom action from within a ruleset?

You can't call a custom function from a ruleset, just from a config option.

>   If
>not, this would be a great future additon to provide the option to run
>custom actions from within a ruleset, in a similar fashion to the way you
>have already from within the config file.

It's not trivial to do. Why can't you just make the custom function make
the same decisions as the ruleset would have made?

>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Monday, October 25, 2004 1:08 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>Yes, it can be done. It would need a Custom Function attached to the
>Archive Mail option, and one attached to the non-spam actions option. This
>could ask if the particular header was defined, and produce a different
>result in this case, compared to the normal response.
>
>But you will need some knowledge of perl to be able to write this.
>
>At 17:00 25/10/2004, you wrote:
> >Hello Again:
> >
> >In this case, if somehow a Spammer managed to know what our custom header
> >was, and placed it into messages, these messages would be processed
> >normally, (i.e. by the MS SPAM blocking routines, and / or SPAM Assassin,
> >anti-virus, etc).  It would, in this case only by-pass our archiving rule
> >and also our delete rule.
> >
> >In other words, since the message was already processed by MS, if I ran it
> >through Sendmail again, would MS capture it and archive it the second time?
> >
> >All we are wondering , is if it can be done, and if so, how?
> >
> >Thanks for any assistance.
> >
> >Steve
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Monday, October 25, 2004 11:01 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >And what happens when a spammer starts sending you mail with that header in
> >it? You can't trust anything in the headers at all.
> >
> >On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> > > Hello:
> > >
> > > I have managed the following, and have one further issue:
> > >
> > > I am now creating the archive, and also am 'deleting' the outgoing
> >message,.
> > > I have now a question about MailScanner rules, is there anyway that MS
>can
> > > match on any other criteria, i.e. if a certain header exists in a
>message,
> > > then do something?  Example, after my processes analyze the archive
> >created
> > > above, I must then re-send the messages to the Internet to the actual
> > > recipients, but if I again put them through MS, they will again end up
>in
> > > the archive, and a loop will be started.  I could send them via another
> > > Sendmail process , or via another SMTP host but this involves running
> >other
> > > processes, or server..
> > >
> > > After each process above, I put a header field into the messages
> >'X-FLTMAIL'
> > > .  What I would like to know is if MS finds this header, then it should
> >not
> > > archive the message , and also bypass the 'delete' rule .
> > >
> > > Any ideas on how this can be done?  In looking at ruleset syntax, it is
> > > always 'from / To or Default' anyway to check for other fields /
>criteria?
> > > Maybe through a custom function?
> > >
> > > Thanks,
> > >
> > > Steve
> > >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >Behalf
> > > Of Julian Field
> > > Sent: Saturday, October 23, 2004 12:17 PM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: MailScanner Text File Creation
> > >
> > > All you need to do to stop it delivering them is to use a 2-line ruleset
> > > for Non spam actions, spam actions and high scoring spam actions.
> > > From: domain.com delete
> > > FromOrTo: default deliver
> > >
> > > Then use a ruleset for Archive Mail that says
> > > From: domain.com yes
> > > FromOrTo: default no
> > >
> > > At 16:31 23/10/2004, you wrote:
> > >> Good day:
> > >>
> > >> The problem with using the archive method, is that the archive only
> >stores
> > > a
> > >> copy there, but the messages are then delivered to their final
> >recipients.
> > >> What we need is for any mail from the domain to not be delivered , but
> > >> instead just copied to the location with the address file being
> >generated.
> > >> Which function in customconfig would I need to use?
> > >>
> > >> Thanks,
> > >>
> > >> Steve
> > >>
> > >> -----Original Message-----
> > >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > Behalf
> > >> Of Julian Field
> > >> Sent: Saturday, October 23, 2004 11:04 AM
> > >> To: MAILSCANNER@JISCMAIL.AC.UK
> > >> Subject: Re: MailScanner Text File Creation
> > >>
> > >> Take a look in CustomConfig.pm. There are several examples in there,
> > >> including a commented-out skeleton of what you need to do. Your Custom
> > >> Function should return 'deliver' for all the messages except the ones
>you
> > >> are interested in, and copy the files where you want them for the
> > >> domain.com messages. You invoke it by putting
> > >> Non spam actions = &YourCustomFunctionName
> > >> in MailScanner.conf.
> > >>
> > >> The alternative approach I suggested (involving the mail archive) may
>be
> > >> much easier for you to get working.
> > >>
> > >> At 15:49 23/10/2004, you wrote:
> > >>> Hello Again:
> > >>>
> > >>> The custom function sounds like it would work, so I would first set
>my:
> > >>>
> > >>> Non spam actions = somefile.rules
> > >>>
> > >>> In somefile.rules I put the default, to be deliver , and for my per
> > > domain
> > >>> would be:
> > >>>
> > >>> From: *@domain.com      ?
> > >>> FromOrTo:       default deliver
> > >>>
> > >>> Please let me know what I would put here, and how to envoke a custom
> > >>> function, and if possible what this might look like,
> > >>>
> > >>> Thanks,
> > >>>
> > >>> Steve
> > >>>
> > >>> -----Original Message-----
> > >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > >> Behalf
> > >>> Of Julian Field
> > >>> Sent: Friday, October 15, 2004 12:24 PM
> > >>> To: MAILSCANNER@JISCMAIL.AC.UK
> > >>> Subject: Re: MailScanner Text File Creation
> > >>>
> > >>> At 17:07 15/10/2004, you wrote:
> > >>>> Good day:
> > >>>>
> > >>>> I had sent previously but missed the reply, if any.
> > >>>>
> > >>>> We have an application where we would need to have the following to
> > >> occur:
> > >>>>
> > >>>>> From *@domain.com ,
> > >>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > >>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient
>of
> > >> the
> > >>>> message on a separate line.
> > >>>>
> > >>>> Also, the message should stop there, i.e. not be sent out, as the
> > >>> processing
> > >>>> we have on those messages, will anylize then send those.
> > >>>>
> > >>>> Is there any way that MailScanner can be set up to do this?
> > >>>
> > >>> You would probably need to write a Custom Function to do this, and
> > > probably
> > >>> attach it to the "non-spam actions" configuration option. This could
> >test
> > >>> for the *@domain.com and write out the message in the files you want.
> > >>>
> > >>> The alternative would be to archive mail using "Archive Mail" and a
> > >>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> > > processed
> > >>> the archive entries to generate the processed data you want, then
> >deleted
> > >>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sconway at WLNET.COM  Mon Oct 25 18:49:04 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3908.1137101242.24926.mailscanner@lists.mailscanner.info>

Hello:

That is what I am doing now, is writing the two functions.  For the
'archiving' all I need do , is return what would have been in the action of
the ruleset, after matching my criteria?  I.e. , if it was archived to a
location, or to another email address, just return these vaules back to MS ?

Thanks for all assistance.

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, October 25, 2004 1:31 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

At 18:21 25/10/2004, you wrote:
>Hello:
>
>I do know perl and am writing the functions, but I am looking now at the
>Custom Function , the only problem I have, is that the Custom Function must
>be called from within the config file, and not from within a ruleset.  If I
>use custom functions, the one for the non SPAM actions is easy enough, but
I
>will also need to do all archiving things / criteria from a custom function
>as well.  Or is it possible to do a custom action from within a ruleset?

You can't call a custom function from a ruleset, just from a config option.

>   If
>not, this would be a great future additon to provide the option to run
>custom actions from within a ruleset, in a similar fashion to the way you
>have already from within the config file.

It's not trivial to do. Why can't you just make the custom function make
the same decisions as the ruleset would have made?

>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Monday, October 25, 2004 1:08 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>Yes, it can be done. It would need a Custom Function attached to the
>Archive Mail option, and one attached to the non-spam actions option. This
>could ask if the particular header was defined, and produce a different
>result in this case, compared to the normal response.
>
>But you will need some knowledge of perl to be able to write this.
>
>At 17:00 25/10/2004, you wrote:
> >Hello Again:
> >
> >In this case, if somehow a Spammer managed to know what our custom header
> >was, and placed it into messages, these messages would be processed
> >normally, (i.e. by the MS SPAM blocking routines, and / or SPAM Assassin,
> >anti-virus, etc).  It would, in this case only by-pass our archiving rule
> >and also our delete rule.
> >
> >In other words, since the message was already processed by MS, if I ran
it
> >through Sendmail again, would MS capture it and archive it the second
time?
> >
> >All we are wondering , is if it can be done, and if so, how?
> >
> >Thanks for any assistance.
> >
> >Steve
> >
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Monday, October 25, 2004 11:01 AM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >And what happens when a spammer starts sending you mail with that header
in
> >it? You can't trust anything in the headers at all.
> >
> >On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> > > Hello:
> > >
> > > I have managed the following, and have one further issue:
> > >
> > > I am now creating the archive, and also am 'deleting' the outgoing
> >message,.
> > > I have now a question about MailScanner rules, is there anyway that MS
>can
> > > match on any other criteria, i.e. if a certain header exists in a
>message,
> > > then do something?  Example, after my processes analyze the archive
> >created
> > > above, I must then re-send the messages to the Internet to the actual
> > > recipients, but if I again put them through MS, they will again end up
>in
> > > the archive, and a loop will be started.  I could send them via
another
> > > Sendmail process , or via another SMTP host but this involves running
> >other
> > > processes, or server..
> > >
> > > After each process above, I put a header field into the messages
> >'X-FLTMAIL'
> > > .  What I would like to know is if MS finds this header, then it
should
> >not
> > > archive the message , and also bypass the 'delete' rule .
> > >
> > > Any ideas on how this can be done?  In looking at ruleset syntax, it
is
> > > always 'from / To or Default' anyway to check for other fields /
>criteria?
> > > Maybe through a custom function?
> > >
> > > Thanks,
> > >
> > > Steve
> > >
> > > -----Original Message-----
> > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >Behalf
> > > Of Julian Field
> > > Sent: Saturday, October 23, 2004 12:17 PM
> > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > Subject: Re: MailScanner Text File Creation
> > >
> > > All you need to do to stop it delivering them is to use a 2-line
ruleset
> > > for Non spam actions, spam actions and high scoring spam actions.
> > > From: domain.com delete
> > > FromOrTo: default deliver
> > >
> > > Then use a ruleset for Archive Mail that says
> > > From: domain.com yes
> > > FromOrTo: default no
> > >
> > > At 16:31 23/10/2004, you wrote:
> > >> Good day:
> > >>
> > >> The problem with using the archive method, is that the archive only
> >stores
> > > a
> > >> copy there, but the messages are then delivered to their final
> >recipients.
> > >> What we need is for any mail from the domain to not be delivered ,
but
> > >> instead just copied to the location with the address file being
> >generated.
> > >> Which function in customconfig would I need to use?
> > >>
> > >> Thanks,
> > >>
> > >> Steve
> > >>
> > >> -----Original Message-----
> > >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > Behalf
> > >> Of Julian Field
> > >> Sent: Saturday, October 23, 2004 11:04 AM
> > >> To: MAILSCANNER@JISCMAIL.AC.UK
> > >> Subject: Re: MailScanner Text File Creation
> > >>
> > >> Take a look in CustomConfig.pm. There are several examples in there,
> > >> including a commented-out skeleton of what you need to do. Your
Custom
> > >> Function should return 'deliver' for all the messages except the ones
>you
> > >> are interested in, and copy the files where you want them for the
> > >> domain.com messages. You invoke it by putting
> > >> Non spam actions = &YourCustomFunctionName
> > >> in MailScanner.conf.
> > >>
> > >> The alternative approach I suggested (involving the mail archive) may
>be
> > >> much easier for you to get working.
> > >>
> > >> At 15:49 23/10/2004, you wrote:
> > >>> Hello Again:
> > >>>
> > >>> The custom function sounds like it would work, so I would first set
>my:
> > >>>
> > >>> Non spam actions = somefile.rules
> > >>>
> > >>> In somefile.rules I put the default, to be deliver , and for my per
> > > domain
> > >>> would be:
> > >>>
> > >>> From: *@domain.com      ?
> > >>> FromOrTo:       default deliver
> > >>>
> > >>> Please let me know what I would put here, and how to envoke a custom
> > >>> function, and if possible what this might look like,
> > >>>
> > >>> Thanks,
> > >>>
> > >>> Steve
> > >>>
> > >>> -----Original Message-----
> > >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
On
> > >> Behalf
> > >>> Of Julian Field
> > >>> Sent: Friday, October 15, 2004 12:24 PM
> > >>> To: MAILSCANNER@JISCMAIL.AC.UK
> > >>> Subject: Re: MailScanner Text File Creation
> > >>>
> > >>> At 17:07 15/10/2004, you wrote:
> > >>>> Good day:
> > >>>>
> > >>>> I had sent previously but missed the reply, if any.
> > >>>>
> > >>>> We have an application where we would need to have the following to
> > >> occur:
> > >>>>
> > >>>>> From *@domain.com ,
> > >>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > >>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient
>of
> > >> the
> > >>>> message on a separate line.
> > >>>>
> > >>>> Also, the message should stop there, i.e. not be sent out, as the
> > >>> processing
> > >>>> we have on those messages, will anylize then send those.
> > >>>>
> > >>>> Is there any way that MailScanner can be set up to do this?
> > >>>
> > >>> You would probably need to write a Custom Function to do this, and
> > > probably
> > >>> attach it to the "non-spam actions" configuration option. This could
> >test
> > >>> for the *@domain.com and write out the message in the files you
want.
> > >>>
> > >>> The alternative would be to archive mail using "Archive Mail" and a
> > >>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> > > processed
> > >>> the archive entries to generate the processed data you want, then
> >deleted
> > >>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wagner at MILLER-ENGINEERING.COM  Mon Oct 25 18:48:38 2004
From: wagner at MILLER-ENGINEERING.COM (Joseph Wagner)
Date: Thu Jan 12 21:27:22 2006
Subject: scanning mail over and over
Message-ID: <mailman.3909.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I am trying to setup an email server that uses Mailscanner but I'm
having a bit of a problem.
I am using:
Postfix 2.0.18
ClamAV v0.80
Mailscanner v4.34.8
it's running on Trustix 2.1

For the most part the system seems to be working.  I sent test infected
messages to it and it caught most of them.
But, mailscanner has been scanning some of the same messages over and
over again without any action being taken.
Here is a snippet from  /var/log/mail/info

Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
messages, 44308 bytes
Oct 25 08:27:30 moon MailScanner[30094]: MailScanner E-Mail Virus
Scanner version 4.34.8 starting...
Oct 25 08:27:30 moon MailScanner[30061]: Virus and Content Scanning:
Starting
Oct 25 08:27:31 moon MailScanner[30094]: Using locktype = flock
Oct 25 08:27:33 moon MailScanner[30061]: Filename Checks: Windows/DOS
Executable (25940108FBB eicar.com)
Oct 25 08:27:33 moon MailScanner[30061]: Other Checks: Found 1 problems
Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
messages, 44308 bytes
Oct 25 08:27:40 moon MailScanner[30094]: Virus and Content Scanning:
Starting
Oct 25 08:27:40 moon MailScanner[30134]: MailScanner E-Mail Virus
Scanner version 4.34.8 starting...
Oct 25 08:27:41 moon MailScanner[30134]: Using locktype = flock
Oct 25 08:27:43 moon MailScanner[30094]: Filename Checks: Windows/DOS
Executable (25940108FBB eicar.com)
Oct 25 08:27:43 moon MailScanner[30094]: Other Checks: Found 1 problems
Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
messages, 44308 bytes
Oct 25 08:27:50 moon MailScanner[30134]: Virus and Content Scanning:
Starting
Oct 25 08:27:50 moon MailScanner[30166]: MailScanner E-Mail Virus
Scanner version 4.34.8 starting...
Oct 25 08:27:51 moon MailScanner[30166]: Using locktype = flock
Oct 25 08:27:53 moon MailScanner[30134]: Filename Checks: Windows/DOS
Executable (25940108FBB eicar.com)
Oct 25 08:27:53 moon MailScanner[30134]: Other Checks: Found 1 problems
Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
messages, 44308 bytes
Oct 25 08:28:00 moon MailScanner[30201]: MailScanner E-Mail Virus
Scanner version 4.34.8 starting...
Oct 25 08:28:00 moon MailScanner[30166]: Virus and Content Scanning:
Starting
Oct 25 08:28:01 moon MailScanner[30201]: Using locktype = flock
Oct 25 08:28:03 moon MailScanner[30166]: Filename Checks: Windows/DOS
Executable (25940108FBB eicar.com)
Oct 25 08:28:03 moon MailScanner[30166]: Other Checks: Found 1 problems

Any clues? Does anyone have any tips for running Mailscanner on Trustix 2.1?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From peter at UCGBOOK.COM  Mon Oct 25 19:15:14 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:22 2006
Subject: scanning mail over and over
Message-ID: <mailman.3910.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Joseph Wagner wrote:
> Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
> messages, 44308 bytes
> Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
> messages, 44308 bytes
> Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
> messages, 44308 bytes
> Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
> messages, 44308 bytes
>
> Any clues? Does anyone have any tips for running Mailscanner on Trustix
> 2.1?

I'm not sure but it looks like several MS children are picking up your
test message which would indicate a file locking problem. Could you try
posix instead of flock?

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 19:17:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: scanning mail over and over
Message-ID: <mailman.3911.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Go into debug mode and see what it is saying. Kill all your MailScanner
processes, set
         Debug = yes
         Debug SpamAssassin = yes
in MailScanner.conf, and run check_mailscanner. I suspect it will print an
error message.

At 18:48 25/10/2004, you wrote:
>I am trying to setup an email server that uses Mailscanner but I'm
>having a bit of a problem.
>I am using:
>Postfix 2.0.18
>ClamAV v0.80
>Mailscanner v4.34.8
>it's running on Trustix 2.1
>
>For the most part the system seems to be working.  I sent test infected
>messages to it and it caught most of them.
>But, mailscanner has been scanning some of the same messages over and
>over again without any action being taken.
>Here is a snippet from  /var/log/mail/info
>
>Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:27:30 moon MailScanner[30094]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:27:30 moon MailScanner[30061]: Virus and Content Scanning:
>Starting
>Oct 25 08:27:31 moon MailScanner[30094]: Using locktype = flock
>Oct 25 08:27:33 moon MailScanner[30061]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:27:33 moon MailScanner[30061]: Other Checks: Found 1 problems
>Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:27:40 moon MailScanner[30094]: Virus and Content Scanning:
>Starting
>Oct 25 08:27:40 moon MailScanner[30134]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:27:41 moon MailScanner[30134]: Using locktype = flock
>Oct 25 08:27:43 moon MailScanner[30094]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:27:43 moon MailScanner[30094]: Other Checks: Found 1 problems
>Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:27:50 moon MailScanner[30134]: Virus and Content Scanning:
>Starting
>Oct 25 08:27:50 moon MailScanner[30166]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:27:51 moon MailScanner[30166]: Using locktype = flock
>Oct 25 08:27:53 moon MailScanner[30134]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:27:53 moon MailScanner[30134]: Other Checks: Found 1 problems
>Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
>messages, 44308 bytes
>Oct 25 08:28:00 moon MailScanner[30201]: MailScanner E-Mail Virus
>Scanner version 4.34.8 starting...
>Oct 25 08:28:00 moon MailScanner[30166]: Virus and Content Scanning:
>Starting
>Oct 25 08:28:01 moon MailScanner[30201]: Using locktype = flock
>Oct 25 08:28:03 moon MailScanner[30166]: Filename Checks: Windows/DOS
>Executable (25940108FBB eicar.com)
>Oct 25 08:28:03 moon MailScanner[30166]: Other Checks: Found 1 problems
>
>Any clues? Does anyone have any tips for running Mailscanner on Trustix 2.1?
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From mailscanner at ecs.soton.ac.uk  Mon Oct 25 19:15:59 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3912.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Yes.

Custom Functions just need to return what would be the action of a ruleset.
Oh, with one exception, which I really must get around to fixing some time.
For yes/no results, you must return 1 or 0 (yes=1, no=0).

At 18:49 25/10/2004, you wrote:
>Hello:
>
>That is what I am doing now, is writing the two functions.  For the
>'archiving' all I need do , is return what would have been in the action of
>the ruleset, after matching my criteria?  I.e. , if it was archived to a
>location, or to another email address, just return these vaules back to MS ?
>
>Thanks for all assistance.
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Monday, October 25, 2004 1:31 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>At 18:21 25/10/2004, you wrote:
> >Hello:
> >
> >I do know perl and am writing the functions, but I am looking now at the
> >Custom Function , the only problem I have, is that the Custom Function must
> >be called from within the config file, and not from within a ruleset.  If I
> >use custom functions, the one for the non SPAM actions is easy enough, but
>I
> >will also need to do all archiving things / criteria from a custom function
> >as well.  Or is it possible to do a custom action from within a ruleset?
>
>You can't call a custom function from a ruleset, just from a config option.
>
> >   If
> >not, this would be a great future additon to provide the option to run
> >custom actions from within a ruleset, in a similar fashion to the way you
> >have already from within the config file.
>
>It's not trivial to do. Why can't you just make the custom function make
>the same decisions as the ruleset would have made?
>
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Monday, October 25, 2004 1:08 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >Yes, it can be done. It would need a Custom Function attached to the
> >Archive Mail option, and one attached to the non-spam actions option. This
> >could ask if the particular header was defined, and produce a different
> >result in this case, compared to the normal response.
> >
> >But you will need some knowledge of perl to be able to write this.
> >
> >At 17:00 25/10/2004, you wrote:
> > >Hello Again:
> > >
> > >In this case, if somehow a Spammer managed to know what our custom header
> > >was, and placed it into messages, these messages would be processed
> > >normally, (i.e. by the MS SPAM blocking routines, and / or SPAM Assassin,
> > >anti-virus, etc).  It would, in this case only by-pass our archiving rule
> > >and also our delete rule.
> > >
> > >In other words, since the message was already processed by MS, if I ran
>it
> > >through Sendmail again, would MS capture it and archive it the second
>time?
> > >
> > >All we are wondering , is if it can be done, and if so, how?
> > >
> > >Thanks for any assistance.
> > >
> > >Steve
> > >
> > >-----Original Message-----
> > >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >Behalf
> > >Of Julian Field
> > >Sent: Monday, October 25, 2004 11:01 AM
> > >To: MAILSCANNER@JISCMAIL.AC.UK
> > >Subject: Re: MailScanner Text File Creation
> > >
> > >And what happens when a spammer starts sending you mail with that header
>in
> > >it? You can't trust anything in the headers at all.
> > >
> > >On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> > > > Hello:
> > > >
> > > > I have managed the following, and have one further issue:
> > > >
> > > > I am now creating the archive, and also am 'deleting' the outgoing
> > >message,.
> > > > I have now a question about MailScanner rules, is there anyway that MS
> >can
> > > > match on any other criteria, i.e. if a certain header exists in a
> >message,
> > > > then do something?  Example, after my processes analyze the archive
> > >created
> > > > above, I must then re-send the messages to the Internet to the actual
> > > > recipients, but if I again put them through MS, they will again end up
> >in
> > > > the archive, and a loop will be started.  I could send them via
>another
> > > > Sendmail process , or via another SMTP host but this involves running
> > >other
> > > > processes, or server..
> > > >
> > > > After each process above, I put a header field into the messages
> > >'X-FLTMAIL'
> > > > .  What I would like to know is if MS finds this header, then it
>should
> > >not
> > > > archive the message , and also bypass the 'delete' rule .
> > > >
> > > > Any ideas on how this can be done?  In looking at ruleset syntax, it
>is
> > > > always 'from / To or Default' anyway to check for other fields /
> >criteria?
> > > > Maybe through a custom function?
> > > >
> > > > Thanks,
> > > >
> > > > Steve
> > > >
> > > > -----Original Message-----
> > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > >Behalf
> > > > Of Julian Field
> > > > Sent: Saturday, October 23, 2004 12:17 PM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: MailScanner Text File Creation
> > > >
> > > > All you need to do to stop it delivering them is to use a 2-line
>ruleset
> > > > for Non spam actions, spam actions and high scoring spam actions.
> > > > From: domain.com delete
> > > > FromOrTo: default deliver
> > > >
> > > > Then use a ruleset for Archive Mail that says
> > > > From: domain.com yes
> > > > FromOrTo: default no
> > > >
> > > > At 16:31 23/10/2004, you wrote:
> > > >> Good day:
> > > >>
> > > >> The problem with using the archive method, is that the archive only
> > >stores
> > > > a
> > > >> copy there, but the messages are then delivered to their final
> > >recipients.
> > > >> What we need is for any mail from the domain to not be delivered ,
>but
> > > >> instead just copied to the location with the address file being
> > >generated.
> > > >> Which function in customconfig would I need to use?
> > > >>
> > > >> Thanks,
> > > >>
> > > >> Steve
> > > >>
> > > >> -----Original Message-----
> > > >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > > > Behalf
> > > >> Of Julian Field
> > > >> Sent: Saturday, October 23, 2004 11:04 AM
> > > >> To: MAILSCANNER@JISCMAIL.AC.UK
> > > >> Subject: Re: MailScanner Text File Creation
> > > >>
> > > >> Take a look in CustomConfig.pm. There are several examples in there,
> > > >> including a commented-out skeleton of what you need to do. Your
>Custom
> > > >> Function should return 'deliver' for all the messages except the ones
> >you
> > > >> are interested in, and copy the files where you want them for the
> > > >> domain.com messages. You invoke it by putting
> > > >> Non spam actions = &YourCustomFunctionName
> > > >> in MailScanner.conf.
> > > >>
> > > >> The alternative approach I suggested (involving the mail archive) may
> >be
> > > >> much easier for you to get working.
> > > >>
> > > >> At 15:49 23/10/2004, you wrote:
> > > >>> Hello Again:
> > > >>>
> > > >>> The custom function sounds like it would work, so I would first set
> >my:
> > > >>>
> > > >>> Non spam actions = somefile.rules
> > > >>>
> > > >>> In somefile.rules I put the default, to be deliver , and for my per
> > > > domain
> > > >>> would be:
> > > >>>
> > > >>> From: *@domain.com      ?
> > > >>> FromOrTo:       default deliver
> > > >>>
> > > >>> Please let me know what I would put here, and how to envoke a custom
> > > >>> function, and if possible what this might look like,
> > > >>>
> > > >>> Thanks,
> > > >>>
> > > >>> Steve
> > > >>>
> > > >>> -----Original Message-----
> > > >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
>On
> > > >> Behalf
> > > >>> Of Julian Field
> > > >>> Sent: Friday, October 15, 2004 12:24 PM
> > > >>> To: MAILSCANNER@JISCMAIL.AC.UK
> > > >>> Subject: Re: MailScanner Text File Creation
> > > >>>
> > > >>> At 17:07 15/10/2004, you wrote:
> > > >>>> Good day:
> > > >>>>
> > > >>>> I had sent previously but missed the reply, if any.
> > > >>>>
> > > >>>> We have an application where we would need to have the following to
> > > >> occur:
> > > >>>>
> > > >>>>> From *@domain.com ,
> > > >>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > > >>>> Put a file to /anypath/MESSAGEREF.add which contains each recipient
> >of
> > > >> the
> > > >>>> message on a separate line.
> > > >>>>
> > > >>>> Also, the message should stop there, i.e. not be sent out, as the
> > > >>> processing
> > > >>>> we have on those messages, will anylize then send those.
> > > >>>>
> > > >>>> Is there any way that MailScanner can be set up to do this?
> > > >>>
> > > >>> You would probably need to write a Custom Function to do this, and
> > > > probably
> > > >>> attach it to the "non-spam actions" configuration option. This could
> > >test
> > > >>> for the *@domain.com and write out the message in the files you
>want.
> > > >>>
> > > >>> The alternative would be to archive mail using "Archive Mail" and a
> > > >>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> > > > processed
> > > >>> the archive entries to generate the processed data you want, then
> > >deleted
> > > >>> the original archive files so it didn't process the same mail twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From vachanta at GMAIL.COM  Mon Oct 25 19:32:47 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment to outbound e-mail
Message-ID: <mailman.3913.1137101242.24926.mailscanner@lists.mailscanner.info>

Hello,

     we are attaching a disclaimer to every out-going e-mail through the
mailscanner using the inline.sig.txt and inline.sig.html,its working great

if someone sends out a e-mail and get a repsonse and if he responds again
the disclaimer is getting attached again.if this happens X number of times
we end up having disclaimer attached X number of time as well which looks
ugly(better than spam though :-)) )

But i am curious to know if someone on this list is able to strip that
disclaimers that many times and have only one disclaimer attached
regardless of how many times we replied to the message.

Thanks in advance for all the informative replies,

Venkata Achanta

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From quinting at HSD.CA  Mon Oct 25 19:34:50 2004
From: quinting at HSD.CA (Quintin Giesbrecht)
Date: Thu Jan 12 21:27:22 2006
Subject: Test-harness
Message-ID: <mailman.3914.1137101242.24926.mailscanner@lists.mailscanner.info>

I get the following when installing Clam-SA - It fails at installing test-harness.  Can anyone enlighten me as to how to correct this?

Thanks


t/test-harness......NOK 40#     Failed test (t/test-harness.t at line 535)
#          got: 'Scalar found where operator expected at (eval 162) line 1, near "'int'  $__val"
#       (Missing operator before   $__val?)

-----Original Message-----
From: Denis Beauchemin [mailto:Denis.Beauchemin@USHERBROOKE.CA] 
Sent: October 6, 2004 12:36 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: ANNOUNCE: MailScanner Stable 4.34.8 released


Julian (looks like the previous message didn't go to the list),

I upgraded one of my servers to 4.34.8 and my filename.rules.conf got 
replaced by the one in the installation RPM.  No rpmnew or rpmsave...

Since I customized it with French comments, I was surprised to see 
English comments in emails sent to users...

Could you make sure this doesn't happen again?  I always look for rpmnew 
files after an upgrade, but I didn't I needed also to look at other 
files also.

I also had problems with perl-ExtUtils-MakeMaker-6.05-1:
le fichier /usr/share/man/man3/ExtUtils::testlib.3pm.gz de 
l'installation de perl-ExtUtils-MakeMaker-6.05-1 entre en conflit avec 
le fichier du paquetage perl-5.8.0-88.7

Sorry for the French error message.  It says that it is conflicting with 
my Perl 5.8 RPM...  I had to force install it.

Thanks again!

PS: Here is the output of MS -V on that server:
Running on
Linux smtpi1.usherbrooke.ca 2.4.21-15.0.4.EL #1 Sat Jul 31 01:33:50 EDT 
2004 i686 i686 i386 GNU/Linux
This is Red Hat Enterprise Linux AS release 3 (Taroon Update 3)
This is Perl version 5.008000 (5.8.0)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.04    Fcntl
2.71    File::Basename
2.05    File::Copy
2.01    FileHandle
1.05    File::Path
0.13    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.20    IO
1.09    IO::File
1.122   IO::Pipe
3.03    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.05    POSIX
1.75    Socket
0.03    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.00    Digest
1.01    Digest::HMAC
2.20    Digest::MD5
2.10    Digest::SHA1
missing Inline
missing Mail::ClamAV
3.000000        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
missing Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.26    Test::Harness
0.47    Test::Simple
1.89    Text::Balanced
1.31    URI

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From sconway at WLNET.COM  Mon Oct 25 20:09:25 2004
From: sconway at WLNET.COM (Stephen Conway)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner Text File Creation
Message-ID: <mailman.3915.1137101242.24926.mailscanner@lists.mailscanner.info>

Hello:

Great, I have found actually that I can do all I need with really one
function, (that running off the non spam actions), here checking the sender
and our header criteria, and based on this either deleting and creating the
archive file, or delivering normally.  I do have one more question, by which
method / variable would I be able to write the entire message to a text file
including all headers?  I have found in Message.pm something like this:

$this->AppendToMbox($dir);

But, the AppendToMbox function is in Message.pm , I am getting the header
information from $message-{header} , is there a similar $message value that
will get the entire SMTP message?

Thanks for any assistance.

Steve

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Monday, October 25, 2004 2:16 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: MailScanner Text File Creation

Yes.

Custom Functions just need to return what would be the action of a ruleset.
Oh, with one exception, which I really must get around to fixing some time.
For yes/no results, you must return 1 or 0 (yes=1, no=0).

At 18:49 25/10/2004, you wrote:
>Hello:
>
>That is what I am doing now, is writing the two functions.  For the
>'archiving' all I need do , is return what would have been in the action of
>the ruleset, after matching my criteria?  I.e. , if it was archived to a
>location, or to another email address, just return these vaules back to MS
?
>
>Thanks for all assistance.
>
>Steve
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf
>Of Julian Field
>Sent: Monday, October 25, 2004 1:31 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: MailScanner Text File Creation
>
>At 18:21 25/10/2004, you wrote:
> >Hello:
> >
> >I do know perl and am writing the functions, but I am looking now at the
> >Custom Function , the only problem I have, is that the Custom Function
must
> >be called from within the config file, and not from within a ruleset.  If
I
> >use custom functions, the one for the non SPAM actions is easy enough,
but
>I
> >will also need to do all archiving things / criteria from a custom
function
> >as well.  Or is it possible to do a custom action from within a ruleset?
>
>You can't call a custom function from a ruleset, just from a config option.
>
> >   If
> >not, this would be a great future additon to provide the option to run
> >custom actions from within a ruleset, in a similar fashion to the way you
> >have already from within the config file.
>
>It's not trivial to do. Why can't you just make the custom function make
>the same decisions as the ruleset would have made?
>
> >-----Original Message-----
> >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf
> >Of Julian Field
> >Sent: Monday, October 25, 2004 1:08 PM
> >To: MAILSCANNER@JISCMAIL.AC.UK
> >Subject: Re: MailScanner Text File Creation
> >
> >Yes, it can be done. It would need a Custom Function attached to the
> >Archive Mail option, and one attached to the non-spam actions option.
This
> >could ask if the particular header was defined, and produce a different
> >result in this case, compared to the normal response.
> >
> >But you will need some knowledge of perl to be able to write this.
> >
> >At 17:00 25/10/2004, you wrote:
> > >Hello Again:
> > >
> > >In this case, if somehow a Spammer managed to know what our custom
header
> > >was, and placed it into messages, these messages would be processed
> > >normally, (i.e. by the MS SPAM blocking routines, and / or SPAM
Assassin,
> > >anti-virus, etc).  It would, in this case only by-pass our archiving
rule
> > >and also our delete rule.
> > >
> > >In other words, since the message was already processed by MS, if I ran
>it
> > >through Sendmail again, would MS capture it and archive it the second
>time?
> > >
> > >All we are wondering , is if it can be done, and if so, how?
> > >
> > >Thanks for any assistance.
> > >
> > >Steve
> > >
> > >-----Original Message-----
> > >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> >Behalf
> > >Of Julian Field
> > >Sent: Monday, October 25, 2004 11:01 AM
> > >To: MAILSCANNER@JISCMAIL.AC.UK
> > >Subject: Re: MailScanner Text File Creation
> > >
> > >And what happens when a spammer starts sending you mail with that
header
>in
> > >it? You can't trust anything in the headers at all.
> > >
> > >On 25/10/04 3:48 pm, "Stephen Conway" <sconway@WLNET.COM> wrote:
> > > > Hello:
> > > >
> > > > I have managed the following, and have one further issue:
> > > >
> > > > I am now creating the archive, and also am 'deleting' the outgoing
> > >message,.
> > > > I have now a question about MailScanner rules, is there anyway that
MS
> >can
> > > > match on any other criteria, i.e. if a certain header exists in a
> >message,
> > > > then do something?  Example, after my processes analyze the archive
> > >created
> > > > above, I must then re-send the messages to the Internet to the
actual
> > > > recipients, but if I again put them through MS, they will again end
up
> >in
> > > > the archive, and a loop will be started.  I could send them via
>another
> > > > Sendmail process , or via another SMTP host but this involves
running
> > >other
> > > > processes, or server..
> > > >
> > > > After each process above, I put a header field into the messages
> > >'X-FLTMAIL'
> > > > .  What I would like to know is if MS finds this header, then it
>should
> > >not
> > > > archive the message , and also bypass the 'delete' rule .
> > > >
> > > > Any ideas on how this can be done?  In looking at ruleset syntax, it
>is
> > > > always 'from / To or Default' anyway to check for other fields /
> >criteria?
> > > > Maybe through a custom function?
> > > >
> > > > Thanks,
> > > >
> > > > Steve
> > > >
> > > > -----Original Message-----
> > > > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
On
> > >Behalf
> > > > Of Julian Field
> > > > Sent: Saturday, October 23, 2004 12:17 PM
> > > > To: MAILSCANNER@JISCMAIL.AC.UK
> > > > Subject: Re: MailScanner Text File Creation
> > > >
> > > > All you need to do to stop it delivering them is to use a 2-line
>ruleset
> > > > for Non spam actions, spam actions and high scoring spam actions.
> > > > From: domain.com delete
> > > > FromOrTo: default deliver
> > > >
> > > > Then use a ruleset for Archive Mail that says
> > > > From: domain.com yes
> > > > FromOrTo: default no
> > > >
> > > > At 16:31 23/10/2004, you wrote:
> > > >> Good day:
> > > >>
> > > >> The problem with using the archive method, is that the archive only
> > >stores
> > > > a
> > > >> copy there, but the messages are then delivered to their final
> > >recipients.
> > > >> What we need is for any mail from the domain to not be delivered ,
>but
> > > >> instead just copied to the location with the address file being
> > >generated.
> > > >> Which function in customconfig would I need to use?
> > > >>
> > > >> Thanks,
> > > >>
> > > >> Steve
> > > >>
> > > >> -----Original Message-----
> > > >> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
On
> > > > Behalf
> > > >> Of Julian Field
> > > >> Sent: Saturday, October 23, 2004 11:04 AM
> > > >> To: MAILSCANNER@JISCMAIL.AC.UK
> > > >> Subject: Re: MailScanner Text File Creation
> > > >>
> > > >> Take a look in CustomConfig.pm. There are several examples in
there,
> > > >> including a commented-out skeleton of what you need to do. Your
>Custom
> > > >> Function should return 'deliver' for all the messages except the
ones
> >you
> > > >> are interested in, and copy the files where you want them for the
> > > >> domain.com messages. You invoke it by putting
> > > >> Non spam actions = &YourCustomFunctionName
> > > >> in MailScanner.conf.
> > > >>
> > > >> The alternative approach I suggested (involving the mail archive)
may
> >be
> > > >> much easier for you to get working.
> > > >>
> > > >> At 15:49 23/10/2004, you wrote:
> > > >>> Hello Again:
> > > >>>
> > > >>> The custom function sounds like it would work, so I would first
set
> >my:
> > > >>>
> > > >>> Non spam actions = somefile.rules
> > > >>>
> > > >>> In somefile.rules I put the default, to be deliver , and for my
per
> > > > domain
> > > >>> would be:
> > > >>>
> > > >>> From: *@domain.com      ?
> > > >>> FromOrTo:       default deliver
> > > >>>
> > > >>> Please let me know what I would put here, and how to envoke a
custom
> > > >>> function, and if possible what this might look like,
> > > >>>
> > > >>> Thanks,
> > > >>>
> > > >>> Steve
> > > >>>
> > > >>> -----Original Message-----
> > > >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
>On
> > > >> Behalf
> > > >>> Of Julian Field
> > > >>> Sent: Friday, October 15, 2004 12:24 PM
> > > >>> To: MAILSCANNER@JISCMAIL.AC.UK
> > > >>> Subject: Re: MailScanner Text File Creation
> > > >>>
> > > >>> At 17:07 15/10/2004, you wrote:
> > > >>>> Good day:
> > > >>>>
> > > >>>> I had sent previously but missed the reply, if any.
> > > >>>>
> > > >>>> We have an application where we would need to have the following
to
> > > >> occur:
> > > >>>>
> > > >>>>> From *@domain.com ,
> > > >>>> Copy that entire SMTP message to /anypath/MESSAGEREF.inc
> > > >>>> Put a file to /anypath/MESSAGEREF.add which contains each
recipient
> >of
> > > >> the
> > > >>>> message on a separate line.
> > > >>>>
> > > >>>> Also, the message should stop there, i.e. not be sent out, as the
> > > >>> processing
> > > >>>> we have on those messages, will anylize then send those.
> > > >>>>
> > > >>>> Is there any way that MailScanner can be set up to do this?
> > > >>>
> > > >>> You would probably need to write a Custom Function to do this, and
> > > > probably
> > > >>> attach it to the "non-spam actions" configuration option. This
could
> > >test
> > > >>> for the *@domain.com and write out the message in the files you
>want.
> > > >>>
> > > >>> The alternative would be to archive mail using "Archive Mail" and
a
> > > >>> ruleset, then have a cron job that ran every 5 or 10 minutes and
> > > > processed
> > > >>> the archive entries to generate the processed data you want, then
> > >deleted
> > > >>> the original archive files so it didn't process the same mail
twice.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From wagner at MILLER-ENGINEERING.COM  Mon Oct 25 20:16:54 2004
From: wagner at MILLER-ENGINEERING.COM (Joseph Wagner)
Date: Thu Jan 12 21:27:22 2006
Subject: scanning mail over and over
Message-ID: <mailman.3916.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
I ran MailScanner in debug mode and I received no error message.
I also, tried changing file locking from flock to posix and that made no
difference.
It still looks like multiple child processes are picking the messages up.
Oh, and yes I restarted MailScanner after making changes to the config file.





Julian Field wrote:

> Go into debug mode and see what it is saying. Kill all your MailScanner
> processes, set
>         Debug = yes
>         Debug SpamAssassin = yes
> in MailScanner.conf, and run check_mailscanner. I suspect it will
> print an
> error message.
>
> At 18:48 25/10/2004, you wrote:
>
>> I am trying to setup an email server that uses Mailscanner but I'm
>> having a bit of a problem.
>> I am using:
>> Postfix 2.0.18
>> ClamAV v0.80
>> Mailscanner v4.34.8
>> it's running on Trustix 2.1
>>
>> For the most part the system seems to be working.  I sent test infected
>> messages to it and it caught most of them.
>> But, mailscanner has been scanning some of the same messages over and
>> over again without any action being taken.
>> Here is a snippet from  /var/log/mail/info
>>
>> Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:30 moon MailScanner[30094]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:30 moon MailScanner[30061]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:31 moon MailScanner[30094]: Using locktype = flock
>> Oct 25 08:27:33 moon MailScanner[30061]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:33 moon MailScanner[30061]: Other Checks: Found 1 problems
>> Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:40 moon MailScanner[30094]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:40 moon MailScanner[30134]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:41 moon MailScanner[30134]: Using locktype = flock
>> Oct 25 08:27:43 moon MailScanner[30094]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:43 moon MailScanner[30094]: Other Checks: Found 1 problems
>> Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:50 moon MailScanner[30134]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:50 moon MailScanner[30166]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:51 moon MailScanner[30166]: Using locktype = flock
>> Oct 25 08:27:53 moon MailScanner[30134]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:53 moon MailScanner[30134]: Other Checks: Found 1 problems
>> Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:28:00 moon MailScanner[30201]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:28:00 moon MailScanner[30166]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:28:01 moon MailScanner[30201]: Using locktype = flock
>> Oct 25 08:28:03 moon MailScanner[30166]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:28:03 moon MailScanner[30166]: Other Checks: Found 1 problems
>>
>> Any clues? Does anyone have any tips for running Mailscanner on
>> Trustix 2.1?
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From wagner at MILLER-ENGINEERING.COM  Mon Oct 25 21:36:51 2004
From: wagner at MILLER-ENGINEERING.COM (Joseph Wagner)
Date: Thu Jan 12 21:27:22 2006
Subject: scanning mail over and over
Message-ID: <mailman.3917.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Okay, for whatever reason the debugging didn't turn on the first time.
Now, that debugging is working, I get this error when running
check_MailScanner

ack! no binary decoder! at /usr/lib/perl5/site_perl/5.8.3/MIME/Entity.pm
line 1851

So far I tried upgrading MIME::Tools through CPAN but that didn't take
care of the problem.  Any ideas?





Julian Field wrote:

> Go into debug mode and see what it is saying. Kill all your MailScanner
> processes, set
>         Debug = yes
>         Debug SpamAssassin = yes
> in MailScanner.conf, and run check_mailscanner. I suspect it will
> print an
> error message.
>
> At 18:48 25/10/2004, you wrote:
>
>> I am trying to setup an email server that uses Mailscanner but I'm
>> having a bit of a problem.
>> I am using:
>> Postfix 2.0.18
>> ClamAV v0.80
>> Mailscanner v4.34.8
>> it's running on Trustix 2.1
>>
>> For the most part the system seems to be working.  I sent test infected
>> messages to it and it caught most of them.
>> But, mailscanner has been scanning some of the same messages over and
>> over again without any action being taken.
>> Here is a snippet from  /var/log/mail/info
>>
>> Oct 25 08:27:26 moon MailScanner[30061]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:30 moon MailScanner[30094]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:30 moon MailScanner[30061]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:31 moon MailScanner[30094]: Using locktype = flock
>> Oct 25 08:27:33 moon MailScanner[30061]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:33 moon MailScanner[30061]: Other Checks: Found 1 problems
>> Oct 25 08:27:36 moon MailScanner[30094]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:40 moon MailScanner[30094]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:40 moon MailScanner[30134]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:41 moon MailScanner[30134]: Using locktype = flock
>> Oct 25 08:27:43 moon MailScanner[30094]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:43 moon MailScanner[30094]: Other Checks: Found 1 problems
>> Oct 25 08:27:46 moon MailScanner[30134]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:27:50 moon MailScanner[30134]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:27:50 moon MailScanner[30166]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:27:51 moon MailScanner[30166]: Using locktype = flock
>> Oct 25 08:27:53 moon MailScanner[30134]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:27:53 moon MailScanner[30134]: Other Checks: Found 1 problems
>> Oct 25 08:27:56 moon MailScanner[30166]: New Batch: Scanning 14
>> messages, 44308 bytes
>> Oct 25 08:28:00 moon MailScanner[30201]: MailScanner E-Mail Virus
>> Scanner version 4.34.8 starting...
>> Oct 25 08:28:00 moon MailScanner[30166]: Virus and Content Scanning:
>> Starting
>> Oct 25 08:28:01 moon MailScanner[30201]: Using locktype = flock
>> Oct 25 08:28:03 moon MailScanner[30166]: Filename Checks: Windows/DOS
>> Executable (25940108FBB eicar.com)
>> Oct 25 08:28:03 moon MailScanner[30166]: Other Checks: Found 1 problems
>>
>> Any clues? Does anyone have any tips for running Mailscanner on
>> Trustix 2.1?
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From sevans at FOUNDATION.SDSU.EDU  Tue Oct 26 05:23:20 2004
From: sevans at FOUNDATION.SDSU.EDU (Steve Evans)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3918.1137101242.24926.mailscanner@lists.mailscanner.info>

On the legality of e-mail disclaimers - http://slate.msn.com/id/2101561/


Steve Evans
SDSU Foundation

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Matt Kettler
Sent: Monday, October 25, 2004 5:32 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Disclaimer Attachment- ONLY ONCE

At 07:33 PM 10/25/2004, Venkata Achanta wrote:
>Sorry may be i have to change the subject line to attract ppl to read 
>my message. I apologize if this is an incovenience for some of you.

no inconvenience, but I don't see how this would be possible with
MailScanner.

MailScanner's "sign clean messages" feature is intended to have an
notice that a message was virus scanned, not a legal disclaimer.
Although many
(use|abuse) it for this purpose.

In the context of it's real purpose, it makes no sense for MS to "only
add it once", as the virus scan would have to apply to each message
separately, so should the signature stating there was a scan.

To change it, Julian would have to add a bit of code to look for the
signature (possibly with added line-wraps and >'s added) before
inserting it.

Quite frankly, I hope Julian doesn't add a "only once" feature, in the
interest of encouraging people to not use MS for the purpose of adding
legalese spam to all of their email.

(Just as I wish he'd remove the bounce mis-feature, but he's at least
decided to put a few hoops in before you can enable this dangerous
feature, and I'm thankful for that much.)


> >if someone sends out a e-mail and get a repsonse and if he responds 
> >again the disclaimer is getting attached again.if this happens X 
> >number of times we end up having disclaimer attached X number of time

> >as well which looks ugly(better than spam though :-)) )

Quite frankly, I feel that bulk-disclaimer-attachers are *worse* than
spammers.

They aren't even selling anything, they're just inserting garbage in
email to cover their hind ends in the event of a  misdirected email by a
careless employees. And quite frankly, I seriously question if the 'this
message may be legally privileged' disclaimers even offer much, if any,
useful legal protection. So not only are they selling nothing, they are
also saying nothing of value, just wasting space on the world's disk
drives to keep some high-level manager happy. Wonderful.

For that matter, re-posters who cannot even wait 6 hours before
reposting the same message with a different subject might be better
suited by exercising a little patience.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Tue Oct 26 05:34:55 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:22 2006
Subject: update_virus_scanners
Message-ID: <mailman.3919.1137101242.24926.mailscanner@lists.mailscanner.info>

OK .. I have managed to confuse the hell out of myself and really could use
someone to put me out of my misery. I have just updated one of my servers to
Mail::ClamAV 0.12 and MailScanner 4.35.5. After a bit of fiddling that went
OK. However, while I was doing that, I decided to again tackle the
update_virus_scanners issue I have been having in that I keep getting an
error like the following when I run or cron runs update_virus_scanners:

Oct 26 00:00:21 ebony update.virus.scanners: Found clamav installed
Oct 26 00:00:21 ebony update.virus.scanners: Running autoupdate for clamav
Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV updater failed

However, if I run freshclam -v I get:

Current working dir is /usr/local/share/clamav
Max retries == 3
ClamAV update process started at Tue Oct 26 00:01:13 2004
Connected to database.clamav.net (65.110.48.11).
Reading CVD header (main.cvd): OK
main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
tomek)
Connected to database.clamav.net (65.110.48.11).
Reading CVD header (daily.cvd): OK
daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
trog)
Freeing option list...done

Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:

Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV did not need updating

in my maillog. Also, in clamav-autoupdate, I have changed the log directory
to /var/log/clamav/ClamAV.update.log and in there I get:

ClamAV update process started at Tue Oct 26 00:03:28 2004
main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
tomek)
daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
trog)

So, apparently /etc/cron.hourly/update_virus_scanners if not working and
also apparently, I am too dull to figure out why.

Can someone PLEASE help me out and tell me what they think is going on here?
I know it is probably stupid of me but sometimes you just gotta throw your
hands in the air and yell for help.

Dave

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From ree at THUNDERSTAR.NET  Tue Oct 26 05:46:34 2004
From: ree at THUNDERSTAR.NET (Ron E.)
Date: Thu Jan 12 21:27:22 2006
Subject: Additional blank line inserted into header, Postfix 2.0.18-4
Message-ID: <mailman.3920.1137101242.24926.mailscanner@lists.mailscanner.info>

        I'm running postfix, MailScanner 4.35.5-1 and SA 3.0.1, but this
same problem was occasionally happening with MailScanner 4.33.3-1 and SA
3.0.0.

        What happens is occasionally messages will have a blank line
inserted just before the X-orgname-MailScanner-Information -- I checked a
bit more thoroughly and found that that line has one space in it just
before EOL.

        Does anyone have any idea why this is happening? I searched the
archives and found only one other mention of this but occurring with
Sendmail.

        I also checked briefly through the postfix mailing list but didn't
find much.

        Hopefully someone has an idea how I can track this down. It's
rather annoying as the occasional message will then not be correctly
handled after MailScanner is done with it due to the header that appears
to end before the spamassassin scoring stuff.

        Thanks in advance.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hden at KCBBS.GEN.NZ  Tue Oct 26 06:03:27 2004
From: hden at KCBBS.GEN.NZ (Hendrik den Hartog)
Date: Thu Jan 12 21:27:22 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3921.1137101242.24926.mailscanner@lists.mailscanner.info>

On Mon, Oct 25, 2004 at 06:44:20PM -0400, Steve Swaney wrote:

> I've been able to fix this problem on our test boxes. Note that these
> instructions are ONLY applicable to Redhat 3.0 (and probably) all Red Hat
> "clone" operating systems. I've tested on Red Hat, WhiteBox and Tao Linux
> systems. If your using a different operating system the steps will probably
> be similar but the commands may differ.
>
> Thanks to Steve Freegard for the location of the rpms:
>
> To implement this fix:[instructions snipped]

 Thanks! Were using CentOS-3, the process went smoothly.

 Appreciate the heads up, and fix instructions.

Cheers!
Hendrik

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From davidj at synaq.com  Tue Oct 26 07:49:33 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:22 2006
Subject: update_virus_scanners
Message-ID: <mailman.3922.1137101242.24926.mailscanner@lists.mailscanner.info>

Hi,

Perhaps try appending -x to the end of the #!/bin/bash line
in /usr/sbin/update_virus_scanners and look for any glaring
errors.

On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> OK .. I have managed to confuse the hell out of myself and really could use
> someone to put me out of my misery. I have just updated one of my servers to
> Mail::ClamAV 0.12 and MailScanner 4.35.5. After a bit of fiddling that went
> OK. However, while I was doing that, I decided to again tackle the
> update_virus_scanners issue I have been having in that I keep getting an
> error like the following when I run or cron runs update_virus_scanners:
> 
> Oct 26 00:00:21 ebony update.virus.scanners: Found clamav installed
> Oct 26 00:00:21 ebony update.virus.scanners: Running autoupdate for clamav
> Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV updater failed
> 
> However, if I run freshclam -v I get:
> 
> Current working dir is /usr/local/share/clamav
> Max retries == 3
> ClamAV update process started at Tue Oct 26 00:01:13 2004
> Connected to database.clamav.net (65.110.48.11).
> Reading CVD header (main.cvd): OK
> main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> tomek)
> Connected to database.clamav.net (65.110.48.11).
> Reading CVD header (daily.cvd): OK
> daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> trog)
> Freeing option list...done
> 
> Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> 
> Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV did not need updating
> 
> in my maillog. Also, in clamav-autoupdate, I have changed the log directory
> to /var/log/clamav/ClamAV.update.log and in there I get:
> 
> ClamAV update process started at Tue Oct 26 00:03:28 2004
> main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> tomek)
> daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> trog)
> 
> So, apparently /etc/cron.hourly/update_virus_scanners if not working and
> also apparently, I am too dull to figure out why.
> 
> Can someone PLEASE help me out and tell me what they think is going on here?
> I know it is probably stupid of me but sometimes you just gotta throw your
> hands in the air and yell for help.
> 
> Dave
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From Steve.Swaney at FSL.COM  Mon Oct 25 23:44:20 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:22 2006
Subject: Problem installing SpamAssassin 3.0.1
Message-ID: <mailman.3923.1137101242.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steve Freegard
> Sent: Monday, October 25, 2004 5:16 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Problem installing SpamAssassin 3.0.1
>
> Hi Hendrik,
>
> Hendrik den Hartog wrote:
> > I'm currently tring to install spamassassin 3.0.1. All proceeds fine
> until
> > make test, where it hangs on this test..
> >
> >  t/bayesdbm..................ok 37/44
> >
> > How, what etc do I need to do to sort this?
> >
> > Any/all advice appreciated,
> > Cheers!
> > Hendrik
> >
>
> See http://wiki.apache.org/spamassassin/DbFileSleepBug - and see if this
>   is affecting you.
>
> Kind regards,
> Steve.
>
Form the link Steve refers to above:

"As discussed in http://bugzilla.spamassassin.org/show_bug.cgi?id=3048 ,
libdb version 4.1.25, at least, seems to have a bug that will cause it to
sleep for 1 second under heavy load.

Upgrading to libdb 4.2.52 seemed to make this delay go away."

I've been able to fix this problem on our test boxes. Note that these
instructions are ONLY applicable to Redhat 3.0 (and probably) all Red Hat
"clone" operating systems. I've tested on Red Hat, WhiteBox and Tao Linux
systems. If your using a different operating system the steps will probably
be similar but the commands may differ.

Thanks to Steve Freegard for the location of the rpms:

To implement this fix:

From:
        http://projects.standblue.net/rpms/subversion/1.0.2/rhes3.0/db4/

Download:

        db4-4.2.52-2.i386.
        db4-devel-4.2.52-2.i386

And optionally (if you need it):

        db4-utils-4.2.52-2.i386

Then:

Find the installed db4 rpms

        rpm -qa | grep db4

if db4-utils-4.1.25-8 or db4-devel-4.1.25-8 or any db4-util-e.1* or
db4-devel-4.1.*, remove these rpms!

        rpm -e  db4-devel
        rpm -e  db4-utils

Then install db4-4.2.52-2.i386.rpm and db4-devel-4.2.52-2.i386.rpm
alongside of db4-4.1.25-8

In directory containing db4-4.2.52-2.i386.rpm and
db4-devel-4.2.52-2.i386.rpm reside

        rpm -ivh db4*

Rebuild DB_file against the new db4-devel libraries

        perl -MCPAN -e shell
        cpan> force install DB_File

---------------

These steps have worked or me on all of the systems I have fixed but beware,
your mileage may vary :(

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vachanta at GMAIL.COM  Tue Oct 26 00:33:38 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3924.1137101242.24926.mailscanner@lists.mailscanner.info>

Sorry may be i have to change the subject line to attract ppl to read my
message. I apologize if this is an incovenience for some of you.

Please reply.
Thanks

On Mon, 25 Oct 2004 19:32:47 +0100, Venkata Achanta <vachanta@GMAIL.COM>
wrote:

>Hello,
>
>     we are attaching a disclaimer to every out-going e-mail through the
>mailscanner using the inline.sig.txt and inline.sig.html,its working great
>
>if someone sends out a e-mail and get a repsonse and if he responds again
>the disclaimer is getting attached again.if this happens X number of times
>we end up having disclaimer attached X number of time as well which looks
>ugly(better than spam though :-)) )
>
>But i am curious to know if someone on this list is able to strip that
>disclaimers that many times and have only one disclaimer attached
>regardless of how many times we replied to the message.
>
>Thanks in advance for all the informative replies,
>
>Venkata Achanta
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mkettler at EVI-INC.COM  Tue Oct 26 01:32:06 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3925.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
At 07:33 PM 10/25/2004, Venkata Achanta wrote:
>Sorry may be i have to change the subject line to attract ppl to read my
>message. I apologize if this is an incovenience for some of you.

no inconvenience, but I don't see how this would be possible with MailScanner.

MailScanner's "sign clean messages" feature is intended to have an notice
that a message was virus scanned, not a legal disclaimer. Although many
(use|abuse) it for this purpose.

In the context of it's real purpose, it makes no sense for MS to "only add
it once", as the virus scan would have to apply to each message separately,
so should the signature stating there was a scan.

To change it, Julian would have to add a bit of code to look for the
signature (possibly with added line-wraps and >'s added) before inserting it.

Quite frankly, I hope Julian doesn't add a "only once" feature, in the
interest of encouraging people to not use MS for the purpose of adding
legalese spam to all of their email.

(Just as I wish he'd remove the bounce mis-feature, but he's at least
decided to put a few hoops in before you can enable this dangerous feature,
and I'm thankful for that much.)


> >if someone sends out a e-mail and get a repsonse and if he responds again
> >the disclaimer is getting attached again.if this happens X number of times
> >we end up having disclaimer attached X number of time as well which looks
> >ugly(better than spam though :-)) )

Quite frankly, I feel that bulk-disclaimer-attachers are *worse* than
spammers.

They aren't even selling anything, they're just inserting garbage in email
to cover their hind ends in the event of a  misdirected email by a careless
employees. And quite frankly, I seriously question if the 'this message may
be legally privileged' disclaimers even offer much, if any, useful legal
protection. So not only are they selling nothing, they are also saying
nothing of value, just wasting space on the world's disk drives to keep
some high-level manager happy. Wonderful.

For that matter, re-posters who cannot even wait 6 hours before reposting
the same message with a different subject might be better suited by
exercising a little patience.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From marco at XSSNET.COM  Tue Oct 26 02:01:02 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3926.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
to play devil's advocate...

alot of companies use the <...barf...> disclaimers and MailScanner has
an easy way to add it, although not what inteded for.  not every company
has gurus and pointy-haired managers want certain things even tho they
dont make sense.  but is it right to *not* add that feature because of
l-users?

i once wrote a Sendmail milter to add a disclaimer, before i found
MailScanner, and all i decided to do was append the disclaimer if it
wasnt a reply or forward.  pretty easy.  i'm sure if the poster wrote a
rule regex on the subject he can avoid the disclaimer being added so
many times.

BOFH excuse #361: The cause of the problem is: Plasma conduit breach




Matt Kettler wrote:

> At 07:33 PM 10/25/2004, Venkata Achanta wrote:
>
>> Sorry may be i have to change the subject line to attract ppl to read my
>> message. I apologize if this is an incovenience for some of you.
>
>
> no inconvenience, but I don't see how this would be possible with
> MailScanner.
>
> MailScanner's "sign clean messages" feature is intended to have an notice
> that a message was virus scanned, not a legal disclaimer. Although many
> (use|abuse) it for this purpose.
>
> In the context of it's real purpose, it makes no sense for MS to "only
> add
> it once", as the virus scan would have to apply to each message
> separately,
> so should the signature stating there was a scan.
>
> To change it, Julian would have to add a bit of code to look for the
> signature (possibly with added line-wraps and >'s added) before
> inserting it.
>
> Quite frankly, I hope Julian doesn't add a "only once" feature, in the
> interest of encouraging people to not use MS for the purpose of adding
> legalese spam to all of their email.
>
> (Just as I wish he'd remove the bounce mis-feature, but he's at least
> decided to put a few hoops in before you can enable this dangerous
> feature,
> and I'm thankful for that much.)
>
>
>> >if someone sends out a e-mail and get a repsonse and if he responds
>> again
>> >the disclaimer is getting attached again.if this happens X number of
>> times
>> >we end up having disclaimer attached X number of time as well which
>> looks
>> >ugly(better than spam though :-)) )
>
>
> Quite frankly, I feel that bulk-disclaimer-attachers are *worse* than
> spammers.
>
> They aren't even selling anything, they're just inserting garbage in
> email
> to cover their hind ends in the event of a  misdirected email by a
> careless
> employees. And quite frankly, I seriously question if the 'this
> message may
> be legally privileged' disclaimers even offer much, if any, useful legal
> protection. So not only are they selling nothing, they are also saying
> nothing of value, just wasting space on the world's disk drives to keep
> some high-level manager happy. Wonderful.
>
> For that matter, re-posters who cannot even wait 6 hours before reposting
> the same message with a different subject might be better suited by
> exercising a little patience.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From SJCJonker at SJC.NL  Tue Oct 26 09:17:14 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3927.1137101242.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello all,

Once the MailScanner systems where upgraded to MailScanner 4.34.8 with
SpamAssassin 3.0 there where quite some spam email slipping through, so
some investigation was performed to the cause.

I upgraded to SpamAssassin 3.01 due to the URIBL checks where set to
head instead of body.

I inserted:
loadplugin Mail::SpamAssassin::Plugin::URIDNSBL and
loadplugin Mail::SpamAssassin::Plugin::SPF
first in /etc/mail/spamassassin/local.cf then moved it to:
/etc/MailScanner/spam.assassin.prefs.conf

But whatever I do i don't see any hits on the rules with URIBL/SURBL and
or SPF. Although I couldn't find it back in the list I believe i need
the latest beta for SPF support, but URIBL should work.

I check some of the spam only minutes after they where received on
http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
listed in one or more lists.

The only rule scoring I modified in local.cf is:
score ALL_TRUSTED 0

Is there somebody who can offer some adivce on how to troubleshoot
and/or find the culprit for this?

P.S. MailScanner -v output is in the attachment.

Thanks in advance.

--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

Running on
Linux <> 2.6.8-1.521smp #1 SMP Mon Aug 16 09:25:06 EDT 2004 i686 i686 i386 GNU/Linux
This is Fedora Core release 2 (Tettnang)
This is Perl version 5.008003 (5.8.3)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.01    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.122   IO::Pipe
3.03    MIME::Base64
5.413   MIME::Decoder
5.413   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.07    POSIX
1.76    Socket
0.04    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.808   DB_File
1.05    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.11    Mail::ClamAV
3.000001        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
0.32    Net::LDAP
1.94    Parse::RecDescent
0.15    SAVI
1.2     Sys::Hostname::Long
2.42    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.34    URI

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
From mailscanner at ecs.soton.ac.uk  Tue Oct 26 09:12:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3928.1137101242.24926.mailscanner@lists.mailscanner.info>

I think this is the best solution so far. A little Custom Function that
looked at the Subject: to decide whether to add the sig or not should only
be about 5 lines of code at most.

On 26/10/04 2:01 am, "Marco Benton" <marco@XSSNET.COM> wrote:
> to play devil's advocate...
>
> alot of companies use the <...barf...> disclaimers and MailScanner has
> an easy way to add it, although not what inteded for.  not every company
> has gurus and pointy-haired managers want certain things even tho they
> dont make sense.  but is it right to *not* add that feature because of
> l-users?
>
> i once wrote a Sendmail milter to add a disclaimer, before i found
> MailScanner, and all i decided to do was append the disclaimer if it
> wasnt a reply or forward.  pretty easy.  i'm sure if the poster wrote a
> rule regex on the subject he can avoid the disclaimer being added so
> many times.
>
> BOFH excuse #361: The cause of the problem is: Plasma conduit breach
>
>
>
>
> Matt Kettler wrote:
>
>> At 07:33 PM 10/25/2004, Venkata Achanta wrote:
>>
>>> Sorry may be i have to change the subject line to attract ppl to read my
>>> message. I apologize if this is an incovenience for some of you.
>>
>>
>> no inconvenience, but I don't see how this would be possible with
>> MailScanner.
>>
>> MailScanner's "sign clean messages" feature is intended to have an notice
>> that a message was virus scanned, not a legal disclaimer. Although many
>> (use|abuse) it for this purpose.
>>
>> In the context of it's real purpose, it makes no sense for MS to "only
>> add
>> it once", as the virus scan would have to apply to each message
>> separately,
>> so should the signature stating there was a scan.
>>
>> To change it, Julian would have to add a bit of code to look for the
>> signature (possibly with added line-wraps and >'s added) before
>> inserting it.
>>
>> Quite frankly, I hope Julian doesn't add a "only once" feature, in the
>> interest of encouraging people to not use MS for the purpose of adding
>> legalese spam to all of their email.
>>
>> (Just as I wish he'd remove the bounce mis-feature, but he's at least
>> decided to put a few hoops in before you can enable this dangerous
>> feature,
>> and I'm thankful for that much.)
>>
>>
>>>> if someone sends out a e-mail and get a repsonse and if he responds
>>> again
>>>> the disclaimer is getting attached again.if this happens X number of
>>> times
>>>> we end up having disclaimer attached X number of time as well which
>>> looks
>>>> ugly(better than spam though :-)) )
>>
>>
>> Quite frankly, I feel that bulk-disclaimer-attachers are *worse* than
>> spammers.
>>
>> They aren't even selling anything, they're just inserting garbage in
>> email
>> to cover their hind ends in the event of a  misdirected email by a
>> careless
>> employees. And quite frankly, I seriously question if the 'this
>> message may
>> be legally privileged' disclaimers even offer much, if any, useful legal
>> protection. So not only are they selling nothing, they are also saying
>> nothing of value, just wasting space on the world's disk drives to keep
>> some high-level manager happy. Wonderful.
>>
>> For that matter, re-posters who cannot even wait 6 hours before reposting
>> the same message with a different subject might be better suited by
>> exercising a little patience.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 26 09:15:15 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Additional blank line inserted into header, Postfix 2.0.18-4
Message-ID: <mailman.3929.1137101242.24926.mailscanner@lists.mailscanner.info>

Header names are not allowed to have spaces in them. If you add a header (or
someone else adds a header) whose name contains a space, then you (or they)
are breaking an important bit of RFC822 (or 2822) and all sorts of nasty
things will happen.

On 26/10/04 5:46 am, "Ron E." <ree@THUNDERSTAR.NET> wrote:
>         I'm running postfix, MailScanner 4.35.5-1 and SA 3.0.1, but this
> same problem was occasionally happening with MailScanner 4.33.3-1 and SA
> 3.0.0.
>
>         What happens is occasionally messages will have a blank line
> inserted just before the X-orgname-MailScanner-Information -- I checked a
> bit more thoroughly and found that that line has one space in it just
> before EOL.
>
>         Does anyone have any idea why this is happening? I searched the
> archives and found only one other mention of this but occurring with
> Sendmail.
>
>         I also checked briefly through the postfix mailing list but didn't
> find much.
>
>         Hopefully someone has an idea how I can track this down. It's
> rather annoying as the occasional message will then not be correctly
> handled after MailScanner is done with it due to the header that appears
> to end before the spamassassin scoring stuff.

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From vlado at AGENDA.SI  Tue Oct 26 09:22:39 2004
From: vlado at AGENDA.SI (Vladimir Nikolic)
Date: Thu Jan 12 21:27:22 2006
Subject: mailscanner strange problem
Message-ID: <mailman.3930.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi!

After upgrade to 4.34.8 (from 4.21.9) mailscanner doesn't work right.
Trouble is that mailscanner child processes are creating their own child
processes which then run without control and by the time take all
resources.
I've tried wiht downgrade to 4.21.9 but it didn't help. Mailscanner acts
  the same.

Regards,
Vlado

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From raymond at PROLOCATION.NET  Tue Oct 26 09:23:38 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:22 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3931.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hi Stijn,

> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL and
> loadplugin Mail::SpamAssassin::Plugin::SPF
> first in /etc/mail/spamassassin/local.cf then moved it to:
> /etc/MailScanner/spam.assassin.prefs.conf
>
> But whatever I do i don't see any hits on the rules with URIBL/SURBL and
> or SPF. Although I couldn't find it back in the list I believe i need
> the latest beta for SPF support, but URIBL should work.
>
> I check some of the spam only minutes after they where received on
> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
> listed in one or more lists.
>
> The only rule scoring I modified in local.cf is:
> score ALL_TRUSTED 0

What does a SA --lint tell you ?

> Is there somebody who can offer some adivce on how to troubleshoot
> and/or find the culprit for this?

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Tue Oct 26 10:01:06 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3932.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Julian

I'd stay with Matt and others on this. besides the <not tested in court
legal disclaimer.h> issues it is nice double check that the outbound
email has been scanned by MS as you say of its original intention.

Also note that alot of the traffic on this list has the list unsubscribe
footer attached multiple times, esp when people top post (like me;-). So
ths problem isn't necessarilty the technology, but the use of it (people
don't trim the footers...).



--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> I think this is the best solution so far. A little Custom Function that
> looked at the Subject: to decide whether to add the sig or not should only
> be about 5 lines of code at most.
>
> On 26/10/04 2:01 am, "Marco Benton" <marco@XSSNET.COM> wrote:
>
>>to play devil's advocate...
>>
>>alot of companies use the <...barf...> disclaimers and MailScanner has
>>an easy way to add it, although not what inteded for.  not every company
>>has gurus and pointy-haired managers want certain things even tho they
>>dont make sense.  but is it right to *not* add that feature because of
>>l-users?
>>
>>i once wrote a Sendmail milter to add a disclaimer, before i found
>>MailScanner, and all i decided to do was append the disclaimer if it
>>wasnt a reply or forward.  pretty easy.  i'm sure if the poster wrote a
>>rule regex on the subject he can avoid the disclaimer being added so
>>many times.
>>
>>BOFH excuse #361: The cause of the problem is: Plasma conduit breach
>>
>>
>>
>>
>>Matt Kettler wrote:
>>
>>
>>>At 07:33 PM 10/25/2004, Venkata Achanta wrote:
>>>
>>>
>>>>Sorry may be i have to change the subject line to attract ppl to read my
>>>>message. I apologize if this is an incovenience for some of you.
>>>
>>>
>>>no inconvenience, but I don't see how this would be possible with
>>>MailScanner.
>>>
>>>MailScanner's "sign clean messages" feature is intended to have an notice
>>>that a message was virus scanned, not a legal disclaimer. Although many
>>>(use|abuse) it for this purpose.
>>>
>>>In the context of it's real purpose, it makes no sense for MS to "only
>>>add
>>>it once", as the virus scan would have to apply to each message
>>>separately,
>>>so should the signature stating there was a scan.
>>>
>>>To change it, Julian would have to add a bit of code to look for the
>>>signature (possibly with added line-wraps and >'s added) before
>>>inserting it.
>>>
>>>Quite frankly, I hope Julian doesn't add a "only once" feature, in the
>>>interest of encouraging people to not use MS for the purpose of adding
>>>legalese spam to all of their email.
>>>
>>>(Just as I wish he'd remove the bounce mis-feature, but he's at least
>>>decided to put a few hoops in before you can enable this dangerous
>>>feature,
>>>and I'm thankful for that much.)
>>>
>>>
>>>
>>>>>if someone sends out a e-mail and get a repsonse and if he responds
>>>>
>>>>again
>>>>
>>>>>the disclaimer is getting attached again.if this happens X number of
>>>>
>>>>times
>>>>
>>>>>we end up having disclaimer attached X number of time as well which
>>>>
>>>>looks
>>>>
>>>>>ugly(better than spam though :-)) )
>>>
>>>
>>>Quite frankly, I feel that bulk-disclaimer-attachers are *worse* than
>>>spammers.
>>>
>>>They aren't even selling anything, they're just inserting garbage in
>>>email
>>>to cover their hind ends in the event of a  misdirected email by a
>>>careless
>>>employees. And quite frankly, I seriously question if the 'this
>>>message may
>>>be legally privileged' disclaimers even offer much, if any, useful legal
>>>protection. So not only are they selling nothing, they are also saying
>>>nothing of value, just wasting space on the world's disk drives to keep
>>>some high-level manager happy. Wonderful.
>>>
>>>For that matter, re-posters who cannot even wait 6 hours before reposting
>>>the same message with a different subject might be better suited by
>>>exercising a little patience.

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From martinh at SOLID-STATE-LOGIC.COM  Tue Oct 26 10:04:42 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:22 2006
Subject: mailscanner strange problem
Message-ID: <mailman.3933.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Vladimir

quite a jump...

anyway what O/S. MTA etc.

what does mailscanner -v give you, so we can check the versions of perl
modules.

Are you using SA? If you are what version?

Are you using any anti-virus, if so which on and wnat version.

Have you tried putting MS into debug mode and running check mailscanner
to see if you can spot where it's doing odd things?

have you looked in the log files to see if there's anything
'interesting' there?


--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Vladimir Nikolic wrote:
> Hi!
>
> After upgrade to 4.34.8 (from 4.21.9) mailscanner doesn't work right.
> Trouble is that mailscanner child processes are creating their own child
> processes which then run without control and by the time take all
> resources.
> I've tried wiht downgrade to 4.21.9 but it didn't help. Mailscanner acts
>  the same.
>
> Regards,
> Vlado
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>

From ree at THUNDERSTAR.NET  Tue Oct 26 12:12:27 2004
From: ree at THUNDERSTAR.NET (Ron E.)
Date: Thu Jan 12 21:27:22 2006
Subject: Additional blank line inserted into header, Postfix 2.0.18-4
Message-ID: <mailman.3934.1137101242.24926.mailscanner@lists.mailscanner.info>

Dear Julian,

        Yes, definitely agreed!

        Perhaps this is done intentionally... this is always spam that has
this extra "header" consisting of one space. If this is of interest, I can
post a sample of one of these.

        Due to the way that I handle email that is deteted as spam on this
particular server, such messages are not routed correctly and they make it
to users when normally they are blocked.

        Is there any way to configure MailScanner to quarantine such
items?

Regards,

Ron

On Tue, 26 Oct 2004, Julian Field wrote:

> Header names are not allowed to have spaces in them. If you add a header (or
> someone else adds a header) whose name contains a space, then you (or they)
> are breaking an important bit of RFC822 (or 2822) and all sorts of nasty
> things will happen.
>
> On 26/10/04 5:46 am, "Ron E." <ree@THUNDERSTAR.NET> wrote:
> >         I'm running postfix, MailScanner 4.35.5-1 and SA 3.0.1, but this
> > same problem was occasionally happening with MailScanner 4.33.3-1 and SA
> > 3.0.0.
> >
> >         What happens is occasionally messages will have a blank line
> > inserted just before the X-orgname-MailScanner-Information -- I checked a
> > bit more thoroughly and found that that line has one space in it just
> > before EOL.
> >
> >         Does anyone have any idea why this is happening? I searched the
> > archives and found only one other mention of this but occurring with
> > Sendmail.
> >
> >         I also checked briefly through the postfix mailing list but didn't
> > find much.
> >
> >         Hopefully someone has an idea how I can track this down. It's
> > rather annoying as the occasional message will then not be correctly
> > handled after MailScanner is done with it due to the header that appears
> > to end before the spamassassin scoring stuff.
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From david.hooton at gmail.com  Tue Oct 26 12:34:03 2004
From: david.hooton at gmail.com (David Hooton)
Date: Thu Jan 12 21:27:22 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3935.1137101242.24926.mailscanner@lists.mailscanner.info>

There are quite a lot of legitimate reasons for footers to be added to
all in/outbound mail.  There is also a very valid reason why you would
only want the footer once.

I definately vote for the option of only append once if it's at all
possible.  I know Julian has previously said it was
hard/difficult/impossible but it really would help make MS footers
much more slick.
--
Regards,

David Hooton

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From gercke at HNM.DE  Tue Oct 26 12:41:05 2004
From: gercke at HNM.DE (Daniel Gercke)
Date: Thu Jan 12 21:27:22 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.3936.1137101242.24926.mailscanner@lists.mailscanner.info>

<x-flowed>
Hello all,

i want to update from 4.28.5-2 to the current stable release. Are there 
any hints that i musst know to update without runnings into Problems?
I´m using PRM Version.

-- 

Daniel Gercke

programmierung . system managements


--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
.
-- 
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

</x-flowed>

From dfilchak at sympatico.ca  Tue Oct 26 14:10:08 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:22 2006
Subject: update_virus_scanners
Message-ID: <mailman.3937.1137101242.24926.mailscanner@lists.mailscanner.info>

Thanks for your reply. Tried what you suggested and really cannot see
anything weird. It finds ClamAV installed and finds generic installed but
nothing else, which is normal.

+ SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
+ LOCKFILE=/tmp/MailScanner.autoupdate.lock
++ perl -e 'print "young" if -f "/tmp/MailScanner.autoupdate.lock" && -M
"/tmp/MailScanner.autoupdate.lock"<0.042'
+ '[' x = xyoung ']'
+ trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT
+ touch /tmp/MailScanner.autoupdate.lock
+ umask 022
++ uname
+ OS=Linux
+ '[' Linux = SunOS ']'
+ GREP=grep
+ cat /etc/MailScanner/virus.scanners.conf
+ sed -e 's/#.*$//'
+ grep -e -wrapper

<SNIP>

+ read NAME WRAPPER PACKAGEDIR
++ echo /usr/lib/MailScanner/clamav-wrapper
++ sed -e 's/-wrapper$/-autoupdate/'
+ UPDATER=/usr/lib/MailScanner/clamav-autoupdate
+ '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper -a -n /usr ']'
+ /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled
+ logger -p mail.info -t update.virus.scanners Found clamav installed
+ '[' -x /usr/lib/MailScanner/clamav-autoupdate ']'
+ logger -p mail.info -t update.virus.scanners Running autoupdate for clamav
+ /usr/lib/MailScanner/clamav-autoupdate /usr

<SNIP>

+ read NAME WRAPPER PACKAGEDIR
++ echo /usr/lib/MailScanner/generic-wrapper
++ sed -e 's/-wrapper$/-autoupdate/'
+ UPDATER=/usr/lib/MailScanner/generic-autoupdate
+ '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper -a -n / ']'
+ /usr/lib/MailScanner/generic-wrapper / -IsItInstalled
+ logger -p mail.info -t update.virus.scanners Found generic installed
+ '[' -x /usr/lib/MailScanner/generic-autoupdate ']'
+ logger -p mail.info -t update.virus.scanners Running autoupdate for
generic
+ /usr/lib/MailScanner/generic-autoupdate /

I have edited out the non-pertinent portions. So, as far as I can tell, this
part seems fine. The only thing might be the lockfile. I do not see this
being created when this is run but it is hard to tell.

Any other ideas??

Dave

-----Original Message-----
From: David Jacobson [mailto:davidj@synaq.com]
Sent: Tuesday, October 26, 2004 2:49 AM
To: dfilchak@sympatico.ca
Subject: Re: update_virus_scanners

Hi,

Perhaps try appending -x to the end of the #!/bin/bash line in
/usr/sbin/update_virus_scanners and look for any glaring errors.

On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> OK .. I have managed to confuse the hell out of myself and really
> could use someone to put me out of my misery. I have just updated one
> of my servers to Mail::ClamAV 0.12 and MailScanner 4.35.5. After a bit
> of fiddling that went OK. However, while I was doing that, I decided
> to again tackle the update_virus_scanners issue I have been having in
> that I keep getting an error like the following when I run or cron runs
update_virus_scanners:
>
> Oct 26 00:00:21 ebony update.virus.scanners: Found clamav installed
> Oct 26 00:00:21 ebony update.virus.scanners: Running autoupdate for
> clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV updater
> failed
>
> However, if I run freshclam -v I get:
>
> Current working dir is /usr/local/share/clamav Max retries == 3 ClamAV
> update process started at Tue Oct 26 00:01:13 2004 Connected to
> database.clamav.net (65.110.48.11).
> Reading CVD header (main.cvd): OK
> main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> tomek)
> Connected to database.clamav.net (65.110.48.11).
> Reading CVD header (daily.cvd): OK
> daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> trog)
> Freeing option list...done
>
> Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
>
> Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV did not need
> updating
>
> in my maillog. Also, in clamav-autoupdate, I have changed the log
> directory to /var/log/clamav/ClamAV.update.log and in there I get:
>
> ClamAV update process started at Tue Oct 26 00:03:28 2004 main.cvd is
> up to date (version: 27, sigs: 23982, f-level: 2, builder:
> tomek)
> daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> trog)
>
> So, apparently /etc/cron.hourly/update_virus_scanners if not working
> and also apparently, I am too dull to figure out why.
>
> Can someone PLEASE help me out and tell me what they think is going on
here?
> I know it is probably stupid of me but sometimes you just gotta throw
> your hands in the air and yell for help.
>
> Dave
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
> archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
--
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From 20020401 at DUH.NET  Tue Oct 26 14:48:49 2004
From: 20020401 at DUH.NET (No Name)
Date: Thu Jan 12 21:27:22 2006
Subject: Blocked content
Message-ID: <mailman.3938.1137101242.24926.mailscanner@lists.mailscanner.info>

We just discovered blocked content warning messages sent to postmaster
do not have any report information.  Looking in the logs it shows the
message(s) have "Too many attachments".  Though the message is delivered
to the recipient with the subject modified with "{Blocked Content}" and
all the attachments included.

So should the content/attachments have been removed from the message to
the recipient?

And shouldn't there be some report information in the postmaster notices
like viruses, blocked attachments, etc have?

Example:

-Subject: Warning: E-mail viruses detected
-
-The following e-mail messages were found to have viruses in them:
-
-    Sender: xxxxx@xxxxx
-IP Address: 68.111.105.150
- Recipient: xxxxx@xxxxx
-   Subject: Fwd: Meat
- MessageID: i9PK9TQj024346
-    Report:
-Full headers are:

Also, should the subject be something more appropriate, instead of
virus detected?

---
Travis Taylor, EMail Administrator
Newton Unified School District #373
Educational Technology Center
116 West 7th
Newton, KS 67114
316-284-6251

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From davidj at synaq.com  Tue Oct 26 15:03:26 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:22 2006
Subject: update_virus_scanners
Message-ID: <mailman.3939.1137101242.24926.mailscanner@lists.mailscanner.info>

Hi,

Does "perl -w /usr/lib/MailScanner/clamav-autoupdate" show any errors?

Also what are your /tmp directory permissions? (Should be 1777) you can
see this by issuing "stat /tmp"


On Tue, 2004-10-26 at 15:10, Dave Filchak wrote:
> Thanks for your reply. Tried what you suggested and really cannot see
> anything weird. It finds ClamAV installed and finds generic installed but
> nothing else, which is normal. 
> 
> + SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
> + LOCKFILE=/tmp/MailScanner.autoupdate.lock
> ++ perl -e 'print "young" if -f "/tmp/MailScanner.autoupdate.lock" && -M
> "/tmp/MailScanner.autoupdate.lock"<0.042'
> + '[' x = xyoung ']'
> + trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT
> + touch /tmp/MailScanner.autoupdate.lock
> + umask 022
> ++ uname
> + OS=Linux
> + '[' Linux = SunOS ']'
> + GREP=grep
> + cat /etc/MailScanner/virus.scanners.conf
> + sed -e 's/#.*$//'
> + grep -e -wrapper
> 
> <SNIP>
> 
> + read NAME WRAPPER PACKAGEDIR
> ++ echo /usr/lib/MailScanner/clamav-wrapper
> ++ sed -e 's/-wrapper$/-autoupdate/'
> + UPDATER=/usr/lib/MailScanner/clamav-autoupdate
> + '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper -a -n /usr ']'
> + /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled
> + logger -p mail.info -t update.virus.scanners Found clamav installed
> + '[' -x /usr/lib/MailScanner/clamav-autoupdate ']'
> + logger -p mail.info -t update.virus.scanners Running autoupdate for clamav
> + /usr/lib/MailScanner/clamav-autoupdate /usr
> 
> <SNIP>
> 
> + read NAME WRAPPER PACKAGEDIR
> ++ echo /usr/lib/MailScanner/generic-wrapper
> ++ sed -e 's/-wrapper$/-autoupdate/'
> + UPDATER=/usr/lib/MailScanner/generic-autoupdate
> + '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper -a -n / ']'
> + /usr/lib/MailScanner/generic-wrapper / -IsItInstalled
> + logger -p mail.info -t update.virus.scanners Found generic installed
> + '[' -x /usr/lib/MailScanner/generic-autoupdate ']'
> + logger -p mail.info -t update.virus.scanners Running autoupdate for
> generic
> + /usr/lib/MailScanner/generic-autoupdate /
> 
> I have edited out the non-pertinent portions. So, as far as I can tell, this
> part seems fine. The only thing might be the lockfile. I do not see this
> being created when this is run but it is hard to tell.
> 
> Any other ideas??
> 
> Dave
> 
> -----Original Message-----
> From: David Jacobson [mailto:davidj@synaq.com] 
> Sent: Tuesday, October 26, 2004 2:49 AM
> To: dfilchak@sympatico.ca
> Subject: Re: update_virus_scanners
> 
> Hi,
> 
> Perhaps try appending -x to the end of the #!/bin/bash line in
> /usr/sbin/update_virus_scanners and look for any glaring errors.
> 
> On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> > OK .. I have managed to confuse the hell out of myself and really 
> > could use someone to put me out of my misery. I have just updated one 
> > of my servers to Mail::ClamAV 0.12 and MailScanner 4.35.5. After a bit 
> > of fiddling that went OK. However, while I was doing that, I decided 
> > to again tackle the update_virus_scanners issue I have been having in 
> > that I keep getting an error like the following when I run or cron runs
> update_virus_scanners:
> > 
> > Oct 26 00:00:21 ebony update.virus.scanners: Found clamav installed 
> > Oct 26 00:00:21 ebony update.virus.scanners: Running autoupdate for 
> > clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV updater 
> > failed
> > 
> > However, if I run freshclam -v I get:
> > 
> > Current working dir is /usr/local/share/clamav Max retries == 3 ClamAV 
> > update process started at Tue Oct 26 00:01:13 2004 Connected to 
> > database.clamav.net (65.110.48.11).
> > Reading CVD header (main.cvd): OK
> > main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > tomek)
> > Connected to database.clamav.net (65.110.48.11).
> > Reading CVD header (daily.cvd): OK
> > daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> > trog)
> > Freeing option list...done
> > 
> > Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> > 
> > Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV did not need 
> > updating
> > 
> > in my maillog. Also, in clamav-autoupdate, I have changed the log 
> > directory to /var/log/clamav/ClamAV.update.log and in there I get:
> > 
> > ClamAV update process started at Tue Oct 26 00:03:28 2004 main.cvd is 
> > up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > tomek)
> > daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> > trog)
> > 
> > So, apparently /etc/cron.hourly/update_virus_scanners if not working 
> > and also apparently, I am too dull to figure out why.
> > 
> > Can someone PLEASE help me out and tell me what they think is going on
> here?
> > I know it is probably stupid of me but sometimes you just gotta throw 
> > your hands in the air and yell for help.
> > 
> > Dave
> > 
> > ------------------------ MailScanner list ------------------------ To 
> > unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the 
> > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> --
> Regards,
> 
> David Jacobson
> Technical Director
> SYNAQ (Pty) Ltd
> 
> Tel:  011 290 6388
> Cell: 083 235 0760
> Mail: davidj@synaq.com
> WWW:  http://www.synaq.com	
> 
> Key Fingerprint
> 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From dfilchak at sympatico.ca  Tue Oct 26 15:37:44 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:22 2006
Subject: update_virus_scanners
Message-ID: <mailman.3940.1137101242.24926.mailscanner@lists.mailscanner.info>

Permissions on /tmp are right:

stat /tmp
  File: `/tmp'
  Size: 11264           Blocks: 22         IO Block: 4096   Directory
Device: 801h/2049d      Inode: 2           Links: 11
Access: (1777/drwxrwxrwt)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2004-10-26 09:15:24.000000000 -0400
Modify: 2004-10-26 10:33:16.000000000 -0400
Change: 2004-10-26 10:33:16.000000000 -0400

And  perl -w /usr/lib/MailScanner/clamav-autoupdate shows no errors.

Dave

-----Original Message-----
From: David Jacobson [mailto:davidj@synaq.com]
Sent: Tuesday, October 26, 2004 10:03 AM
To: dfilchak@sympatico.ca
Cc: MAILSCANNER@JISCMAIL.AC.UK
Subject: RE: update_virus_scanners

Hi,

Does "perl -w /usr/lib/MailScanner/clamav-autoupdate" show any errors?

Also what are your /tmp directory permissions? (Should be 1777) you can see
this by issuing "stat /tmp"


On Tue, 2004-10-26 at 15:10, Dave Filchak wrote:
> Thanks for your reply. Tried what you suggested and really cannot see
> anything weird. It finds ClamAV installed and finds generic installed
> but nothing else, which is normal.
>
> + SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
> + LOCKFILE=/tmp/MailScanner.autoupdate.lock
> ++ perl -e 'print "young" if -f "/tmp/MailScanner.autoupdate.lock" &&
> ++ -M
> "/tmp/MailScanner.autoupdate.lock"<0.042'
> + '[' x = xyoung ']'
> + trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT touch
> + /tmp/MailScanner.autoupdate.lock umask 022
> ++ uname
> + OS=Linux
> + '[' Linux = SunOS ']'
> + GREP=grep
> + cat /etc/MailScanner/virus.scanners.conf
> + sed -e 's/#.*$//'
> + grep -e -wrapper
>
> <SNIP>
>
> + read NAME WRAPPER PACKAGEDIR
> ++ echo /usr/lib/MailScanner/clamav-wrapper
> ++ sed -e 's/-wrapper$/-autoupdate/'
> + UPDATER=/usr/lib/MailScanner/clamav-autoupdate
> + '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper -a -n /usr ']'
> + /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled logger -p
> + mail.info -t update.virus.scanners Found clamav installed '[' -x
> + /usr/lib/MailScanner/clamav-autoupdate ']'
> + logger -p mail.info -t update.virus.scanners Running autoupdate for
> + clamav /usr/lib/MailScanner/clamav-autoupdate /usr
>
> <SNIP>
>
> + read NAME WRAPPER PACKAGEDIR
> ++ echo /usr/lib/MailScanner/generic-wrapper
> ++ sed -e 's/-wrapper$/-autoupdate/'
> + UPDATER=/usr/lib/MailScanner/generic-autoupdate
> + '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper -a -n / ']'
> + /usr/lib/MailScanner/generic-wrapper / -IsItInstalled logger -p
> + mail.info -t update.virus.scanners Found generic installed '[' -x
> + /usr/lib/MailScanner/generic-autoupdate ']'
> + logger -p mail.info -t update.virus.scanners Running autoupdate for
> generic
> + /usr/lib/MailScanner/generic-autoupdate /
>
> I have edited out the non-pertinent portions. So, as far as I can
> tell, this part seems fine. The only thing might be the lockfile. I do
> not see this being created when this is run but it is hard to tell.
>
> Any other ideas??
>
> Dave
>
> -----Original Message-----
> From: David Jacobson [mailto:davidj@synaq.com]
> Sent: Tuesday, October 26, 2004 2:49 AM
> To: dfilchak@sympatico.ca
> Subject: Re: update_virus_scanners
>
> Hi,
>
> Perhaps try appending -x to the end of the #!/bin/bash line in
> /usr/sbin/update_virus_scanners and look for any glaring errors.
>
> On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> > OK .. I have managed to confuse the hell out of myself and really
> > could use someone to put me out of my misery. I have just updated
> > one of my servers to Mail::ClamAV 0.12 and MailScanner 4.35.5. After
> > a bit of fiddling that went OK. However, while I was doing that, I
> > decided to again tackle the update_virus_scanners issue I have been
> > having in that I keep getting an error like the following when I run
> > or cron runs
> update_virus_scanners:
> >
> > Oct 26 00:00:21 ebony update.virus.scanners: Found clamav installed
> > Oct 26 00:00:21 ebony update.virus.scanners: Running autoupdate for
> > clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV
> > updater failed
> >
> > However, if I run freshclam -v I get:
> >
> > Current working dir is /usr/local/share/clamav Max retries == 3
> > ClamAV update process started at Tue Oct 26 00:01:13 2004 Connected
> > to database.clamav.net (65.110.48.11).
> > Reading CVD header (main.cvd): OK
> > main.cvd is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > tomek)
> > Connected to database.clamav.net (65.110.48.11).
> > Reading CVD header (daily.cvd): OK
> > daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> > trog)
> > Freeing option list...done
> >
> > Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> >
> > Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV did not need
> > updating
> >
> > in my maillog. Also, in clamav-autoupdate, I have changed the log
> > directory to /var/log/clamav/ClamAV.update.log and in there I get:
> >
> > ClamAV update process started at Tue Oct 26 00:03:28 2004 main.cvd
> > is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > tomek)
> > daily.cvd is up to date (version: 550, sigs: 1607, f-level: 3, builder:
> > trog)
> >
> > So, apparently /etc/cron.hourly/update_virus_scanners if not working
> > and also apparently, I am too dull to figure out why.
> >
> > Can someone PLEASE help me out and tell me what they think is going
> > on
> here?
> > I know it is probably stupid of me but sometimes you just gotta
> > throw your hands in the air and yell for help.
> >
> > Dave
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> --
> Regards,
>
> David Jacobson
> Technical Director
> SYNAQ (Pty) Ltd
>
> Tel:  011 290 6388
> Cell: 083 235 0760
> Mail: davidj@synaq.com
> WWW:  http://www.synaq.com
>
> Key Fingerprint
> 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
--
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Oct 26 15:35:49 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.3941.1137101242.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I would advise you wait for the 1st November 4.35 stable release. 4.34 was a
bit bumpy...


On 26/10/04 12:41 pm, "Daniel Gercke" <gercke@HNM.DE> wrote:

> <x-flowed>
> Hello all,
> 
> i want to update from 4.28.5-2 to the current stable release. Are there
> any hints that i musst know to update without runnings into Problems?
> I´m using PRM Version.

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Oct 26 15:34:57 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:22 2006
Subject: Additional blank line inserted into header, Postfix 2.0.18-4
Message-ID: <mailman.3942.1137101242.24926.mailscanner@lists.mailscanner.info>

Not really, no. There's no difference between a message which suffers this
problem and a real message that just has weird text in it.


On 26/10/04 12:12 pm, "Ron E." <ree@THUNDERSTAR.NET> wrote:

> Dear Julian,
>
>         Yes, definitely agreed!
>
>         Perhaps this is done intentionally... this is always spam that has
> this extra "header" consisting of one space. If this is of interest, I can
> post a sample of one of these.
>
>         Due to the way that I handle email that is deteted as spam on this
> particular server, such messages are not routed correctly and they make it
> to users when normally they are blocked.
>
>         Is there any way to configure MailScanner to quarantine such
> items?
>
> Regards,
>
> Ron
>
> On Tue, 26 Oct 2004, Julian Field wrote:
>
>> Header names are not allowed to have spaces in them. If you add a header (or
>> someone else adds a header) whose name contains a space, then you (or they)
>> are breaking an important bit of RFC822 (or 2822) and all sorts of nasty
>> things will happen.
>>
>> On 26/10/04 5:46 am, "Ron E." <ree@THUNDERSTAR.NET> wrote:
>>>         I'm running postfix, MailScanner 4.35.5-1 and SA 3.0.1, but this
>>> same problem was occasionally happening with MailScanner 4.33.3-1 and SA
>>> 3.0.0.
>>>
>>>         What happens is occasionally messages will have a blank line
>>> inserted just before the X-orgname-MailScanner-Information -- I checked a
>>> bit more thoroughly and found that that line has one space in it just
>>> before EOL.
>>>
>>>         Does anyone have any idea why this is happening? I searched the
>>> archives and found only one other mention of this but occurring with
>>> Sendmail.
>>>
>>>         I also checked briefly through the postfix mailing list but didn't
>>> find much.
>>>
>>>         Hopefully someone has an idea how I can track this down. It's
>>> rather annoying as the occasional message will then not be correctly
>>> handled after MailScanner is done with it due to the header that appears
>>> to end before the spamassassin scoring stuff.
>>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Tue Oct 26 14:40:34 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3943.1137101242.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello!

Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
usualy was getting these rpms at http://dag.wieers.com/packages/clamav/, but
the last version there is 0.75-1-1.

Regards

Roger Jochem

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dparter at CS.WISC.EDU  Tue Oct 26 16:06:19 2004
From: dparter at CS.WISC.EDU (David Parter)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3944.1137101243.24926.mailscanner@lists.mailscanner.info>

> Hello!
>
> Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
> usualy was getting these rpms at http://dag.wieers.com/packages/clamav/, but
> the last version there is 0.75-1-1.

I found a thread on a mailing list (using a google search) that says
that the new RPM will be at that site soon. Something about waiting for
internet access to be fixed...

        --david

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Tue Oct 26 15:55:49 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3945.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Roger Jochem wrote:
> Hello!
>
> Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
> usualy was getting these rpms at http://dag.wieers.com/packages/clamav/, but
> the last version there is 0.75-1-1.

This will work:
http://filelister.linux-kernel.at/?current=/packages/SRPMS/

Download 'clamav-0.80-1.src.rpm' and run 'rpmbuild --rebuild
clamav-0.80-1.src.rpm'

- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Tue Oct 26 15:29:13 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3946.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "Windows-1252" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I received an e-mail from Dag Wieers saying that just now... He wrote:

--------------------------
Sure, as soon as I have Internet. I still have to wait 1.5 week (already
waited 6 weeks, no improvement).
--------------------------

----- Original Message -----
From: "David Parter" <dparter@CS.WISC.EDU>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 26, 2004 1:06 PM
Subject: Re: Clamav RPMs


> > Hello!
> >
> > Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
> > usualy was getting these rpms at http://dag.wieers.com/packages/clamav/,
but
> > the last version there is 0.75-1-1.
>
> I found a thread on a mailing list (using a google search) that says
> that the new RPM will be at that site soon. Something about waiting for
> internet access to be fixed...
>
>         --david
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Oct 26 16:30:53 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3947.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

<<Snip>>
|> But whatever I do i don't see any hits on the rules with URIBL/SURBL and
|> or SPF. Although I couldn't find it back in the list I believe i need
|> the latest beta for SPF support, but URIBL should work.
|>
|> I check some of the spam only minutes after they where received on
|> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
|> listed in one or more lists.
|>
|> The only rule scoring I modified in local.cf is:
|> score ALL_TRUSTED 0
|
|
| What does a SA --lint tell you ?
|
|> Is there somebody who can offer some adivce on how to troubleshoot
|> and/or find the culprit for this?
Check to see if you have a "/etc/mail/spamassassin/init.pre" You might
find it instead in "/usr/etc/mail/spamassassin/init.pre". Copy (or link
might work) to /etc/mail/spamassassin and restart MailScanner just to be
safe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBfm2tRADw9lziUqQRAs/JAJ9EOcZDx6KLMhCDRv3vrj9vAlfODACfaTcY
drfrHkN0S5bHsg0K9jeHRFY=
=saRy
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Tue Oct 26 16:46:55 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:23 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.3948.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>I would advise you wait for the 1st November 4.35 stable release. 4.34 was a
>bit bumpy...
>  
>
Yesterday I upgraded an old SA to 3.0.1 running on MS 4.29.7 (string 
found in the old /usr/sbin/MailScanner).  The SA upgrade went smoothly.

But when I restarted MS, it wouldn't stop restarting new children 
without processing any email.  I checked the logs and there was nothing 
special.  I then decided to upgrade MS right away...

I went with 4.34.8-4 but it wouldn't install on my RHEL 3 system.  At 
that point I decided to go with 4.35.5-1, even though it is an unstable 
release...

I had so many problems making it work on my system I was beginning to 
feel uncomfortable (this was on a production server: I was then running 
with only 1 MS server instead of 2 as usual).  I tried to reinstall many 
Perl modules using CPAN, tried to re-run install.sh many times, removed 
some Perl modules manually (rm)...  and finally I got it right.

Don't know what I finally did to get it running OK (too many changes at 
once)...

This makes me uneasy with the most recent releases...  Once you start 
upgrading the Perl modules, it's more difficult to get back to an older 
MS version.  At one point I thought my system was completely screwed 
beyond any hope...

I had strange messages like (I logged every install.sh attempt in a 
script file):
Oh good, module Convert::BinHex version 1.119 is already installed.
error: Failed dependencies:
        perl(Convert::BinHex) is needed by perl-MIME-tools-5.413-4
Oh good, module Compress::Zlib version 1.33 is already installed.
error: Failed dependencies:
        perl(Compress::Zlib) is needed by perl-Archive-Zip-1.13-1

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Oct 26 16:32:32 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:23 2006
Subject: mailscanner strange problem
Message-ID: <mailman.3949.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Martin Hepworth wrote:
| Vladimir
|
| quite a jump...
|
| anyway what O/S. MTA etc.
|
| what does mailscanner -v give you, so we can check the versions of perl
| modules.
|
| Are you using SA? If you are what version?
|
| Are you using any anti-virus, if so which on and wnat version.
|
| Have you tried putting MS into debug mode and running check mailscanner
| to see if you can spot where it's doing odd things?
|
| have you looked in the log files to see if there's anything
| 'interesting' there?
|
|
| --
| Martin Hepworth
| Snr Systems Administrator
| Solid State Logic
| Tel: +44 (0)1865 842300
|
|
| Vladimir Nikolic wrote:
|
|> Hi!
|>
|> After upgrade to 4.34.8 (from 4.21.9) mailscanner doesn't work right.
|> Trouble is that mailscanner child processes are creating their own child
|> processes which then run without control and by the time take all
|> resources.
|> I've tried wiht downgrade to 4.21.9 but it didn't help. Mailscanner acts
|>  the same.
|>
|> Regards,
|> Vlado
|>
|> ------------------------ MailScanner list ------------------------
|> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
|> 'leave mailscanner' in the body of the email.
|> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
|> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
|
|
| **********************************************************************
Also, if you used the rpm install, did you search for the .rpmnew files
and fix that problem.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBfm4QRADw9lziUqQRAm9WAJ9oxHDZnk5oM0+s8hrOuZRTkPrAUgCfWsmY
Q4t85kBfX38rbtG4rzM+x7o=
=dpeS
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Kevin_Miller at CI.JUNEAU.AK.US  Tue Oct 26 16:53:12 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3950.1137101243.24926.mailscanner@lists.mailscanner.info>

Venkata Achanta wrote:
>>
>> if someone sends out a e-mail and get a repsonse and if he responds
>> again the disclaimer is getting attached again.if this happens X
>> number of times we end up having disclaimer attached X number of
>> time as well which looks ugly(better than spam though :-)) )
>>

The problem here isn't MailScanner - it's people too lazy to edit their
responses.  Every time a reply is generated, you get a ">" in front of the
previous text, including the disclaimers.  Just delete the text that isn't
relivant.

I suppose this is an outgrowth of top-posting where people no longer deal
w/the full body of email.  Still, it's silly to blame the MTA when it's the
email client and user that's to blame.

However, the way email is supposed to work, is that one can define a
signature such that it isn't included in replies by seperating it from the
body of the message with two dashes and a space (such as under "...Kevin"
below).  A reasonably modern email client will not include anything below
that in a reply.  Therefore, if you edited the disclaimer and delimited it
with a line containing "-- " (sans quotes) before anything else, then it
shouldn't be included when you reply...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From t.d.lee at DURHAM.AC.UK  Tue Oct 26 16:52:46 2004
From: t.d.lee at DURHAM.AC.UK (David Lee)
Date: Thu Jan 12 21:27:23 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.3951.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tue, 26 Oct 2004, Julian Field wrote:

> On 26/10/04 12:41 pm, "Daniel Gercke" <gercke@HNM.DE> wrote:
>
> > <x-flowed>
> > Hello all,
> >
> > i want to update from 4.28.5-2 to the current stable release. Are there
> > any hints that i musst know to update without runnings into Problems?
> > I´m using PRM Version.
>
> I would advise you wait for the 1st November 4.35 stable release. 4.34 was a
> bit bumpy...

Julian:  Also, I recall that the recent weeks have seen many changes and
interaction issues with other software.  From memory, I recall:
   SA 3.0 code
   SA 3.0 rulesets
   clamav 0.80 release
   perl modules (MS v. rpm v. CPAN)
   (and probably others)

Are all these products still independent across their versions?  Or does
upgrading to the latest version of product X (MS, SA, clamav, ...)
_require_ upgrading another product Y (same set ...)?

When you do the 4.35 stable release, it might be helpful to outline any
known inter-relationship lock-step issues.

Thanks.


-- 

:  David Lee                                I.T. Service          :
:  Senior Systems Programmer                Computer Centre       :
:                                           University of Durham  :
:  http://www.dur.ac.uk/t.d.lee/            South Road            :
:                                           Durham                :
:  Phone: +44 191 334 2752                  U.K.                  :

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From SJCJonker at SJC.NL  Tue Oct 26 16:55:01 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & SURBL / URIBL and SPF checks]
Message-ID: <mailman.3952.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Oeps,

Just found out i didn't copy the list.

-------- Original Message --------
Subject: Re: MailScanner & SURBL / URIBL and SPF checks
Date: Tue, 26 Oct 2004 10:55:20 +0200
From: Stijn Jonker <SJCJonker@SJC.nl>
To: Raymond Dijkxhoorn <raymond@prolocation.net>
References: <417E080A.3060805@SJC.nl>
<Pine.LNX.4.61.0410261022510.29843@mailbox.prolocation.net>

Raymond,

Thanks for the response, well I ran SA --lint and SA --test on a
message, and indeed it lists the following:

debug: uri found: http://www.valuate.biz/red/s4.gif
debug: uri found: http://www.valuate.biz/red/s3.gif
debug: uri found: http://www.valuate.biz/red/s2.jpg
debug: uri found: http://www.valuate.biz/o/
debug: uri found: http://www.valuate.biz/red/sc.htm
debug: uri found: http://www.valuate.biz/red/s1.gif
debug: URIDNSBL: domains to query: valuate.biz
debug: is Net::DNS::Resolver available? yes
<<SNIP>>

And that's it. Full output is attached.

And I just checked again, valuate.biz is listed in ws.surbl.org, my
score for that is: 50_scores.cf:score URIBL_WS_SURBL 0 0.539 0 1.462

So it should run (fyi, this is the default file/value for the score.)

Stijn

Raymond Dijkxhoorn said the following on 26/10/2004 10:23:
> Hi Stijn,
>
>> loadplugin Mail::SpamAssassin::Plugin::URIDNSBL and
>> loadplugin Mail::SpamAssassin::Plugin::SPF
>> first in /etc/mail/spamassassin/local.cf then moved it to:
>> /etc/MailScanner/spam.assassin.prefs.conf
>>
>> But whatever I do i don't see any hits on the rules with URIBL/SURBL and
>> or SPF. Although I couldn't find it back in the list I believe i need
>> the latest beta for SPF support, but URIBL should work.
>>
>> I check some of the spam only minutes after they where received on
>> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
>> listed in one or more lists.
>>
>> The only rule scoring I modified in local.cf is:
>> score ALL_TRUSTED 0
>
>
> What does a SA --lint tell you ?
>
>> Is there somebody who can offer some adivce on how to troubleshoot
>> and/or find the culprit for this?
>
>
> Bye,
> Raymond.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>


--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

debug: SpamAssassin version 3.0.1
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to: /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/70_sare_adult.cf
debug: config: read file /etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf
debug: config: read file /etc/mail/spamassassin/70_sare_header.cf
debug: config: read file /etc/mail/spamassassin/70_sare_html.cf
debug: config: read file /etc/mail/spamassassin/70_sare_oem.cf
debug: config: read file /etc/mail/spamassassin/70_sare_random.cf
debug: config: read file /etc/mail/spamassassin/70_sare_ratware.cf
debug: config: read file /etc/mail/spamassassin/70_sare_specific.cf
debug: config: read file /etc/mail/spamassassin/70_sare_spoof.cf
debug: config: read file /etc/mail/spamassassin/72_sare_bml_post25x.cf
debug: config: read file /etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf
debug: config: read file /etc/mail/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /etc/mail/spamassassin/antidrug.cf
debug: config: read file /etc/mail/spamassassin/bogus-virus-warnings.cf
debug: config: read file /etc/mail/spamassassin/evilnumbers.cf
debug: config: read file /etc/mail/spamassassin/local.cf
debug: config: read file /etc/mail/spamassassin/random.cf
debug: config: read file /etc/mail/spamassassin/tripwire.cf
debug: using "/root/.spamassassin" for user state dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0x99ec8a4)
debug: bayes: 26016 tie-ing to DB file R/O /var/spool/spamassassin/bayes_toks
debug: bayes: 26016 tie-ing to DB file R/O /var/spool/spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: Score set 3 chosen.
debug: received-header: parsed as [ ip=192.168.253.1 rdns=hn00dmz01.sjc.nl helo=hn00dmz01.sjc.nl by=hn00srv01.sjc.nl ident= envfrom= intl=0 id=8577618014 ]
debug: received-header: parsed as [ ip=192.168.253.254 rdns=hn00sia01.sjc.nl helo=hn00sia01.sjc.nl by=hn00dmz01.sjc.nl ident= envfrom= intl=0 id=i9Q8XXia024995 ]
debug: received-header: parsed as [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=hn00sia01.sjc.nl ident= envfrom= intl=0 id=A0E088023 ]
debug: dns_available set to yes in config file, skipping test
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: looking up PTR record for '69.6.24.71'
debug: PTR for '69.6.24.71': 'mx2.valuate.biz'
debug: received-header: parsed as [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=jk271w.mx2.valuate.biz ident= envfrom= intl=0 id= ]
debug: looking up A records for 'hn00srv01.sjc.nl'
debug: A records for 'hn00srv01.sjc.nl': 192.168.175.1
debug: received-header: 'from' 192.168.253.1 has reserved IP
debug: received-header: 'from' 192.168.253.1 is near to first 'by'
debug: received-header: relay 192.168.253.1 trusted? yes internal? no
debug: received-header: 'from' 192.168.253.254 has reserved IP
debug: received-header: 'from' 192.168.253.254 is near to first 'by'
debug: received-header: relay 192.168.253.254 trusted? yes internal? no
debug: looking up A records for 'hn00sia01.sjc.nl'
debug: A records for 'hn00sia01.sjc.nl': 192.168.253.254 192.168.175.254
debug: received-header: 'by' hn00sia01.sjc.nl has reserved IP 192.168.253.254
debug: received-header: 'by' hn00sia01.sjc.nl has reserved IP 192.168.175.254
debug: received-header: 'by' hn00sia01.sjc.nl has no public IPs
debug: received-header: relay 69.6.24.71 trusted? yes internal? no
debug: looking up A records for 'jk271w.mx2.valuate.biz'
debug: A records for 'jk271w.mx2.valuate.biz':
debug: received-header: relay 69.6.24.71 trusted? no internal? no
debug: metadata: X-Spam-Relays-Trusted: [ ip=192.168.253.1 rdns=hn00dmz01.sjc.nl helo=hn00dmz01.sjc.nl by=hn00srv01.sjc.nl ident= envfrom= intl=0 id=8577618014 ] [ ip=192.168.253.254 rdns=hn00sia01.sjc.nl helo=hn00sia01.sjc.nl by=hn00dmz01.sjc.nl ident= envfrom= intl=0 id=i9Q8XXia024995 ] [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=hn00sia01.sjc.nl ident= envfrom= intl=0 id=A0E088023 ]
debug: metadata: X-Spam-Relays-Untrusted: [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=jk271w.mx2.valuate.biz ident= envfrom= intl=0 id= ]
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c) implements 'parsed_metadata'
debug: ---- MIME PARSER START ----
debug: main message type: multipart/alternative
debug: parsing multipart, got boundary: ----=_NextPart_2548111434867620825622456472163
debug: found part of type text/plain, boundary: ----=_NextPart_2548111434867620825622456472163
debug: parsing normal part
debug: added part, type: text/plain
debug: found part of type text/html, boundary: ----=_NextPart_2548111434867620825622456472163
debug: parsing normal part
debug: added part, type: text/html
debug: ---- MIME PARSER END ----
debug: decoding: other encoding type (7bit), ignoring
debug: decoding: quoted-printable
debug: uri found: http://www.valuate.biz/red/s4.gif
debug: uri found: http://www.valuate.biz/red/s3.gif
debug: uri found: http://www.valuate.biz/red/s2.jpg
debug: uri found: http://www.valuate.biz/o/
debug: uri found: http://www.valuate.biz/red/sc.htm
debug: uri found: http://www.valuate.biz/red/s1.gif
debug: URIDNSBL: domains to query: valuate.biz
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: all '*From' addrs: research@valuate.biz
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: all '*To' addrs: spam@sjc.nl bestuur@ospylac.com sjonker@hn00srv01.sjc.nl
debug: forged-HELO: from=valuate.biz helo=valuate.biz by=valuate.biz
debug: running body-text per-line regexp tests; score so far=0
debug: running uri tests; score so far=0
debug: bayes corpus size: nspam = 1331, nham = 3081
debug: tokenize: header tokens for *p = "U*research D*valuate.biz D*biz"
debug: tokenize: header tokens for *m = "  lyyk1 07h3rm4 mx2 valuate biz "
debug: tokenize: header tokens for To = "U*bestuur D*ospylac.com D*com"
debug: tokenize: header tokens for MIME-Version = " "
debug: tokenize: header tokens for X-Encoding = " MIME"
debug: tokenize: header tokens for *c = " multipart/alternative;   ----=_ NHxtPHrt _ HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH"
debug: tokenize: header tokens for *F = "U*research D*valuate.biz D*biz"
debug: tokenize: header tokens for *RT = " [ ip=192.168.253.1 rdns=hn00dmz01.sjc.nl helo=hn00dmz01.sjc.nl by=hn00srv01.sjc.nl ident= envfrom= intl=0 id=8577618014 ] [ ip=192.168.253.254 rdns=hn00sia01.sjc.nl helo=hn00sia01.sjc.nl by=hn00dmz01.sjc.nl ident= envfrom= intl=0 id=i9Q8XXia024995 ] [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=hn00sia01.sjc.nl ident= envfrom= intl=0 id=A0E088023 ]"
debug: tokenize: header tokens for *RU = " [ ip=69.6.24.71 rdns=mx2.valuate.biz helo=mx2.valuate.biz by=jk271w.mx2.valuate.biz ident= envfrom= intl=0 id= ]"
debug: tokenize: header tokens for *r = "   mx2.valuate.biz [69.6.24 ip*69.6.24.71 ] by jk271w.mx2.valuate.biz    ; "
debug: tokenize: header tokens for *r = "   mx2.valuate.biz [69.6.24 ip*69.6.24.71 ] by jk271w.mx2.valuate.biz    ;     mx2.valuate.biz (mx2.valuate.biz [69.6.24 ip*69.6.24.71 ]) by hn00sia01.sjc.nl (SJCMailer)         <bestuur@ospylac.com>; "
debug: bayes token 'HTo:U*bestuur' => 0.999197089926881
debug: bayes token 'H*r:sk:bestuur' => 0.999158962802908
debug: bayes token 'bertrand' => 0.988731707317073
debug: bayes token 'russell' => 0.985096774193548
debug: bayes token 'H*m:biz' => 0.985096774193548
debug: bayes token 'H*c:sk:HHHHHHH' => 0.981126161868103
debug: bayes token 'H*m:mx2' => 0.978
debug: bayes token 'H*MI:mx2' => 0.978
debug: bayes token 'H*r:69.6.24' => 0.978
debug: bayes token 'UD:gif' => 0.941293855903048
debug: bayes token 'H*c:alternative' => 0.936477375940418
debug: bayes token 'H*RT:sk:hn00srv' => 0.0674039579417098
debug: bayes token 'H*MI:biz' => 0.917309925256388
debug: bayes token 'UD:biz' => 0.903253460268809
debug: bayes token 'H*F:D*biz' => 0.895378967698394
debug: bayes token 'H*c:multipart' => 0.885275398348535
debug: bayes token 'HTo:D*ospylac.com' => 0.884884362062149
debug: bayes token 'precise' => 0.865927036864467
debug: bayes token 'Keep' => 0.865927036864467
debug: bayes token 'UD:htm' => 0.135568949647952
debug: bayes token 'realize' => 0.153891590678825
debug: bayes: score = 0.999952096435384
debug: bayes: 26016 untie-ing
debug: bayes: 26016 untie-ing db_toks
debug: bayes: 26016 untie-ing db_seen
debug: madiff: left: 0, orig: 18, max-difference: 0.00%
debug: Razor2 is available
debug: entering helper-app run mode
 Razor-Log: Computed razorhome from env: /root/.razor
 Razor-Log: Found razorhome: /root/.razor
 Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
Oct 26 10:50:34.734031 check[26016]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout
Oct 26 10:50:34.734379 check[26016]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity-rumJH0SFB6
Oct 26 10:50:34.734508 check[26016]: [ 8] Client supported_engines: 4 8
Oct 26 10:50:34.735167 check[26016]: [ 8]  prep_mail done: mail 1 headers=1130, mime0=223, mime1=876
Oct 26 10:50:34.735408 check[26016]: [ 5] read_file: 1 items read from /root/.razor/servers.discovery.lst
Oct 26 10:50:34.735621 check[26016]: [ 5] read_file: 2 items read from /root/.razor/servers.nomination.lst
Oct 26 10:50:34.735851 check[26016]: [ 5] read_file: 3 items read from /root/.razor/servers.catalogue.lst
Oct 26 10:50:34.736081 check[26016]: [ 9] Assigning defaults to folly.cloudmark.com
Oct 26 10:50:34.736196 check[26016]: [ 9] Assigning defaults to joy.cloudmark.com
Oct 26 10:50:34.736311 check[26016]: [ 9] Assigning defaults to pride.cloudmark.com
Oct 26 10:50:34.736422 check[26016]: [ 9] Assigning defaults to thrill.cloudmark.com
Oct 26 10:50:34.736535 check[26016]: [ 9] Assigning defaults to wonder.cloudmark.com
Oct 26 10:50:34.737237 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:50:34.737685 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:50:34.738095 check[26016]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:50:34.738481 check[26016]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:50:34.738894 check[26016]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:50:34.739306 check[26016]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:50:34.739760 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:50:34.740211 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:50:34.740664 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:50:34.741117 check[26016]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:50:34.741262 check[26016]: [ 5] 107614 seconds before closest server discovery
Oct 26 10:50:34.741386 check[26016]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:50:34.741506 check[26016]: [ 8] Computed supported_engines: 4 8
Oct 26 10:50:34.741596 check[26016]: [ 8] Using next closest server pride.cloudmark.com:2703, cached info srl 5047
Oct 26 10:50:34.741687 check[26016]: [ 8] mail 1 Subject: Test & Keep a Standing Scooter - Product Evaluators Wanted
Oct 26 10:50:34.741894 check[26016]: [ 6] preproc: mail 1.0 went from 223 bytes to 109
Oct 26 10:50:34.742194 check[26016]: [ 6] preproc: mail 1.1 went from 876 bytes to 142
Oct 26 10:50:34.742280 check[26016]: [ 6] computing sigs for mail 1.0, len 109
Oct 26 10:50:34.743322 check[26016]: [ 6] Engine (8) didn't produce a signature for mail 1.0
Oct 26 10:50:34.743407 check[26016]: [ 6] computing sigs for mail 1.1, len 142
Oct 26 10:50:34.744921 check[26016]: [ 6] skipping whitelist file (empty?): /root/.razor/razor-whitelist
Oct 26 10:50:34.745018 check[26016]: [ 5] Connecting to pride.cloudmark.com ...
Oct 26 10:50:35.074238 check[26016]: [ 8] Connection established
Oct 26 10:50:35.074368 check[26016]: [ 4] pride.cloudmark.com >> 36 server greeting: sn=C&srl=5047&a=l&a=cg&ep4=7542-10
Oct 26 10:50:35.074650 check[26016]: [ 4] pride.cloudmark.com << 25
Oct 26 10:50:35.074707 check[26016]: [ 6] cn=razor-agents&cv=2.61
Oct 26 10:50:35.074865 check[26016]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:50:35.075debug: Using results from Razor v2.61
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=100
debug: Found Razor2 part: part=1 engine=4 ct=0 cf=0
debug: Found Razor2 part: part=1 engine=8 ct=0 cf=100
debug: leaving helper-app run mode
009 check[26016]: [ 8] Computed supported_engines: 4 8
Oct 26 10:50:35.075164 check[26016]: [ 8] mail 1.0 e4 sig: nvT1d_x3zw73ehk2QSuexAFcuCwA
Oct 26 10:50:35.075263 check[26016]: [ 5] mail 1.0 e8 got no sig
Oct 26 10:50:35.075332 check[26016]: [ 8] mail 1.1 e4 sig: bsPQfWaR_2tr03XqGdTmgkVLRq4A
Oct 26 10:50:35.075418 check[26016]: [ 8] mail 1.1 e8 sig: f2oCGwgpsXIA
Oct 26 10:50:35.075530 check[26016]: [ 8] preparing 3 queries
Oct 26 10:50:35.075766 check[26016]: [ 8] sending 1 batches
Oct 26 10:50:35.075876 check[26016]: [ 4] pride.cloudmark.com << 132
Oct 26 10:50:35.075928 check[26016]: [ 6] -a=c&e=4&ep4=7542-10&s=nvT1d_x3zw73ehk2QSuexAFcuCwA
a=c&e=4&ep4=7542-10&s=bsPQfWaR_2tr03XqGdTmgkVLRq4A
a=c&e=8&s=f2oCGwgpsXIA
.
Oct 26 10:50:35.572800 check[26016]: [ 4] pride.cloudmark.com >> 33
Oct 26 10:50:35.572890 check[26016]: [ 6] response to sent.2
-p=1&cf=100
p=0
p=1&cf=100
.
Oct 26 10:50:35.573242 check[26016]: [ 6] mail 1.0 e=4 sig=nvT1d_x3zw73ehk2QSuexAFcuCwA: Is spam: cf 100 >= min_cf 6
Oct 26 10:50:35.573320 check[26016]: [ 6] mail 1.1 e=4 sig=bsPQfWaR_2tr03XqGdTmgkVLRq4A: sig not found.
Oct 26 10:50:35.573387 check[26016]: [ 6] mail 1.1 e=8 sig=f2oCGwgpsXIA: Is spam: cf 100 >= min_cf 6
Oct 26 10:50:35.573457 check[26016]: [ 7] method 4: mail 1.0: no-contention part, spam=1
Oct 26 10:50:35.573513 check[26016]: [ 7] method 4: mail 1.1: no-contention part, spam=1
Oct 26 10:50:35.573568 check[26016]: [ 7] method 4: mail 1: a non-contention part was spam, mail spam
Oct 26 10:50:35.573624 check[26016]: [ 3] mail 1 is known spam.
Oct 26 10:50:35.573694 check[26016]: [ 5] disconnecting from server pride.cloudmark.com
Oct 26 10:50:35.573807 check[26016]: [ 4] pride.cloudmark.com << 5
Oct 26 10:50:35.573865 check[26016]: [ 6] a=q
debug: Razor2 results: spam? 1  highest cf score: 100
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c) implements 'check_tick'
debug: URIDNSBL: queries completed: 1 started: 2
debug: URIDNSBL: queries active:  at Tue Oct 26 10:50:35 2004
debug: running raw-body-text per-line regexp tests; score so far=7.413
debug: running full-text regexp tests; score so far=7.413
debug: Razor2 is available
debug: Pyzor is available: /usr/bin/pyzor
debug: entering helper-app run mode
debug: setuid: helper proc 26022: ruid=0 euid=0
debug: Pyzor: got response: 217.160.253.84:24441        TimeoutError:
debug: leaving helper-app run mode
debug: Pyzor: couldn't grok response "217.160.253.84:24441      TimeoutError: "
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 26023: ruid=0 euid=0
debug: DCC: got response: X-DCC-sgs_public_dcc_server-Metrics: hn00dmz01.sjc.nl 1199; Body=7 Fuz1=many Fuz2=many
debug: leaving helper-app run mode
debug: DCC: Listed! BODY: 7 of 999999 FUZ1: 999999 of 999999 FUZ2: 999999 of 999999
debug: Running tests for priority: 500
debug: URIDNSBL: queries completed: 2 started: 0
debug: URIDNSBL: queries active:  at Tue Oct 26 10:50:40 2004
debug: RBL: success for 11 of 11 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99eb53c) implements 'check_post_dnsbl'
debug: running meta tests; score so far=14.257
debug: running header regexp tests; score so far=14.409
debug: running body-text per-line regexp tests; score so far=14.409
debug: running uri tests; score so far=14.409
debug: running raw-body-text per-line regexp tests; score so far=14.409
debug: running full-text regexp tests; score so far=14.409
debug: Running tests for priority: 1000
debug: running meta tests; score so far=14.409
debug: running header regexp tests; score so far=14.409
debug: running body-text per-line regexp tests; score so far=14.409
debug: running uri tests; score so far=14.409
debug: running raw-body-text per-line regexp tests; score so far=14.409
debug: running full-text regexp tests; score so far=14.409
debug: auto-learn: currently using scoreset 3, recomputing score based on scoreset 1.
debug: auto-learn: message score: 14.409, computed score for autolearn: 9.776
debug: auto-learn? ham=0.1, spam=12, body-points=9.67, head-points=5.687, learned-points=1.886
debug: auto-learn? no: inside auto-learn thresholds, not considered ham or spam
debug: is spam? score=14.409 required=5
debug: tests=BAYES_99,BIZ_TLD,DCC_CHECK,DIGEST_MULTIPLE,HTML_80_90,HTML_IMAGE_ONLY_08,HTML_MESSAGE,MIME_BOUND_NEXTPART,MSGID_FROM_MTA_HEADER,RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_NJABL_SPAM,RCVD_IN_SBL
debug: subtests=__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__HAS_MSGID,__HAS_SUBJECT,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MSGID_BEFORE_RECEIVED,__NEXTPART_ALL,__RCVD_IN_NJABL,__RCVD_IN_SBL_XBL,__RCVD_IN_SORBS,__SANE_MSGID,__SARE_CC_NONE,__SARE_HAS_BG_COLOR,__SARE_HEAD_HDR_RCVD,__SARE_HTML_HAS_A,__SARE_HTML_HAS_FONT,__SARE_HTML_HAS_IMG,__SARE_HTML_HAS_MSG,__SARE_HTML_HAS_P,__SARE_HTML_HAS_TO,__SARE_WHITE_BG_COLOR,__TAG_EXISTS_BODY,__TAG_EXISTS_HTML
Received: from localhost by hn00dmz01.sjc.nl
        with SpamAssassin (version 3.0.1);
        Tue, 26 Oct 2004 10:50:41 +0200
From: Clever Scooter <research@valuate.biz>
To: bestuur@ospylac.com
Subject: Test & Keep a Standing Scooter - Product Evaluators Wanted
Date: Tue, 26 Oct 2004 02:32:29 -0700
Message-Id: <lyyk1.07h3rm4@mx2.valuate.biz>
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on hn00dmz01.sjc.nl
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.4 required=5.0 tests=BAYES_99,BIZ_TLD,DCC_CHECK,
        DIGEST_MULTIPLE,HTML_80_90,HTML_IMAGE_ONLY_08,HTML_MESSAGE,
        MIME_BOUND_NEXTPART,MSGID_FROM_MTA_HEADER,RAZOR2_CF_RANGE_51_100,
        RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_NJABL_SPAM,RCVD_IN_SBL
        autolearn=no version=3.0.1
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_417E0FE1.13A2306E"

This is a multi-part message in MIME format.

------------=_417E0FE1.13A2306E
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Spam detection software, running on the system "hn00dmz01.sjc.nl", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Everything is vague to a degree you do not realize till
  you have tried to make it precise. Bertrand Russell Everything is vague
  to a degree you do not realize till you have tried to make it precise.
  Bertrand Russell [...]

Content analysis details:   (14.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level domain
 0.1 HTML_80_90             BODY: Message is 80% to 90% HTML
 0.0 HTML_MESSAGE           BODY: HTML included in message
 3.0 HTML_IMAGE_ONLY_08     BODY: HTML: images with 400-800 bytes of words
 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
                            [cf: 100]
 1.9 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 2.2 DCC_CHECK              Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                  [Blocked - see <http://www.spamcop.net/bl.shtml?69.6.24.71>]
 0.1 RCVD_IN_SBL            RBL: Received via a relay in Spamhaus SBL
                            [69.6.24.71 listed in sbl-xbl.spamhaus.org]
 1.8 RCVD_IN_NJABL_SPAM     RBL: NJABL: sender is confirmed spam source
                            [69.6.24.71 listed in combined.njabl.org]
 0.1 DIGEST_MULTIPLE        Message hits more than one network digest check
 0.0 MIME_BOUND_NEXTPART    Spam tool pattern in MIME boundary
 0.1 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.


------------=_417E0FE1.13A2306E
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Return-Path: <research@valuate.biz>
X-Original-To: spam@sjc.nl
Delivered-To: sjonker@hn00srv01.sjc.nl
Received: from hn00dmz01.sjc.nl (hn00dmz01.sjc.nl [192.168.253.1])
        by hn00srv01.sjc.nl (SJCMailer) with ESMTP id 8577618014
        for <spam@sjc.nl>; Tue, 26 Oct 2004 10:33:41 +0200 (CEST)
Received: from hn00sia01.sjc.nl (hn00sia01.sjc.nl [192.168.253.254])
        by hn00dmz01.sjc.nl (8.12.11/8.12.11) with ESMTP id i9Q8XXia024995
        for <bestuur@ospylac.com>; Tue, 26 Oct 2004 10:33:33 +0200
Received: from mx2.valuate.biz (mx2.valuate.biz [69.6.24.71])
        by hn00sia01.sjc.nl (SJCMailer) with SMTP id A0E088023
        for <bestuur@ospylac.com>; Tue, 26 Oct 2004 10:33:30 +0200 (CEST)
Date: Tue, 26 Oct 2004 02:32:29 -0700
Message-Id: <lyyk1.07h3rm4@mx2.valuate.biz>
Received: from mx2.valuate.biz [69.6.24.71] by jk271w.mx2.valuate.biz with SMTP; Tue, 26 Oct 2004 02:32:29 -0700
To: bestuur@ospylac.com
Subject: Test & Keep a Standing Scooter - Product Evaluators Wanted
MIME-Version: 1.0
X-Encoding: MIME
Content-Type: multipart/alternative;
        boundary="----=_NextPart_2548111434867620825622456472163"
From: Clever Scooter <research@valuate.biz>

This is a multi-part message in MIME format.

------=_NextPart_2548111434867620825622456472163
Content-Type: text/plain;
        charset="us-ascii"
Content-Transfer-Encoding: 7bit

Everything is vague to a degree you do not realize till you have tried to make it precise.
Bertrand Russell


------=_NextPart_2548111434867620825622456472163
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML>
<BODY bgColor=3D#ffffff>
<TABLE cellSpacing=3D0 cellPadding=3D0 width=3D500 align=3Dcenter border=3D=
0>
    <TR>
    <TD colSpan=3D2><A href=3D"http://www.valuate.biz/red/sc.htm"><IMG
      src=3D"http://www.valuate.biz/red/s1.gif" border=3D0></A></TD></TR>
  <TR>
    <TD><IMG src=3D"http://www.valuate.biz/red/s2.jpg"></TD>
    <TD><IMG src=3D"http://www.valuate.biz/red/s3.gif"></TD></TR>
  <TR>
    <TD colSpan=3D2><A href=3D"http://www.valuate.biz/o/"><IMG
      src=3D"http://www.valuate.biz/red/s4.gif"
border=3D0></A></TD></TR></TABLE></p>

<p align=3D"center"><FONT face=3DArial size=3D1><EM>Everything is vague to =
a degree you do not realize till you have tried to make it precise.
Bertrand Russell</EM></FONT></p>
</BODY>
</HTML>

------=_NextPart_2548111434867620825622456472163--



------------=_417E0FE1.13A2306E--

Spam detection software, running on the system "hn00dmz01.sjc.nl", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  Everything is vague to a degree you do not realize till
  you have tried to make it precise. Bertrand Russell Everything is vague
  to a degree you do not realize till you have tried to make it precise.
  Bertrand Russell [...]

Content analysis details:   (14.4 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 2.3 BIZ_TLD                URI: Contains an URL in the BIZ top-level domain
 0.1 HTML_80_90             BODY: Message is 80% to 90% HTML
 0.0 HTML_MESSAGE           BODY: HTML included in message
 3.0 HTML_IMAGE_ONLY_08     BODY: HTML: images with 400-800 bytes of words
 0.1 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above 50%
                            [cf: 100]
 1.9 BAYES_99               BODY: Bayesian spam probability is 99 to 100%
                            [score: 1.0000]
 1.5 RAZOR2_CHECK           Listed in Razor2 (http://razor.sf.net/)
 2.2 DCC_CHECK              Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                  [Blocked - see <http://www.spamcop.net/bl.shtml?69.6.24.71>]
 0.1 RCVD_IN_SBL            RBL: Received via a relay in Spamhaus SBL
                            [69.6.24.71 listed in sbl-xbl.spamhaus.org]
 1.8 RCVD_IN_NJABL_SPAM     RBL: NJABL: sender is confirmed spam source
                            [69.6.24.71 listed in combined.njabl.org]
 0.1 DIGEST_MULTIPLE        Message hits more than one network digest check
 0.0 MIME_BOUND_NEXTPART    Spam tool pattern in MIME boundary
 0.1 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 3: "Attached Text" ]

debug: SpamAssassin version 3.0.1
debug: Score set 0 chosen.
debug: running in taint mode? yes
debug: Running in taint mode, removing unsafe env vars, and resetting PATH
debug: PATH included '/usr/kerberos/sbin', keeping.
debug: PATH included '/usr/kerberos/bin', keeping.
debug: PATH included '/usr/local/sbin', keeping.
debug: PATH included '/usr/local/bin', keeping.
debug: PATH included '/sbin', keeping.
debug: PATH included '/bin', keeping.
debug: PATH included '/usr/sbin', keeping.
debug: PATH included '/usr/bin', keeping.
debug: PATH included '/usr/X11R6/bin', keeping.
debug: PATH included '/root/bin', which doesn't exist, dropping.
debug: Final PATH set to: /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin
debug: diag: module installed: DBI, version 1.40
debug: diag: module installed: DB_File, version 1.808
debug: diag: module installed: Digest::SHA1, version 2.10
debug: diag: module installed: IO::Socket::UNIX, version 1.21
debug: diag: module installed: MIME::Base64, version 3.03
debug: diag: module installed: Net::DNS, version 0.48
debug: diag: module installed: Net::LDAP, version 0.32
debug: diag: module installed: Razor2::Client::Agent, version 2.61
debug: diag: module installed: Storable, version 2.09
debug: diag: module installed: URI, version 1.34
debug: ignore: using a test message to lint rules
debug: using "/usr/share/spamassassin" for default rules dir
debug: config: read file /usr/share/spamassassin/10_misc.cf
debug: config: read file /usr/share/spamassassin/20_anti_ratware.cf
debug: config: read file /usr/share/spamassassin/20_body_tests.cf
debug: config: read file /usr/share/spamassassin/20_compensate.cf
debug: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
debug: config: read file /usr/share/spamassassin/20_drugs.cf
debug: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
debug: config: read file /usr/share/spamassassin/20_head_tests.cf
debug: config: read file /usr/share/spamassassin/20_html_tests.cf
debug: config: read file /usr/share/spamassassin/20_meta_tests.cf
debug: config: read file /usr/share/spamassassin/20_phrases.cf
debug: config: read file /usr/share/spamassassin/20_porn.cf
debug: config: read file /usr/share/spamassassin/20_ratware.cf
debug: config: read file /usr/share/spamassassin/20_uri_tests.cf
debug: config: read file /usr/share/spamassassin/23_bayes.cf
debug: config: read file /usr/share/spamassassin/25_body_tests_es.cf
debug: config: read file /usr/share/spamassassin/25_hashcash.cf
debug: config: read file /usr/share/spamassassin/25_spf.cf
debug: config: read file /usr/share/spamassassin/25_uribl.cf
debug: config: read file /usr/share/spamassassin/30_text_de.cf
debug: config: read file /usr/share/spamassassin/30_text_fr.cf
debug: config: read file /usr/share/spamassassin/30_text_nl.cf
debug: config: read file /usr/share/spamassassin/30_text_pl.cf
debug: config: read file /usr/share/spamassassin/50_scores.cf
debug: config: read file /usr/share/spamassassin/60_whitelist.cf
debug: using "/etc/mail/spamassassin" for site rules dir
debug: config: read file /etc/mail/spamassassin/70_sare_adult.cf
debug: config: read file /etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf
debug: config: read file /etc/mail/spamassassin/70_sare_header.cf
debug: config: read file /etc/mail/spamassassin/70_sare_html.cf
debug: config: read file /etc/mail/spamassassin/70_sare_oem.cf
debug: config: read file /etc/mail/spamassassin/70_sare_random.cf
debug: config: read file /etc/mail/spamassassin/70_sare_ratware.cf
debug: config: read file /etc/mail/spamassassin/70_sare_specific.cf
debug: config: read file /etc/mail/spamassassin/70_sare_spoof.cf
debug: config: read file /etc/mail/spamassassin/72_sare_bml_post25x.cf
debug: config: read file /etc/mail/spamassassin/72_sare_redirect_post3.0.0.cf
debug: config: read file /etc/mail/spamassassin/99_sare_fraud_post25x.cf
debug: config: read file /etc/mail/spamassassin/antidrug.cf
debug: config: read file /etc/mail/spamassassin/bogus-virus-warnings.cf
debug: config: read file /etc/mail/spamassassin/evilnumbers.cf
debug: config: read file /etc/mail/spamassassin/local.cf
debug: config: read file /etc/mail/spamassassin/random.cf
debug: config: read file /etc/mail/spamassassin/tripwire.cf
debug: using "/root/.spamassassin" for user state dir
debug: using "/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file
debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf
debug: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c)
debug: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
debug: plugin: registered Mail::SpamAssassin::Plugin::SPF=HASH(0xac5ca24)
debug: bayes: 25675 tie-ing to DB file R/O /var/spool/spamassassin/bayes_toks
debug: bayes: 25675 tie-ing to DB file R/O /var/spool/spamassassin/bayes_seen
debug: bayes: found bayes db version 3
debug: Score set 3 chosen.
debug: ---- MIME PARSER START ----
debug: main message type: text/plain
debug: parsing normal part
debug: added part, type: text/plain
debug: ---- MIME PARSER END ----
debug: metadata: X-Spam-Relays-Trusted:
debug: metadata: X-Spam-Relays-Untrusted:
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c) implements 'parsed_metadata'
debug: dns_available set to yes in config file, skipping test
debug: decoding: no encoding detected
debug: URIDNSBL: domains to query:
debug: is Net::DNS::Resolver available? yes
debug: Net::DNS version: 0.48
debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org
debug: Running tests for priority: 0
debug: running header regexp tests; score so far=0
debug: all '*To' addrs:
debug: running body-text per-line regexp tests; score so far=0.126
debug: running uri tests; score so far=0.126
debug: bayes corpus size: nspam = 1331, nham = 3081
debug: tokenize: header tokens for *F = "U*ignore D*compiling.spamassassin.taint.org D*spamassassin.taint.org D*taint.org D*org"
debug: tokenize: header tokens for *m = "  1098780229 lint_rules "
debug: tokenize: header tokens for *RT = " "
debug: tokenize: header tokens for *RU = " "
debug: bayes token 'H*Ad:D*org' => 0.000542885973763875
debug: bayes: score = 0.349432821046719
debug: bayes: 25675 untie-ing
debug: bayes: 25675 untie-ing db_toks
debug: bayes: 25675 untie-ing db_seen
debug: Razor2 is available
debug: entering helper-app run mode
 Razor-Log: Computed razorhome from env: /root/.razor
 Razor-Log: Found razorhome: /root/.razor
 Razor-Log: read_file: 16 items read from /root/.razor/razor-agent.conf
Oct 26 10:43:51.022459 check[25675]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout
Oct 26 10:43:51.022868 check[25675]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity-rumJH0SFB6
Oct 26 10:43:51.023042 check[25675]: [ 8] Client supported_engines: 4 8
Oct 26 10:43:51.023341 check[25675]: [ 8]  prep_mail done: mail 1 headers=93, mime0=1376
Oct 26 10:43:51.023622 check[25675]: [ 5] read_file: 1 items read from /root/.razor/servers.discovery.lst
Oct 26 10:43:51.023881 check[25675]: [ 5] read_file: 2 items read from /root/.razor/servers.nomination.lst
Oct 26 10:43:51.024155 check[25675]: [ 5] read_file: 3 items read from /root/.razor/servers.catalogue.lst
Oct 26 10:43:51.024432 check[25675]: [ 9] Assigning defaults to folly.cloudmark.com
Oct 26 10:43:51.024597 check[25675]: [ 9] Assigning defaults to joy.cloudmark.com
Oct 26 10:43:51.024761 check[25675]: [ 9] Assigning defaults to pride.cloudmark.com
Oct 26 10:43:51.024924 check[25675]: [ 9] Assigning defaults to thrill.cloudmark.com
Oct 26 10:43:51.025086 check[25675]: [ 9] Assigning defaults to wonder.cloudmark.com
Oct 26 10:43:51.025851 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:43:51.026357 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.pride.cloudmark.com.conf
Oct 26 10:43:51.026801 check[25675]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:43:51.027230 check[25675]: [ 5] read_file: 13 items read from /root/.razor/server.folly.cloudmark.com.conf
Oct 26 10:43:51.027697 check[25675]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:43:51.028151 check[25675]: [ 5] read_file: 14 items read from /root/.razor/server.joy.cloudmark.com.conf
Oct 26 10:43:51.028657 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:43:51.029149 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.wonder.cloudmark.com.conf
Oct 26 10:43:51.029656 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:43:51.030142 check[25675]: [ 5] read_file: 16 items read from /root/.razor/server.thrill.cloudmark.com.conf
Oct 26 10:43:51.030335 check[25675]: [ 5] 106445 seconds before closest server discovery
Oct 26 10:43:51.030505 check[25675]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:43:51.030668 check[25675]: [ 8] Computed supported_engines: 4 8
Oct 26 10:43:51.030798 check[25675]: [ 8] Using next closest server pride.cloudmark.com:2703, cached info srl 5047
Oct 26 10:43:51.030913 check[25675]: [ 8] mail 1 has no subject
Oct 26 10:43:51.031172 check[25675]: [ 6] preproc: mail 1.0 went from 1376 bytes to 1339
Oct 26 10:43:51.031311 check[25675]: [ 6] computing sigs for mail 1.0, len 1339
Oct 26 10:43:51.032462 check[25675]: [ 6] Engine (8) didn't produce a signature for mail 1.0
Oct 26 10:43:51.032643 check[25675]: [ 6] skipping whitelist file (empty?): /root/.razor/razor-whitelist
Oct 26 10:43:51.032766 check[25675]: [ 5] Connecting to pride.cloudmark.com ...
Oct 26 10:43:51.362553 check[25675]: [ 8] Connection established
Oct 26 10:43:51.362717 check[25675]: [ 4] pride.cloudmark.com >> 36 server greeting: sn=C&srl=5047&a=l&a=cg&ep4=7542-10
Oct 26 10:43:51.363044 check[25675]: [ 4] pride.cloudmark.com << 25
Oct 26 10:43:51.363126 check[25675]: [ 6] cn=razor-agents&cv=2.61
Oct 26 10:43:51.363350 check[25675]: [ 6] pride.cloudmark.com is a Catalogue Server srl 5047; computed min_cf=6, Server se: C8
Oct 26 10:43:51.363529 check[25675]: [ 8] Computed supported_engines: 4 8
Oct 26 10:43:51.363675 check[25675]: [ 8] mail 1.0 e4 sig: xFaZIZUVHk90OQfARnenjx5BZTMA
Oct 26 10:43:51.363810 check[25675]: [ 5] mail 1.0 e8 got no sig
Oct 26 10:43:51.363929 check[25675]: [ 8] preparing 1 queries
Oct 26 10:43:51.364105 check[25675]: [ 8] sending 1 batches
Oct 26 10:43:51.364255 check[25675]: [ 4] pride.cloudmark.com << 52
Oct 26 10:43:51.364332 check[25675]: [ 6] a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA
Oct 26 10:43:51.803059 check[25675]: [ 4] pride.cloudmark.com >> 5
Oct 26 10:43:51.803156 check[25675]: [ 6] response to sent.2
p=0
Oct 26 10:43:51.803490 check[25675]: [ 6] mail 1.0 e=4 sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found.
Oct 26 10:43:51.803606 check[25675]: [ 7] method 4: mail 1.0: no-contention part, spam=0
Oct 26 10:43:51.803702 check[25675]: [ 7] method 4: mail 1: all non-contention parts not spam, mail not spam
Oct 26 10:43:51.803795 check[25675]: [ 3] mail 1 is not known spam.
Oct 26 10:43:51.803899 check[25675]: [ 5] disconnecting from server pride.cloudmark.com
Oct 26 10:43:51.804067 check[25675]: [ 4] pride.cloudmark.com << 5
Oct 26 10:43:51.804143 check[25675]: [ 6] a=q
debug: Using results from Razor v2.61
debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0
debug: leaving helper-app run mode
debug: Razor2 results: spam? 0  highest cf score: 0
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c) implements 'check_tick'
debug: running raw-body-text per-line regexp tests; score so far=-0.97
debug: running full-text regexp tests; score so far=-0.97
debug: Razor2 is available
debug: Pyzor is available: /usr/bin/pyzor
debug: entering helper-app run mode
debug: setuid: helper proc 25676: ruid=0 euid=0
debug: Pyzor: got response: 217.160.253.84:24441        TimeoutError:
debug: leaving helper-app run mode
debug: Pyzor: couldn't grok response "217.160.253.84:24441      TimeoutError: "
debug: DCCifd is not available: no r/w dccifd socket found.
debug: DCC is available: /usr/local/bin/dccproc
debug: entering helper-app run mode
debug: setuid: helper proc 25687: ruid=0 euid=0
debug: DCC: got response: X-DCC-sgs_public_dcc_server-Metrics: hn00dmz01.sjc.nl 1199; Body=22198 Fuz1=1519921 Fuz2=1518922
debug: leaving helper-app run mode
debug: DCC: Listed! BODY: 22198 of 999999 FUZ1: 1519921 of 999999 FUZ2: 1518922 of 999999
debug: Running tests for priority: 500
debug: RBL: success for 1 of 1 queries
debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0xac5b62c) implements 'check_post_dnsbl'
debug: running meta tests; score so far=1.199
debug: running header regexp tests; score so far=2.916
debug: running body-text per-line regexp tests; score so far=2.916
debug: running uri tests; score so far=2.916
debug: running raw-body-text per-line regexp tests; score so far=2.916
debug: running full-text regexp tests; score so far=2.916
debug: Running tests for priority: 1000
debug: running meta tests; score so far=2.916
debug: running header regexp tests; score so far=2.916
debug: running body-text per-line regexp tests; score so far=2.916
debug: running uri tests; score so far=2.916
debug: running raw-body-text per-line regexp tests; score so far=2.916
debug: running full-text regexp tests; score so far=2.916
debug: is spam? score=2.916 required=5
debug: tests=BAYES_40,DCC_CHECK,MISSING_HEADERS,MISSING_SUBJECT,NO_REAL_NAME,SARE_TOCC_NONE
debug: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__SARE_CC_NONE,__SARE_HTML_HAS_MSG,__SARE_TO_NONE,__UNUSABLE_MSGID

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Tue Oct 26 17:07:59 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.3953.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On 26/10/04 4:52 pm, "David Lee" <t.d.lee@DURHAM.AC.UK> wrote:

> On Tue, 26 Oct 2004, Julian Field wrote:
> 
>> On 26/10/04 12:41 pm, "Daniel Gercke" <gercke@HNM.DE> wrote:
>> 
>>> <x-flowed>
>>> Hello all,
>>> 
>>> i want to update from 4.28.5-2 to the current stable release. Are there
>>> any hints that i musst know to update without runnings into Problems?
>>> I´m using PRM Version.
>> 
>> I would advise you wait for the 1st November 4.35 stable release. 4.34 was a
>> bit bumpy...
> 
> Julian:  Also, I recall that the recent weeks have seen many changes and
> interaction issues with other software.  From memory, I recall:
>    SA 3.0 code
>    SA 3.0 rulesets
>    clamav 0.80 release
>    perl modules (MS v. rpm v. CPAN)
>    (and probably others)
> 
> Are all these products still independent across their versions?  Or does
> upgrading to the latest version of product X (MS, SA, clamav, ...)
> _require_ upgrading another product Y (same set ...)?
> 
> When you do the 4.35 stable release, it might be helpful to outline any
> known inter-relationship lock-step issues.

I have dropped support for Mail::ClamAV 0.11 and ClamAV 0.75 if you are
using "clamavmodule". ClamAV 0.75 will still work if you use
    Virus Scanners = clamav
But not if you use
    Virus Scanners = clamavmodule

-- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Tue Oct 26 15:51:32 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3954.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This process did not create clamav-db rpm... Why is that?

----- Original Message -----
From: "Dhawal Doshy" <dhawal@NETMAGICSOLUTIONS.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 26, 2004 12:55 PM
Subject: Re: Clamav RPMs


> Roger Jochem wrote:
> > Hello!
> >
> > Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
> > usualy was getting these rpms at http://dag.wieers.com/packages/clamav/,
but
> > the last version there is 0.75-1-1.
>
> This will work:
> http://filelister.linux-kernel.at/?current=/packages/SRPMS/
>
> Download 'clamav-0.80-1.src.rpm' and run 'rpmbuild --rebuild
> clamav-0.80-1.src.rpm'
>
> - dhawal
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hans at ENEM.NL  Tue Oct 26 17:04:39 2004
From: hans at ENEM.NL (Hans Melgers)
Date: Thu Jan 12 21:27:23 2006
Subject: update_virus_scanners
Message-ID: <mailman.3955.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Is your path ok ?
Try adding a path statement in the script, something like

# could be needed for cron
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin

Hans

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Filchak
> Sent: dinsdag 26 oktober 2004 16:38
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: update_virus_scanners
>
>
> Permissions on /tmp are right:
>
> stat /tmp
>   File: `/tmp'
>   Size: 11264           Blocks: 22         IO Block: 4096   Directory
> Device: 801h/2049d      Inode: 2           Links: 11
> Access: (1777/drwxrwxrwt)  Uid: (    0/    root)   Gid: (
> 0/    root)
> Access: 2004-10-26 09:15:24.000000000 -0400
> Modify: 2004-10-26 10:33:16.000000000 -0400
> Change: 2004-10-26 10:33:16.000000000 -0400
>
> And  perl -w /usr/lib/MailScanner/clamav-autoupdate shows no errors.
>
> Dave
>
> -----Original Message-----
> From: David Jacobson [mailto:davidj@synaq.com]
> Sent: Tuesday, October 26, 2004 10:03 AM
> To: dfilchak@sympatico.ca
> Cc: MAILSCANNER@JISCMAIL.AC.UK
> Subject: RE: update_virus_scanners
>
> Hi,
>
> Does "perl -w /usr/lib/MailScanner/clamav-autoupdate" show any errors?
>
> Also what are your /tmp directory permissions? (Should be
> 1777) you can see this by issuing "stat /tmp"
>
>
> On Tue, 2004-10-26 at 15:10, Dave Filchak wrote:
> > Thanks for your reply. Tried what you suggested and really
> cannot see
> > anything weird. It finds ClamAV installed and finds generic
> installed
> > but nothing else, which is normal.
> >
> > + SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
> > + LOCKFILE=/tmp/MailScanner.autoupdate.lock
> > ++ perl -e 'print "young" if -f
> "/tmp/MailScanner.autoupdate.lock" &&
> > ++ -M
> > "/tmp/MailScanner.autoupdate.lock"<0.042'
> > + '[' x = xyoung ']'
> > + trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT touch
> > + /tmp/MailScanner.autoupdate.lock umask 022
> > ++ uname
> > + OS=Linux
> > + '[' Linux = SunOS ']'
> > + GREP=grep
> > + cat /etc/MailScanner/virus.scanners.conf
> > + sed -e 's/#.*$//'
> > + grep -e -wrapper
> >
> > <SNIP>
> >
> > + read NAME WRAPPER PACKAGEDIR
> > ++ echo /usr/lib/MailScanner/clamav-wrapper
> > ++ sed -e 's/-wrapper$/-autoupdate/'
> > + UPDATER=/usr/lib/MailScanner/clamav-autoupdate
> > + '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper
> -a -n /usr ']'
> > + /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled logger -p
> > + mail.info -t update.virus.scanners Found clamav installed '[' -x
> > + /usr/lib/MailScanner/clamav-autoupdate ']'
> > + logger -p mail.info -t update.virus.scanners Running
> autoupdate for
> > + clamav /usr/lib/MailScanner/clamav-autoupdate /usr
> >
> > <SNIP>
> >
> > + read NAME WRAPPER PACKAGEDIR
> > ++ echo /usr/lib/MailScanner/generic-wrapper
> > ++ sed -e 's/-wrapper$/-autoupdate/'
> > + UPDATER=/usr/lib/MailScanner/generic-autoupdate
> > + '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper
> -a -n / ']'
> > + /usr/lib/MailScanner/generic-wrapper / -IsItInstalled logger -p
> > + mail.info -t update.virus.scanners Found generic installed '[' -x
> > + /usr/lib/MailScanner/generic-autoupdate ']'
> > + logger -p mail.info -t update.virus.scanners Running
> autoupdate for
> > generic
> > + /usr/lib/MailScanner/generic-autoupdate /
> >
> > I have edited out the non-pertinent portions. So, as far as I can
> > tell, this part seems fine. The only thing might be the
> lockfile. I do
> > not see this being created when this is run but it is hard to tell.
> >
> > Any other ideas??
> >
> > Dave
> >
> > -----Original Message-----
> > From: David Jacobson [mailto:davidj@synaq.com]
> > Sent: Tuesday, October 26, 2004 2:49 AM
> > To: dfilchak@sympatico.ca
> > Subject: Re: update_virus_scanners
> >
> > Hi,
> >
> > Perhaps try appending -x to the end of the #!/bin/bash line in
> > /usr/sbin/update_virus_scanners and look for any glaring errors.
> >
> > On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> > > OK .. I have managed to confuse the hell out of myself and really
> > > could use someone to put me out of my misery. I have just updated
> > > one of my servers to Mail::ClamAV 0.12 and MailScanner
> 4.35.5. After
> > > a bit of fiddling that went OK. However, while I was
> doing that, I
> > > decided to again tackle the update_virus_scanners issue I
> have been
> > > having in that I keep getting an error like the following
> when I run
> > > or cron runs
> > update_virus_scanners:
> > >
> > > Oct 26 00:00:21 ebony update.virus.scanners: Found clamav
> installed
> > > Oct 26 00:00:21 ebony update.virus.scanners: Running
> autoupdate for
> > > clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV
> > > updater failed
> > >
> > > However, if I run freshclam -v I get:
> > >
> > > Current working dir is /usr/local/share/clamav Max retries == 3
> > > ClamAV update process started at Tue Oct 26 00:01:13 2004
> Connected
> > > to database.clamav.net (65.110.48.11).
> > > Reading CVD header (main.cvd): OK
> > > main.cvd is up to date (version: 27, sigs: 23982,
> f-level: 2, builder:
> > > tomek)
> > > Connected to database.clamav.net (65.110.48.11).
> > > Reading CVD header (daily.cvd): OK
> > > daily.cvd is up to date (version: 550, sigs: 1607,
> f-level: 3, builder:
> > > trog)
> > > Freeing option list...done
> > >
> > > Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> > >
> > > Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV
> did not need
> > > updating
> > >
> > > in my maillog. Also, in clamav-autoupdate, I have changed the log
> > > directory to /var/log/clamav/ClamAV.update.log and in there I get:
> > >
> > > ClamAV update process started at Tue Oct 26 00:03:28 2004
> main.cvd
> > > is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > > tomek)
> > > daily.cvd is up to date (version: 550, sigs: 1607,
> f-level: 3, builder:
> > > trog)
> > >
> > > So, apparently /etc/cron.hourly/update_virus_scanners if
> not working
> > > and also apparently, I am too dull to figure out why.
> > >
> > > Can someone PLEASE help me out and tell me what they
> think is going
> > > on
> > here?
> > > I know it is probably stupid of me but sometimes you just gotta
> > > throw your hands in the air and yell for help.
> > >
> > > Dave
> > >
> > > ------------------------ MailScanner list
> ------------------------
> > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > 'leave mailscanner' in the body of the email.
> > > Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and
> > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > --
> > Regards,
> >
> > David Jacobson
> > Technical Director
> > SYNAQ (Pty) Ltd
> >
> > Tel:  011 290 6388
> > Cell: 083 235 0760
> > Mail: davidj@synaq.com
> > WWW:  http://www.synaq.com
> >
> > Key Fingerprint
> > 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
> --
> Regards,
>
> David Jacobson
> Technical Director
> SYNAQ (Pty) Ltd
>
> Tel:    011 290 6388
> Cell:   083 235 0760
> Mail:   davidj@synaq.com
> WWW:    http://www.synaq.com
>
> Key Fingerprint
> 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Tue Oct 26 17:06:02 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3956.1137101243.24926.mailscanner@lists.mailscanner.info>

At 07:34 AM 10/26/2004, David Hooton wrote:
>There are quite a lot of legitimate reasons for footers to be added to
>all in/outbound mail.  There is also a very valid reason why you would
>only want the footer once.

I'll accept that statement, but only if you can name at least one good
reason. If there are quite a lot, this shouldn't be hard.

I for one see no valid reasons for the feature.

I can see several reasons, but none seem motivating for Julian to do it for
free:

         Mailing List packages already do their own
         AV sigs should be per-message
         Disclaimers are stupid
         Advertisements are naturally commercial in nature and should fund
their own tool development.
         Inserting a company logo to the bottom of all mail is not much
better than disclaimers, and I'd consider it an advert.

Any I missed?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Tue Oct 26 17:00:34 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3957.1137101243.24926.mailscanner@lists.mailscanner.info>

At 09:01 PM 10/25/2004, Marco Benton wrote:
>alot of companies use the <...barf...> disclaimers and MailScanner has
>an easy way to add it, although not what inteded for.  not every company
>has gurus and pointy-haired managers want certain things even tho they
>dont make sense.  but is it right to *not* add that feature because of
>l-users?

IMO, yes, but I think so because the feature only serves l-users.

If there was a redeeming value to it beyond lusers, I'd say add it. But it
doesn't. It only serves those adding clueless disclaimers to their mail. It
doesn't aid those using the feature for virus sigs. It doesn't aid mailing
lists because mailing list management packages have their own signature
tools. It really doesn't aid anyone in a useful valid way.

I'll leave it up to Julian, but quite frankly I think it's a waste of his
time to implement a feature that does the internet community as a whole a
great disservice, and only serves to comfort clueless PHBs.

If the PHBs want disclaimers, fine, but I don't think they should get that
for free from Julian.

There's plenty of other useful things for him to be doing.. Like enjoying a
pint of ale/glass of wine/ beverage of choice :)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Tue Oct 26 17:32:05 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3958.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Kevin Miller wrote:

 Venkata Achanta wrote:
  

 if someone sends out a e-mail and get a repsonse and if he responds
again the disclaimer is getting attached again.if this happens X
number of times we end up having disclaimer attached X number of
time as well which looks ugly(better than spam though :-)) )

      

 The problem here isn't MailScanner - it's people too lazy to edit their
responses.  Every time a reply is generated, you get a ">" in front of the
previous text, including the disclaimers.  Just delete the text that isn't
relivant.

I suppose this is an outgrowth of top-posting where people no longer deal
w/the full body of email.  Still, it's silly to blame the MTA when it's the
email client and user that's to blame.

However, the way email is supposed to work, is that one can define a
signature such that it isn't included in replies by seperating it from the
body of the message with two dashes and a space (such as under "...Kevin"
below).  A reasonably modern email client will not include anything below
that in a reply.  Therefore, if you edited the disclaimer and delimited it
with a line containing "-- " (sans quotes) before anything else, then it
shouldn't be included when you reply...

...Kevin
  

i dont think anyone is blaming the MTA, the original poster is kind of
asking for a new feature.

depending on how this would be implemented, it can be painfully easy or a
coding nightmare to assume the sender's email client and how it encaps
the reply body.  i say the more features the better, despite how
fallacious they can be.

of course this can be put into the same category as to bounce spam or
not...

 --

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #94: The cause of the problem is: Pentium FDIV bug

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From SJCJonker at SJC.NL  Tue Oct 26 17:19:05 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3959.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Scott,

Thanks this fixed it, I'll do some more testing and remove it from
local.cf and/or /etc/MailScanner/spam.assassin.prefs.conf and will post
the results.

And offcourse add a faq item ;-)

Thanks
Stijn

Scott Silva said the following on 26-Oct-04 17:30:
> <<Snip>>
> |> But whatever I do i don't see any hits on the rules with URIBL/SURBL and
> |> or SPF. Although I couldn't find it back in the list I believe i need
> |> the latest beta for SPF support, but URIBL should work.
> |>
> |> I check some of the spam only minutes after they where received on
> |> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
> |> listed in one or more lists.
> |>
> |> The only rule scoring I modified in local.cf is:
> |> score ALL_TRUSTED 0
> |
> |
> | What does a SA --lint tell you ?
> |
> |> Is there somebody who can offer some adivce on how to troubleshoot
> |> and/or find the culprit for this?
> Check to see if you have a "/etc/mail/spamassassin/init.pre" You might
> find it instead in "/usr/etc/mail/spamassassin/init.pre". Copy (or link
> might work) to /etc/mail/spamassassin and restart MailScanner just to be
> safe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Tue Oct 26 17:59:41 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3960.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:

> At 09:01 PM 10/25/2004, Marco Benton wrote:
>
>> alot of companies use the <...barf...> disclaimers and MailScanner has
>> an easy way to add it, although not what inteded for.  not every company
>> has gurus and pointy-haired managers want certain things even tho they
>> dont make sense.  but is it right to *not* add that feature because of
>> l-users?
>
>
> IMO, yes, but I think so because the feature only serves l-users.
>
> If there was a redeeming value to it beyond lusers, I'd say add it.
> But it
> doesn't. It only serves those adding clueless disclaimers to their
> mail. It
> doesn't aid those using the feature for virus sigs. It doesn't aid
> mailing
> lists because mailing list management packages have their own signature
> tools. It really doesn't aid anyone in a useful valid way.
>
> I'll leave it up to Julian, but quite frankly I think it's a waste of his
> time to implement a feature that does the internet community as a whole a
> great disservice, and only serves to comfort clueless PHBs.
>
> If the PHBs want disclaimers, fine, but I don't think they should get
> that
> for free from Julian.
>
> There's plenty of other useful things for him to be doing.. Like
> enjoying a
> pint of ale/glass of wine/ beverage of choice :)
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


i do agree.  i'm just playing the role of the l-users and pointy-haired
managers.

if Julian does decide to do this in a fully compatible way, it *will* be
painfull!  i remember writing that disclaimer milter and having to deal
with  email clients that didnt fully comply with MIME standards...never
mind the raw message bodies that came from brain-dead MTA's or email
clients (most likely spammer servers).

as long as he enjoys the good stuff and not a pint of stomach burning
acid made in the backyard.  ;-)

--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #306: The cause of the problem is: emissions from GSM-phones

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Oct 26 16:05:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3961.1137101243.24926.mailscanner@lists.mailscanner.info>

There are clamav-0.80 rpms in my ClamAV and SA distribution in the "Other
stuff" bit of the downloads page on www.mailscanner.info.


On 26/10/04 2:40 pm, "Roger Jochem" <roger@RUDNICK.COM.BR> wrote:

> Hello!
>
> Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
> usualy was getting these rpms at http://dag.wieers.com/packages/clamav/, but
> the last version there is 0.75-1-1.
>
> Regards
>
> Roger Jochem
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From sanjay.patel at REXWIRE.COM  Tue Oct 26 18:15:06 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:27:23 2006
Subject: Individual black and white listing
Message-ID: <mailman.3962.1137101243.24926.mailscanner@lists.mailscanner.info>

Is it possible for individuals to have their own black list and white list.
In this scenario someone can blacklist a sender while another has that
sender whitelisted.

I saw this functionality in a commercial product and figured it would be a
great function to have.

-SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From campbell at cnpapers.com  Tue Oct 26 18:27:30 2004
From: campbell at cnpapers.com (Steve Campbell)
Date: Thu Jan 12 21:27:23 2006
Subject: Individual black and white listing
Message-ID: <mailman.3963.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This question seems to creep up a lot of times on the list. The answer
always seems to be more complicated that it really is (or else too simple
like "Check the archives")

Wouldn't the "From xxx and To:xxx" type of rule in the blacklist take care
of most of this individuality? Correct me if I'm wrong.

Steve Campbell
campbell@cnpapers.com
Charleston Newspapers

----- Original Message -----
From: "Sanjay K. Patel" <sanjay.patel@REXWIRE.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 26, 2004 1:15 PM
Subject: Individual black and white listing


> Is it possible for individuals to have their own black list and white
list.
> In this scenario someone can blacklist a sender while another has that
> sender whitelisted.
>
> I saw this functionality in a commercial product and figured it would be a
> great function to have.
>
> -SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From vlad at MAZEK.COM  Tue Oct 26 18:32:34 2004
From: vlad at MAZEK.COM (Vlad Mazek)
Date: Thu Jan 12 21:27:23 2006
Subject: Individual black and white listing
Message-ID: <mailman.3964.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Sanjay K. Patel wrote:

 Is it possible for individuals to have their own black list and white list.
In this scenario someone can blacklist a sender while another has that
sender whitelisted.

I saw this functionality in a commercial product and figured it would be a
great function to have.
  

It is possible, all you have to do is edit your
%etc%/rules/spam.whitelist.rules and add a rule that says
From: user@domain.tld and To: localuser@localdomain.tld

You can use the same type of an entry in the blacklist rule file.

Note: I have *never* been able to get this to work but documentation
implies that its possible. Make sure you set Always Include SpamAssassin
Report = no

-Vlad Mazek
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From Kevin_Miller at CI.JUNEAU.AK.US  Tue Oct 26 18:21:12 2004
From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3965.1137101243.24926.mailscanner@lists.mailscanner.info>

>i dont think anyone is blaming the MTA, the original poster is kind of
asking
>for a new feature.

Well, maybe "blame" isn't exactly the right word but I don't know what else
to use.
English is only my first language. ;-)

But my point was, that the OP was looking for a fix at the MTA level
(loosely defining MS as part of the MTA here) whereas the real problem lies
with top posting and HTML posts which don't follow the RFCs.  In our shop we
call that a "Layer 8" issue.  I.e., a user problem, not a technical one.
YMMV.

>depending on how this would be implemented, it can be painfully easy or a
coding
>nightmare to assume the sender's email client and how it encaps the reply
body.
>i say the more features the better, despite how fallacious they can be.

It's as simple as using a standards based email client, posting in text with
a standards complient footer, editing your post and not top posting.  Of
course, many folks will do otherwise, but hey, you make the bed you sleep
in.

>of course this can be put into the same category as to bounce spam or
not...

Ayup.  Kind of borderline between discussing potential new features that
would be useful in MS (on-topic), and quibbling over theological issues that
in the grand scheme of things don't amount to a hill of beans (kill the
thread).  In my previous post I offered a potential workaround that should
be OK if people follow standards.  If they don't want to do it by the book,
then I'd be disinclined to add the feature if I were Julian, but I'm not so
if he and others see some value in going to the trouble of adding it then
live it up.  I just think it's worthwhile to properly identify where the
problem really lies.  Often 10 minutes of user training is more helpful than
10 hours of coding...

...Kevin
--
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Tue Oct 26 17:34:42 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3966.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

In this directory there is also no clamav-db-0.80. Does version 0.80 not
uses clamav-db anymore?

----- Original Message -----
From: "Julian Field" <mailscanner@ECS.SOTON.AC.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 26, 2004 1:05 PM
Subject: Re: Clamav RPMs


> There are clamav-0.80 rpms in my ClamAV and SA distribution in the "Other
> stuff" bit of the downloads page on www.mailscanner.info.
>
>
> On 26/10/04 2:40 pm, "Roger Jochem" <roger@RUDNICK.COM.BR> wrote:
>
> > Hello!
> >
> > Is there any place where I could find the clamav-0.80 rpms for RHEL 3? I
> > usualy was getting these rpms at http://dag.wieers.com/packages/clamav/,
but
> > the last version there is 0.75-1-1.
> >
> > Regards
> >
> > Roger Jochem
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gerrym at FUTUREMETALS.COM  Tue Oct 26 17:17:36 2004
From: gerrym at FUTUREMETALS.COM (Gerry Maddock)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3967.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
running on  a fully updated Fedora Core 2 system running
sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
Outlook to compose emails in HTML format's emails come back looking
strange like this:

This is a multi-part message in MIME format.

------=_NextPart_000_0053_01C4BB54.0ABCAA40
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

test
------=_NextPart_000_0053_01C4BB54.0ABCAA40
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
<BODY><STRONG><EM><U><FONT face=3DArial=20
size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>

------=_NextPart_000_0053_01C4BB54.0ABCAA40--


Any email sent to us in html format comes back looking like that. I have
attached my MailScanner.conf as well. Any help would be greatly
appreciated!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
    [ Part 2, Application/OCTET-STREAM (Name: "MailScanner.conf")  96KB. ]
    [ Unable to print this part. ]


From peter at UCGBOOK.COM  Tue Oct 26 18:49:06 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3968.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Roger Jochem wrote:
> In this directory there is also no clamav-db-0.80. Does version 0.80 not
> uses clamav-db anymore?

That's just up to how the package builder designed it. Some divide it
into small packages where you add on the db and clamd and the milter
part and so on. Some just add it all in one package. Just do "rpm -ql"
to find out what you got. Clamav-db should contain little more than
signature files. If you got those with the single package you're fine.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Tue Oct 26 17:43:57 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3969.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thanks for the answer!!

----- Original Message -----
From: "Peter Bonivart" <peter@UCGBOOK.COM>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Tuesday, October 26, 2004 3:49 PM
Subject: Re: Clamav RPMs


> Roger Jochem wrote:
> > In this directory there is also no clamav-db-0.80. Does version 0.80 not
> > uses clamav-db anymore?
>
> That's just up to how the package builder designed it. Some divide it
> into small packages where you add on the db and clamd and the milter
> part and so on. Some just add it all in one package. Just do "rpm -ql"
> to find out what you got. Clamav-db should contain little more than
> signature files. If you got those with the single package you're fine.
>
> --
> /Peter Bonivart
>
> --Unix lovers do it in the Sun
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Tue Oct 26 18:52:25 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:23 2006
Subject: update_virus_scanners
Message-ID: <mailman.3970.1137101243.24926.mailscanner@lists.mailscanner.info>

Are you saying to add this to the update_virus_scanners script in
cron.hourly or if not, where are you referring to? My path is as follows and
should be OK:

/usr/kerberos/sbin:/usr/kerberos/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/loca
l/bin:/usr/local/sbin:/usr/bin/X11:/usr/X11R6/bin:/root/bin:/usr/local/mysql
:/usr/sbin:/sbin:/usr/local/bin

Thanks

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Hans Melgers
Sent: Tuesday, October 26, 2004 12:05 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] update_virus_scanners

Is your path ok ?
Try adding a path statement in the script, something like

# could be needed for cron
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin

Hans

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Filchak
> Sent: dinsdag 26 oktober 2004 16:38
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: update_virus_scanners
>
>
> Permissions on /tmp are right:
>
> stat /tmp
>   File: `/tmp'
>   Size: 11264           Blocks: 22         IO Block: 4096   Directory
> Device: 801h/2049d      Inode: 2           Links: 11
> Access: (1777/drwxrwxrwt)  Uid: (    0/    root)   Gid: (
> 0/    root)
> Access: 2004-10-26 09:15:24.000000000 -0400
> Modify: 2004-10-26 10:33:16.000000000 -0400
> Change: 2004-10-26 10:33:16.000000000 -0400
>
> And  perl -w /usr/lib/MailScanner/clamav-autoupdate shows no errors.
>
> Dave
>
> -----Original Message-----
> From: David Jacobson [mailto:davidj@synaq.com]
> Sent: Tuesday, October 26, 2004 10:03 AM
> To: dfilchak@sympatico.ca
> Cc: MAILSCANNER@JISCMAIL.AC.UK
> Subject: RE: update_virus_scanners
>
> Hi,
>
> Does "perl -w /usr/lib/MailScanner/clamav-autoupdate" show any errors?
>
> Also what are your /tmp directory permissions? (Should be
> 1777) you can see this by issuing "stat /tmp"
>
>
> On Tue, 2004-10-26 at 15:10, Dave Filchak wrote:
> > Thanks for your reply. Tried what you suggested and really
> cannot see
> > anything weird. It finds ClamAV installed and finds generic
> installed
> > but nothing else, which is normal.
> >
> > + SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
> > + LOCKFILE=/tmp/MailScanner.autoupdate.lock
> > ++ perl -e 'print "young" if -f
> "/tmp/MailScanner.autoupdate.lock" &&
> > ++ -M
> > "/tmp/MailScanner.autoupdate.lock"<0.042'
> > + '[' x = xyoung ']'
> > + trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT touch
> > + /tmp/MailScanner.autoupdate.lock umask 022
> > ++ uname
> > + OS=Linux
> > + '[' Linux = SunOS ']'
> > + GREP=grep
> > + cat /etc/MailScanner/virus.scanners.conf
> > + sed -e 's/#.*$//'
> > + grep -e -wrapper
> >
> > <SNIP>
> >
> > + read NAME WRAPPER PACKAGEDIR
> > ++ echo /usr/lib/MailScanner/clamav-wrapper
> > ++ sed -e 's/-wrapper$/-autoupdate/'
> > + UPDATER=/usr/lib/MailScanner/clamav-autoupdate
> > + '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper
> -a -n /usr ']'
> > + /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled logger -p
> > + mail.info -t update.virus.scanners Found clamav installed '[' -x
> > + /usr/lib/MailScanner/clamav-autoupdate ']'
> > + logger -p mail.info -t update.virus.scanners Running
> autoupdate for
> > + clamav /usr/lib/MailScanner/clamav-autoupdate /usr
> >
> > <SNIP>
> >
> > + read NAME WRAPPER PACKAGEDIR
> > ++ echo /usr/lib/MailScanner/generic-wrapper
> > ++ sed -e 's/-wrapper$/-autoupdate/'
> > + UPDATER=/usr/lib/MailScanner/generic-autoupdate
> > + '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper
> -a -n / ']'
> > + /usr/lib/MailScanner/generic-wrapper / -IsItInstalled logger -p
> > + mail.info -t update.virus.scanners Found generic installed '[' -x
> > + /usr/lib/MailScanner/generic-autoupdate ']'
> > + logger -p mail.info -t update.virus.scanners Running
> autoupdate for
> > generic
> > + /usr/lib/MailScanner/generic-autoupdate /
> >
> > I have edited out the non-pertinent portions. So, as far as I can
> > tell, this part seems fine. The only thing might be the
> lockfile. I do
> > not see this being created when this is run but it is hard to tell.
> >
> > Any other ideas??
> >
> > Dave
> >
> > -----Original Message-----
> > From: David Jacobson [mailto:davidj@synaq.com]
> > Sent: Tuesday, October 26, 2004 2:49 AM
> > To: dfilchak@sympatico.ca
> > Subject: Re: update_virus_scanners
> >
> > Hi,
> >
> > Perhaps try appending -x to the end of the #!/bin/bash line in
> > /usr/sbin/update_virus_scanners and look for any glaring errors.
> >
> > On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> > > OK .. I have managed to confuse the hell out of myself and really
> > > could use someone to put me out of my misery. I have just updated
> > > one of my servers to Mail::ClamAV 0.12 and MailScanner
> 4.35.5. After
> > > a bit of fiddling that went OK. However, while I was
> doing that, I
> > > decided to again tackle the update_virus_scanners issue I
> have been
> > > having in that I keep getting an error like the following
> when I run
> > > or cron runs
> > update_virus_scanners:
> > >
> > > Oct 26 00:00:21 ebony update.virus.scanners: Found clamav
> installed
> > > Oct 26 00:00:21 ebony update.virus.scanners: Running
> autoupdate for
> > > clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV
> > > updater failed
> > >
> > > However, if I run freshclam -v I get:
> > >
> > > Current working dir is /usr/local/share/clamav Max retries == 3
> > > ClamAV update process started at Tue Oct 26 00:01:13 2004
> Connected
> > > to database.clamav.net (65.110.48.11).
> > > Reading CVD header (main.cvd): OK
> > > main.cvd is up to date (version: 27, sigs: 23982,
> f-level: 2, builder:
> > > tomek)
> > > Connected to database.clamav.net (65.110.48.11).
> > > Reading CVD header (daily.cvd): OK daily.cvd is up to date
> > > (version: 550, sigs: 1607,
> f-level: 3, builder:
> > > trog)
> > > Freeing option list...done
> > >
> > > Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> > >
> > > Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV
> did not need
> > > updating
> > >
> > > in my maillog. Also, in clamav-autoupdate, I have changed the log
> > > directory to /var/log/clamav/ClamAV.update.log and in there I get:
> > >
> > > ClamAV update process started at Tue Oct 26 00:03:28 2004
> main.cvd
> > > is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > > tomek)
> > > daily.cvd is up to date (version: 550, sigs: 1607,
> f-level: 3, builder:
> > > trog)
> > >
> > > So, apparently /etc/cron.hourly/update_virus_scanners if
> not working
> > > and also apparently, I am too dull to figure out why.
> > >
> > > Can someone PLEASE help me out and tell me what they
> think is going
> > > on
> > here?
> > > I know it is probably stupid of me but sometimes you just gotta
> > > throw your hands in the air and yell for help.
> > >
> > > Dave
> > >
> > > ------------------------ MailScanner list
> ------------------------
> > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > 'leave mailscanner' in the body of the email.
> > > Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and
> > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > --
> > Regards,
> >
> > David Jacobson
> > Technical Director
> > SYNAQ (Pty) Ltd
> >
> > Tel:  011 290 6388
> > Cell: 083 235 0760
> > Mail: davidj@synaq.com
> > WWW:  http://www.synaq.com
> >
> > Key Fingerprint
> > 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
> --
> Regards,
>
> David Jacobson
> Technical Director
> SYNAQ (Pty) Ltd
>
> Tel:    011 290 6388
> Cell:   083 235 0760
> Mail:   davidj@synaq.com
> WWW:    http://www.synaq.com
>
> Key Fingerprint
> 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wagner at MILLER-ENGINEERING.COM  Tue Oct 26 18:52:17 2004
From: wagner at MILLER-ENGINEERING.COM (Joseph Wagner)
Date: Thu Jan 12 21:27:23 2006
Subject: Mailscanner Perl Error
Message-ID: <mailman.3971.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Okay, for whatever reason the debugging didn't turn on the first time.
Now, that debugging is working, I get this error when running
check_MailScanner

ack! no binary decoder! at /usr/lib/perl5/site_perl/5.8.3/MIME/Entity.pm
line 1851

So far I tried upgrading MIME::Tools through CPAN but that didn't take
care of the problem.  Any ideas?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Oct 26 18:57:26 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3972.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Marco Benton wrote:

> Matt Kettler wrote:
>
>> At 09:01 PM 10/25/2004, Marco Benton wrote:
>>
>>> alot of companies use the <...barf...> disclaimers and MailScanner has
>>> an easy way to add it, although not what inteded for.  not every
>>> company
>>> has gurus and pointy-haired managers want certain things even tho they
>>> dont make sense.  but is it right to *not* add that feature because of
>>> l-users?
>>
>>
>>
>> IMO, yes, but I think so because the feature only serves l-users.
>>
>> If there was a redeeming value to it beyond lusers, I'd say add it.
>> But it
>> doesn't. It only serves those adding clueless disclaimers to their
>> mail. It
>> doesn't aid those using the feature for virus sigs. It doesn't aid
>> mailing
>> lists because mailing list management packages have their own signature
>> tools. It really doesn't aid anyone in a useful valid way.
>>
>> I'll leave it up to Julian, but quite frankly I think it's a waste of
>> his
>> time to implement a feature that does the internet community as a
>> whole a
>> great disservice, and only serves to comfort clueless PHBs.
>>
>> If the PHBs want disclaimers, fine, but I don't think they should get
>> that
>> for free from Julian.
>>
>> There's plenty of other useful things for him to be doing.. Like
>> enjoying a
>> pint of ale/glass of wine/ beverage of choice :)
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>
> i do agree.  i'm just playing the role of the l-users and pointy-haired
> managers.
>
> if Julian does decide to do this in a fully compatible way, it *will* be
> painfull!  i remember writing that disclaimer milter and having to deal
> with  email clients that didnt fully comply with MIME standards...never
> mind the raw message bodies that came from brain-dead MTA's or email
> clients (most likely spammer servers).

I'm inclined to go with the "no" vote here. Once you start considering
MUAs that have turned the original text into HTML, it gets very hard
indeed. You have no idea how it might have done it, so you can't even
just search for the sig in the text. Spaces and line breaks are likely
to have been played with.

> as long as he enjoys the good stuff and not a pint of stomach burning
> acid made in the backyard.  ;-)

Stomach acid, now there's a long story I'll spare you...
Not had any stomach acid since operation number 4 back in 1991. You can
do without all sorts of bits of your insides, I'm living proof :-)

Anyone fancy buying me a Mac laptop? I've just got an iMac G5 at work,
and my PC is starting to gather dust already. Hopefully I've got one of
those lovely little OQOs on the way (see www.oqo.com) so I can work on
the move more easily. Built-in Bluetooth combined with my phone =
productive train trips. They look dead cool, I'll report back once I've
had it a while.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jkf at ecs.soton.ac.uk  Tue Oct 26 19:01:58 2004
From: jkf at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Individual black and white listing
Message-ID: <mailman.3973.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The best answer to this is to take a look in CustomConfig.pm. Using the
per-domain and per-user black/white listing code in there, you can have
1 file per user and/or 1 file per domain which holds the black/white
list for that user/domain. You can then have a simple web interface to
build these files.

It is also enormously faster than large rulesets. Definitely the best
way to go for more than a couple of hundred rules (in total).

Sanjay K. Patel wrote:

>Is it possible for individuals to have their own black list and white list.
>In this scenario someone can blacklist a sender while another has that
>sender whitelisted.
>
>I saw this functionality in a commercial product and figured it would be a
>great function to have.
>
>-SKP
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
--
Julian Field                Teaching Systems Manager
jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                            Southampton SO17 1BJ

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Oct 26 18:52:42 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3974.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

| Scott Silva said the following on 26-Oct-04 17:30:
|
|> <<Snip>>
|> |> But whatever I do i don't see any hits on the rules with
|> URIBL/SURBL and
|> |> or SPF. Although I couldn't find it back in the list I believe i need
|> |> the latest beta for SPF support, but URIBL should work.
|> |>
|> |> I check some of the spam only minutes after they where received on
|> |> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
|> |> listed in one or more lists.
|> |>
|> |> The only rule scoring I modified in local.cf is:
|> |> score ALL_TRUSTED 0
|> |
|> |
|> | What does a SA --lint tell you ?
|> |
|> |> Is there somebody who can offer some adivce on how to troubleshoot
|> |> and/or find the culprit for this?
|> Check to see if you have a "/etc/mail/spamassassin/init.pre" You might
|> find it instead in "/usr/etc/mail/spamassassin/init.pre". Copy (or link
|> might work) to /etc/mail/spamassassin and restart MailScanner just to be
|> safe
Stijn Jonker wrote:
| Scott,
|
| Thanks this fixed it, I'll do some more testing and remove it from
| local.cf and/or /etc/MailScanner/spam.assassin.prefs.conf and will post
| the results.
|
| And offcourse add a faq item ;-)
|
| Thanks
| Stijn
Your welcome. I was hit by the same prob. a few weeks back.
Luckily, as I beat MY head against the wall, I didn't forget what I did.

(top posting fixed)



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBfo7pRADw9lziUqQRAvi3AJ9ys5DnZdiQael0IeIsaqrdOlyEXwCfQlVC
wRi5tr1QJMjJ8aJ+BCs6YWo=
=Q1Ej
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Oct 26 18:59:19 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3975.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Gerry Maddock wrote:
| Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
| running on  a fully updated Fedora Core 2 system running
| sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
| Outlook to compose emails in HTML format's emails come back looking
| strange like this:
|
| This is a multi-part message in MIME format.
|
| ------=_NextPart_000_0053_01C4BB54.0ABCAA40
| Content-Type: text/plain;
|         charset="iso-8859-1"
| Content-Transfer-Encoding: 7bit
|
| test
| ------=_NextPart_000_0053_01C4BB54.0ABCAA40
| Content-Type: text/html;
|         charset="iso-8859-1"
| Content-Transfer-Encoding: quoted-printable
|
| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
| <HTML><HEAD><TITLE></TITLE>
| <META http-equiv=3DContent-Type content=3D"text/html; =
| charset=3Diso-8859-1">
| <META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
| <BODY><STRONG><EM><U><FONT face=3DArial=20
| size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>
|
| ------=_NextPart_000_0053_01C4BB54.0ABCAA40--
|
|
| Any email sent to us in html format comes back looking like that. I have
| attached my MailScanner.conf as well. Any help would be greatly
| appreciated!
Can you post the output of MailScanner -v
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBfpB2RADw9lziUqQRAqNJAJ932VTmi6uTf/wyt/dnADMFE36g0QCeOgWh
gS/LCTsTogn4DjDtz+Eqjqw=
=nvVq
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Tue Oct 26 18:55:27 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:23 2006
Subject: Clamav RPMs
Message-ID: <mailman.3976.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Roger Jochem wrote:
| In this directory there is also no clamav-db-0.80. Does version 0.80 not
| uses clamav-db anymore?
|
I am probably wrong (most likely wrong), but isn't clamav-db just an
initial set of signatures?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBfo+PRADw9lziUqQRAsbkAJ4lDohfhAy9COQu6H8A6EJJzvmCzwCcCgAd
49ujQauCQeBm67Bp4syv3Qw=
=OT0F
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Oct 26 19:33:18 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3977.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Have you upgraded MIME-tools and MIME::Base64 as well?
Personally I would recommend the current beta as actually being better
than the last stable release. There have been a whole world of nasty
problems getting the module upgrades fixed.

Scott Silva wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Gerry Maddock wrote:
> | Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
> | running on  a fully updated Fedora Core 2 system running
> | sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
> | Outlook to compose emails in HTML format's emails come back looking
> | strange like this:
> |
> | This is a multi-part message in MIME format.
> |
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
> | Content-Type: text/plain;
> |         charset="iso-8859-1"
> | Content-Transfer-Encoding: 7bit
> |
> | test
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
> | Content-Type: text/html;
> |         charset="iso-8859-1"
> | Content-Transfer-Encoding: quoted-printable
> |
> | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> | <HTML><HEAD><TITLE></TITLE>
> | <META http-equiv=3DContent-Type content=3D"text/html; =
> | charset=3Diso-8859-1">
> | <META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
> | <BODY><STRONG><EM><U><FONT face=3DArial=20
> | size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>
> |
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40--
> |
> |
> | Any email sent to us in html format comes back looking like that. I
> have
> | attached my MailScanner.conf as well. Any help would be greatly
> | appreciated!
> Can you post the output of MailScanner -v


--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gerrym at FUTUREMETALS.COM  Tue Oct 26 19:38:18 2004
From: gerrym at FUTUREMETALS.COM (Gerry Maddock)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3978.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'll try that out after hours and let you know.

> Have you upgraded MIME-tools and MIME::Base64 as well?
> Personally I would recommend the current beta as actually being better
> than the last stable release. There have been a whole world of nasty
> problems getting the module upgrades fixed.
>
> Scott Silva wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Gerry Maddock wrote:
>> | Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
>> | running on  a fully updated Fedora Core 2 system running
>> | sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
>> | Outlook to compose emails in HTML format's emails come back looking
>> | strange like this:
>> |
>> | This is a multi-part message in MIME format.
>> |
>> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
>> | Content-Type: text/plain;
>> |         charset="iso-8859-1"
>> | Content-Transfer-Encoding: 7bit
>> |
>> | test
>> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
>> | Content-Type: text/html;
>> |         charset="iso-8859-1"
>> | Content-Transfer-Encoding: quoted-printable
>> |
>> | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
>> | <HTML><HEAD><TITLE></TITLE>
>> | <META http-equiv=3DContent-Type content=3D"text/html; =
>> | charset=3Diso-8859-1">
>> | <META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
>> | <BODY><STRONG><EM><U><FONT face=3DArial=20
>> | size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>
>> |
>> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40--
>> |
>> |
>> | Any email sent to us in html format comes back looking like that. I
>> have
>> | attached my MailScanner.conf as well. Any help would be greatly
>> | appreciated!
>> Can you post the output of MailScanner -v
>
>
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz
> MailScanner thanks transtec Computers for their support
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gerrym at FUTUREMETALS.COM  Tue Oct 26 19:38:58 2004
From: gerrym at FUTUREMETALS.COM (Gerry Maddock)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3979.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I had to move back to MailScanner-4.34.8-1 for now
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Gerry Maddock wrote:
> | Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
> | running on  a fully updated Fedora Core 2 system running
> | sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
> | Outlook to compose emails in HTML format's emails come back looking
> | strange like this:
> |
> | This is a multi-part message in MIME format.
> |
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
> | Content-Type: text/plain;
> |         charset="iso-8859-1"
> | Content-Transfer-Encoding: 7bit
> |
> | test
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
> | Content-Type: text/html;
> |         charset="iso-8859-1"
> | Content-Transfer-Encoding: quoted-printable
> |
> | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> | <HTML><HEAD><TITLE></TITLE>
> | <META http-equiv=3DContent-Type content=3D"text/html; =
> | charset=3Diso-8859-1">
> | <META content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
> | <BODY><STRONG><EM><U><FONT face=3DArial=20
> | size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>
> |
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40--
> |
> |
> | Any email sent to us in html format comes back looking like that. I have
> | attached my MailScanner.conf as well. Any help would be greatly
> | appreciated!
> Can you post the output of MailScanner -v
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBfpB2RADw9lziUqQRAqNJAJ932VTmi6uTf/wyt/dnADMFE36g0QCeOgWh
> gS/LCTsTogn4DjDtz+Eqjqw=
> =nvVq
> -----END PGP SIGNATURE-----
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dfilchak at sympatico.ca  Tue Oct 26 19:53:05 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3980.1137101243.24926.mailscanner@lists.mailscanner.info>

Julian,

Has anything in the last beta release of MailScanner address any of the PDF
issues previously discussed in the list?

Cheers

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Julian Field
Sent: Tuesday, October 26, 2004 2:33 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] MailScanner & MIME

Have you upgraded MIME-tools and MIME::Base64 as well?
Personally I would recommend the current beta as actually being better than
the last stable release. There have been a whole world of nasty problems
getting the module upgrades fixed.

Scott Silva wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Gerry Maddock wrote:
> | Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
> | running on  a fully updated Fedora Core 2 system running
> | sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
> | Outlook to compose emails in HTML format's emails come back looking
> | strange like this:
> |
> | This is a multi-part message in MIME format.
> |
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
> | Content-Type: text/plain;
> |         charset="iso-8859-1"
> | Content-Transfer-Encoding: 7bit
> |
> | test
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40
> | Content-Type: text/html;
> |         charset="iso-8859-1"
> | Content-Transfer-Encoding: quoted-printable
> |
> | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
> | <HTML><HEAD><TITLE></TITLE> <META http-equiv=3DContent-Type
> | content=3D"text/html; = charset=3Diso-8859-1"> <META
> | content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
> | <BODY><STRONG><EM><U><FONT face=3DArial=20
> | size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>
> |
> | ------=_NextPart_000_0053_01C4BB54.0ABCAA40--
> |
> |
> | Any email sent to us in html format comes back looking like that. I
> have
> | attached my MailScanner.conf as well. Any help would be greatly
> | appreciated!
> Can you post the output of MailScanner -v


--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From vachanta at GMAIL.COM  Tue Oct 26 20:01:56 2004
From: vachanta at GMAIL.COM (Venkata Achanta)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3981.1137101243.24926.mailscanner@lists.mailscanner.info>

Thanks for all your replies.

Julian,

       I have a request for you. I want to try to get this feature added
(atleast as a separate plugin) and I am ready to devote developer time in
order to get this done.

I am looking for your directions on the design of the module to ensure
forward compatibilty with future versions of MailScanner.

I completely agree with with you about the MUA's adding html tags.but i am
thinking of a module that can be customized to
-What disclaimer text to look for ?
-What type of encoding to look for ?
etc

I know it will not be completely possible to detect whether every message
has a disclaimer attached to it or not(given the variance in the behaviour
MUA's) but still the purpose will be served for most of the e-mails i
believe.

just want you comments on this.

Anyone intrested to team up ?

Many Many thanks for this excellent piece of software,which is saving the e-
mail world from spam.

Thanks much,
Venkata Achanta


On Tue, 26 Oct 2004 18:57:26 +0100, Julian Field
<mailscanner@ECS.SOTON.AC.UK> wrote:

>Marco Benton wrote:
>
>> Matt Kettler wrote:
>>
>>> At 09:01 PM 10/25/2004, Marco Benton wrote:
>>>
>>>> alot of companies use the <...barf...> disclaimers and MailScanner has
>>>> an easy way to add it, although not what inteded for.  not every
>>>> company
>>>> has gurus and pointy-haired managers want certain things even tho they
>>>> dont make sense.  but is it right to *not* add that feature because of
>>>> l-users?
>>>
>>>
>>>
>>> IMO, yes, but I think so because the feature only serves l-users.
>>>
>>> If there was a redeeming value to it beyond lusers, I'd say add it.
>>> But it
>>> doesn't. It only serves those adding clueless disclaimers to their
>>> mail. It
>>> doesn't aid those using the feature for virus sigs. It doesn't aid
>>> mailing
>>> lists because mailing list management packages have their own signature
>>> tools. It really doesn't aid anyone in a useful valid way.
>>>
>>> I'll leave it up to Julian, but quite frankly I think it's a waste of
>>> his
>>> time to implement a feature that does the internet community as a
>>> whole a
>>> great disservice, and only serves to comfort clueless PHBs.
>>>
>>> If the PHBs want disclaimers, fine, but I don't think they should get
>>> that
>>> for free from Julian.
>>>
>>> There's plenty of other useful things for him to be doing.. Like
>>> enjoying a
>>> pint of ale/glass of wine/ beverage of choice :)
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>
>> i do agree.  i'm just playing the role of the l-users and pointy-haired
>> managers.
>>
>> if Julian does decide to do this in a fully compatible way, it *will* be
>> painfull!  i remember writing that disclaimer milter and having to deal
>> with  email clients that didnt fully comply with MIME standards...never
>> mind the raw message bodies that came from brain-dead MTA's or email
>> clients (most likely spammer servers).
>
>I'm inclined to go with the "no" vote here. Once you start considering
>MUAs that have turned the original text into HTML, it gets very hard
>indeed. You have no idea how it might have done it, so you can't even
>just search for the sig in the text. Spaces and line breaks are likely
>to have been played with.
>
>> as long as he enjoys the good stuff and not a pint of stomach burning
>> acid made in the backyard.  ;-)
>
>Stomach acid, now there's a long story I'll spare you...
>Not had any stomach acid since operation number 4 back in 1991. You can
>do without all sorts of bits of your insides, I'm living proof :-)
>
>Anyone fancy buying me a Mac laptop? I've just got an iMac G5 at work,
>and my PC is starting to gather dust already. Hopefully I've got one of
>those lovely little OQOs on the way (see www.oqo.com) so I can work on
>the move more easily. Built-in Bluetooth combined with my phone =
>productive train trips. They look dead cool, I'll report back once I've
>had it a while.
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz
>MailScanner thanks transtec Computers for their support
>Buy the MailScanner book at www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jkf at ecs.soton.ac.uk  Tue Oct 26 20:12:12 2004
From: jkf at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & MIME
Message-ID: <mailman.3982.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Yes, another major improvement was made in the new
MIME-tools/MIME::Base64 pair. It should look for PDF files encoded by
Outlook (which does it all wrong) and correct them.

Dave Filchak wrote:

>Julian,
>
>Has anything in the last beta release of MailScanner address any of the PDF
>issues previously discussed in the list?
>
>Cheers
>
>Dave
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
>Of Julian Field
>Sent: Tuesday, October 26, 2004 2:33 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: [MAILSCANNER] MailScanner & MIME
>
>Have you upgraded MIME-tools and MIME::Base64 as well?
>Personally I would recommend the current beta as actually being better than
>the last stable release. There have been a whole world of nasty problems
>getting the module upgrades fixed.
>
>Scott Silva wrote:
>
>
>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>>
>>Gerry Maddock wrote:
>>| Hello, I just upgraded MailScanner-4.34.8-1 to MailScanner-4.34.8-4
>>| running on  a fully updated Fedora Core 2 system running
>>| sendmail-8.12.11-4.6. After I upgraded MailScanner, my users who use
>>| Outlook to compose emails in HTML format's emails come back looking
>>| strange like this:
>>|
>>| This is a multi-part message in MIME format.
>>|
>>| ------=_NextPart_000_0053_01C4BB54.0ABCAA40
>>| Content-Type: text/plain;
>>|         charset="iso-8859-1"
>>| Content-Transfer-Encoding: 7bit
>>|
>>| test
>>| ------=_NextPart_000_0053_01C4BB54.0ABCAA40
>>| Content-Type: text/html;
>>|         charset="iso-8859-1"
>>| Content-Transfer-Encoding: quoted-printable
>>|
>>| <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
>>| <HTML><HEAD><TITLE></TITLE> <META http-equiv=3DContent-Type
>>| content=3D"text/html; = charset=3Diso-8859-1"> <META
>>| content=3D"MSHTML 6.00.2800.1476" name=3DGENERATOR></HEAD>
>>| <BODY><STRONG><EM><U><FONT face=3DArial=20
>>| size=3D7>test</FONT></U></EM></STRONG></BODY></HTML>
>>|
>>| ------=_NextPart_000_0053_01C4BB54.0ABCAA40--
>>|
>>|
>>| Any email sent to us in html format comes back looking like that. I
>>have
>>| attached my MailScanner.conf as well. Any help would be greatly
>>| appreciated!
>>Can you post the output of MailScanner -v
>>
>>
>
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support Buy the MailScanner book at
>www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
--
Julian Field                Teaching Systems Manager
jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                            Southampton SO17 1BJ

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jkf at ecs.soton.ac.uk  Tue Oct 26 20:19:27 2004
From: jkf at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Disclaimer Attachment- ONLY ONCE
Message-ID: <mailman.3983.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You would be best doing this by writing a Custom Function attached to
the "Sign Clean Messages" option.

Working from the top of the entity tree, look in the first entity and in
any multipart/alternative entities. I would advise
1) Replace all HTML tags with a single space.
2) Look for consecutive lines containing the text of the email signature?

But given that you need to look for the HTML signature and the text
signature, as well as any sigs that have been converted to/from
plain/html, it is going to be very awkward to make sure you have found
them all. You need to look for the text of the HTML and text signatures
in both of the multipart/alternative sections.

This is a very easy thing for humans to do, but very awkward for a
program to do. You have to aim to catch as many permutations as you
possibly can, in order to stand a chance of getting a usable system.

Venkata Achanta wrote:

>Thanks for all your replies.
>
>Julian,
>
>       I have a request for you. I want to try to get this feature added
>(atleast as a separate plugin) and I am ready to devote developer time in
>order to get this done.
>
>I am looking for your directions on the design of the module to ensure
>forward compatibilty with future versions of MailScanner.
>
>I completely agree with with you about the MUA's adding html tags.but i am
>thinking of a module that can be customized to
>-What disclaimer text to look for ?
>-What type of encoding to look for ?
>etc
>
>I know it will not be completely possible to detect whether every message
>has a disclaimer attached to it or not(given the variance in the behaviour
>MUA's) but still the purpose will be served for most of the e-mails i
>believe.
>
>just want you comments on this.
>
>Anyone intrested to team up ?
>
>Many Many thanks for this excellent piece of software,which is saving the e-
>mail world from spam.
>
>Thanks much,
>Venkata Achanta
>
>
>On Tue, 26 Oct 2004 18:57:26 +0100, Julian Field
><mailscanner@ECS.SOTON.AC.UK> wrote:
>
>
>
>>Marco Benton wrote:
>>
>>
>>
>>>Matt Kettler wrote:
>>>
>>>
>>>
>>>>At 09:01 PM 10/25/2004, Marco Benton wrote:
>>>>
>>>>
>>>>
>>>>>alot of companies use the <...barf...> disclaimers and MailScanner has
>>>>>an easy way to add it, although not what inteded for.  not every
>>>>>company
>>>>>has gurus and pointy-haired managers want certain things even tho they
>>>>>dont make sense.  but is it right to *not* add that feature because of
>>>>>l-users?
>>>>>
>>>>>
>>>>
>>>>IMO, yes, but I think so because the feature only serves l-users.
>>>>
>>>>If there was a redeeming value to it beyond lusers, I'd say add it.
>>>>But it
>>>>doesn't. It only serves those adding clueless disclaimers to their
>>>>mail. It
>>>>doesn't aid those using the feature for virus sigs. It doesn't aid
>>>>mailing
>>>>lists because mailing list management packages have their own signature
>>>>tools. It really doesn't aid anyone in a useful valid way.
>>>>
>>>>I'll leave it up to Julian, but quite frankly I think it's a waste of
>>>>his
>>>>time to implement a feature that does the internet community as a
>>>>whole a
>>>>great disservice, and only serves to comfort clueless PHBs.
>>>>
>>>>If the PHBs want disclaimers, fine, but I don't think they should get
>>>>that
>>>>for free from Julian.
>>>>
>>>>There's plenty of other useful things for him to be doing.. Like
>>>>enjoying a
>>>>pint of ale/glass of wine/ beverage of choice :)
>>>>
>>>>------------------------ MailScanner list ------------------------
>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>>>'leave mailscanner' in the body of the email.
>>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>>
>>>
>>>i do agree.  i'm just playing the role of the l-users and pointy-haired
>>>managers.
>>>
>>>if Julian does decide to do this in a fully compatible way, it *will* be
>>>painfull!  i remember writing that disclaimer milter and having to deal
>>>with  email clients that didnt fully comply with MIME standards...never
>>>mind the raw message bodies that came from brain-dead MTA's or email
>>>clients (most likely spammer servers).
>>>
>>>
>>I'm inclined to go with the "no" vote here. Once you start considering
>>MUAs that have turned the original text into HTML, it gets very hard
>>indeed. You have no idea how it might have done it, so you can't even
>>just search for the sig in the text. Spaces and line breaks are likely
>>to have been played with.
>>
>>
>>
>>>as long as he enjoys the good stuff and not a pint of stomach burning
>>>acid made in the backyard.  ;-)
>>>
>>>
>>Stomach acid, now there's a long story I'll spare you...
>>Not had any stomach acid since operation number 4 back in 1991. You can
>>do without all sorts of bits of your insides, I'm living proof :-)
>>
>>Anyone fancy buying me a Mac laptop? I've just got an iMac G5 at work,
>>and my PC is starting to gather dust already. Hopefully I've got one of
>>those lovely little OQOs on the way (see www.oqo.com) so I can work on
>>the move more easily. Built-in Bluetooth combined with my phone =
>>productive train trips. They look dead cool, I'll report back once I've
>>had it a while.
>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Professional Support Services at www.MailScanner.biz
>>MailScanner thanks transtec Computers for their support
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
--
Julian Field                Teaching Systems Manager
jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                            Southampton SO17 1BJ

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wright at CYBERVALE.COM  Tue Oct 26 19:21:00 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:23 2006
Subject: Bayes dir permissions
Message-ID: <mailman.3984.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Guy's
 
running Postfix+MS+SA3
 
what are the correct permissions for the bayes dir and files
 
I get the following error when I try to update rules_dujour:
 
Lint output: Cannot open bayes databases /etc/MailScanner/bayes/bayes_*
R/O: tie failed:
Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie
failed:
Failed to run DNS_FROM_AHBL_RHSBL RBL SpamAssassin test, skipping:
        (Can't call method "bgsend" on an undefined value at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Dns.pm line 112.
)
I've seen in the archives where two approaches are suggested. One to
create a bayes group and add apache and postfix to the group and the one
below.
 
<snip>
I cannot see the idea in adding both postfix and apache to your 'bayes'
group, since postfix already owns the files!

Instead you could have done:

chown postfix.apache bayes_*
chmod 660 bayes_*
<snip>
 
Which is the best? currently permission is:  
-rw-rw----    1 root     apache        144 Sep 23 11:54 bayes_journal
-rw-------    1 root     apache       8922 Sep 23 11:51 bayes.mutex
-rw-rw----    1 root     apache     184320 Sep 23 11:51 bayes_seen
-rw-rw----    1 root     apache    5255168 Sep 23 11:51 bayes_toks
 
TIA.
 
Terran
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From greg at BLASTZONE.COM  Tue Oct 26 20:33:17 2004
From: greg at BLASTZONE.COM (Greg Deputy)
Date: Thu Jan 12 21:27:23 2006
Subject: Bayes dir permissions
Message-ID: <mailman.3985.1137101243.24926.mailscanner@lists.mailscanner.info>

I had this same problem.  The postfix user needs to have rights. 
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]
On Behalf Of Terran Wright
Sent: Tuesday, October 26, 2004 11:21 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Bayes dir permissions

Guy's
 
running Postfix+MS+SA3
 
what are the correct permissions for the bayes dir and files
 
I get the following error when I try to update rules_dujour:
 
Lint output: Cannot open bayes databases
/etc/MailScanner/bayes/bayes_* R/O: tie failed:
Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie
failed:
Failed to run DNS_FROM_AHBL_RHSBL RBL SpamAssassin test, skipping:
        (Can't call method "bgsend" on an undefined value at
/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Dns.pm line 112.
)
I've seen in the archives where two approaches are suggested. One
to create a bayes group and add apache and postfix to the group and
the one below.
 
<snip>
I cannot see the idea in adding both postfix and apache to your
'bayes'
group, since postfix already owns the files!

Instead you could have done:

chown postfix.apache bayes_*
chmod 660 bayes_*
<snip>
 
Which is the best? currently permission is:  
-rw-rw----    1 root     apache        144 Sep 23 11:54
bayes_journal
-rw-------    1 root     apache       8922 Sep 23 11:51 bayes.mutex
-rw-rw----    1 root     apache     184320 Sep 23 11:51 bayes_seen
-rw-rw----    1 root     apache    5255168 Sep 23 11:51 bayes_toks
 
TIA.
 
Terran
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives
(http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From hans at ENEM.NL  Tue Oct 26 20:52:39 2004
From: hans at ENEM.NL (Hans Melgers)
Date: Thu Jan 12 21:27:23 2006
Subject: update_virus_scanners
Message-ID: <mailman.3986.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Yes, in the update virus scanners script.


> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Filchak
> Sent: dinsdag 26 oktober 2004 19:52
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: update_virus_scanners
>
>
> Are you saying to add this to the update_virus_scanners
> script in cron.hourly or if not, where are you referring to?
> My path is as follows and should be OK:
>
> /usr/kerberos/sbin:/usr/kerberos/bin:/bin:/sbin:/usr/bin:/usr/
> sbin:/usr/loca
> l/bin:/usr/local/sbin:/usr/bin/X11:/usr/X11R6/bin:/root/bin:/u
> sr/local/mysql
> :/usr/sbin:/sbin:/usr/local/bin
>
> Thanks
>
> Dave
>
> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Hans Melgers
> Sent: Tuesday, October 26, 2004 12:05 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: [MAILSCANNER] update_virus_scanners
>
> Is your path ok ?
> Try adding a path statement in the script, something like
>
> # could be needed for cron
> export PATH=$PATH:/bin:/usr/bin:/usr/local/bin
>
> Hans
>
> > -----Original Message-----
> > From: MailScanner mailing list
> > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Filchak
> > Sent: dinsdag 26 oktober 2004 16:38
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Re: update_virus_scanners
> >
> >
> > Permissions on /tmp are right:
> >
> > stat /tmp
> >   File: `/tmp'
> >   Size: 11264           Blocks: 22         IO Block: 4096
> Directory
> > Device: 801h/2049d      Inode: 2           Links: 11
> > Access: (1777/drwxrwxrwt)  Uid: (    0/    root)   Gid: (
> > 0/    root)
> > Access: 2004-10-26 09:15:24.000000000 -0400
> > Modify: 2004-10-26 10:33:16.000000000 -0400
> > Change: 2004-10-26 10:33:16.000000000 -0400
> >
> > And  perl -w /usr/lib/MailScanner/clamav-autoupdate shows no errors.
> >
> > Dave
> >
> > -----Original Message-----
> > From: David Jacobson [mailto:davidj@synaq.com]
> > Sent: Tuesday, October 26, 2004 10:03 AM
> > To: dfilchak@sympatico.ca
> > Cc: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: RE: update_virus_scanners
> >
> > Hi,
> >
> > Does "perl -w /usr/lib/MailScanner/clamav-autoupdate" show
> any errors?
> >
> > Also what are your /tmp directory permissions? (Should be
> > 1777) you can see this by issuing "stat /tmp"
> >
> >
> > On Tue, 2004-10-26 at 15:10, Dave Filchak wrote:
> > > Thanks for your reply. Tried what you suggested and really
> > cannot see
> > > anything weird. It finds ClamAV installed and finds generic
> > installed
> > > but nothing else, which is normal.
> > >
> > > + SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
> > > + LOCKFILE=/tmp/MailScanner.autoupdate.lock
> > > ++ perl -e 'print "young" if -f
> > "/tmp/MailScanner.autoupdate.lock" &&
> > > ++ -M
> > > "/tmp/MailScanner.autoupdate.lock"<0.042'
> > > + '[' x = xyoung ']'
> > > + trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT touch
> > > + /tmp/MailScanner.autoupdate.lock umask 022
> > > ++ uname
> > > + OS=Linux
> > > + '[' Linux = SunOS ']'
> > > + GREP=grep
> > > + cat /etc/MailScanner/virus.scanners.conf
> > > + sed -e 's/#.*$//'
> > > + grep -e -wrapper
> > >
> > > <SNIP>
> > >
> > > + read NAME WRAPPER PACKAGEDIR
> > > ++ echo /usr/lib/MailScanner/clamav-wrapper
> > > ++ sed -e 's/-wrapper$/-autoupdate/'
> > > + UPDATER=/usr/lib/MailScanner/clamav-autoupdate
> > > + '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper
> > -a -n /usr ']'
> > > + /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled
> logger -p
> > > + mail.info -t update.virus.scanners Found clamav
> installed '[' -x
> > > + /usr/lib/MailScanner/clamav-autoupdate ']'
> > > + logger -p mail.info -t update.virus.scanners Running
> > autoupdate for
> > > + clamav /usr/lib/MailScanner/clamav-autoupdate /usr
> > >
> > > <SNIP>
> > >
> > > + read NAME WRAPPER PACKAGEDIR
> > > ++ echo /usr/lib/MailScanner/generic-wrapper
> > > ++ sed -e 's/-wrapper$/-autoupdate/'
> > > + UPDATER=/usr/lib/MailScanner/generic-autoupdate
> > > + '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper
> > -a -n / ']'
> > > + /usr/lib/MailScanner/generic-wrapper / -IsItInstalled logger -p
> > > + mail.info -t update.virus.scanners Found generic
> installed '[' -x
> > > + /usr/lib/MailScanner/generic-autoupdate ']'
> > > + logger -p mail.info -t update.virus.scanners Running
> > autoupdate for
> > > generic
> > > + /usr/lib/MailScanner/generic-autoupdate /
> > >
> > > I have edited out the non-pertinent portions. So, as far as I can
> > > tell, this part seems fine. The only thing might be the
> > lockfile. I do
> > > not see this being created when this is run but it is
> hard to tell.
> > >
> > > Any other ideas??
> > >
> > > Dave
> > >
> > > -----Original Message-----
> > > From: David Jacobson [mailto:davidj@synaq.com]
> > > Sent: Tuesday, October 26, 2004 2:49 AM
> > > To: dfilchak@sympatico.ca
> > > Subject: Re: update_virus_scanners
> > >
> > > Hi,
> > >
> > > Perhaps try appending -x to the end of the #!/bin/bash line in
> > > /usr/sbin/update_virus_scanners and look for any glaring errors.
> > >
> > > On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> > > > OK .. I have managed to confuse the hell out of myself
> and really
> > > > could use someone to put me out of my misery. I have
> just updated
> > > > one of my servers to Mail::ClamAV 0.12 and MailScanner
> > 4.35.5. After
> > > > a bit of fiddling that went OK. However, while I was
> > doing that, I
> > > > decided to again tackle the update_virus_scanners issue I
> > have been
> > > > having in that I keep getting an error like the following
> > when I run
> > > > or cron runs
> > > update_virus_scanners:
> > > >
> > > > Oct 26 00:00:21 ebony update.virus.scanners: Found clamav
> > installed
> > > > Oct 26 00:00:21 ebony update.virus.scanners: Running
> > autoupdate for
> > > > clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV
> > > > updater failed
> > > >
> > > > However, if I run freshclam -v I get:
> > > >
> > > > Current working dir is /usr/local/share/clamav Max retries == 3
> > > > ClamAV update process started at Tue Oct 26 00:01:13 2004
> > Connected
> > > > to database.clamav.net (65.110.48.11).
> > > > Reading CVD header (main.cvd): OK
> > > > main.cvd is up to date (version: 27, sigs: 23982,
> > f-level: 2, builder:
> > > > tomek)
> > > > Connected to database.clamav.net (65.110.48.11).
> > > > Reading CVD header (daily.cvd): OK daily.cvd is up to date
> > > > (version: 550, sigs: 1607,
> > f-level: 3, builder:
> > > > trog)
> > > > Freeing option list...done
> > > >
> > > > Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> > > >
> > > > Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV
> > did not need
> > > > updating
> > > >
> > > > in my maillog. Also, in clamav-autoupdate, I have
> changed the log
> > > > directory to /var/log/clamav/ClamAV.update.log and in
> there I get:
> > > >
> > > > ClamAV update process started at Tue Oct 26 00:03:28 2004
> > main.cvd
> > > > is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > > > tomek)
> > > > daily.cvd is up to date (version: 550, sigs: 1607,
> > f-level: 3, builder:
> > > > trog)
> > > >
> > > > So, apparently /etc/cron.hourly/update_virus_scanners if
> > not working
> > > > and also apparently, I am too dull to figure out why.
> > > >
> > > > Can someone PLEASE help me out and tell me what they
> > think is going
> > > > on
> > > here?
> > > > I know it is probably stupid of me but sometimes you just gotta
> > > > throw your hands in the air and yell for help.
> > > >
> > > > Dave
> > > >
> > > > ------------------------ MailScanner list
> > ------------------------
> > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > > 'leave mailscanner' in the body of the email.
> > > > Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and
> > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > > --
> > > Regards,
> > >
> > > David Jacobson
> > > Technical Director
> > > SYNAQ (Pty) Ltd
> > >
> > > Tel:  011 290 6388
> > > Cell: 083 235 0760
> > > Mail: davidj@synaq.com
> > > WWW:  http://www.synaq.com
> > >
> > > Key Fingerprint
> > > 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
> > --
> > Regards,
> >
> > David Jacobson
> > Technical Director
> > SYNAQ (Pty) Ltd
> >
> > Tel:    011 290 6388
> > Cell:   083 235 0760
> > Mail:   davidj@synaq.com
> > WWW:    http://www.synaq.com
> >
> > Key Fingerprint
> > 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
> >
> > ------------------------ MailScanner list
> > ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk
> > with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ
> > (http://www.mailscanner.biz/maq/) and the archives
> > (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Tue Oct 26 21:17:38 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:23 2006
Subject: Bayes dir permissions
Message-ID: <mailman.3987.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Terran Wright wrote:
> Guy's
>
> running Postfix+MS+SA3
>
> what are the correct permissions for the bayes dir and files
>
> I get the following error when I try to update rules_dujour:
>
> Lint output: Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie failed:
> Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/O: tie failed:
> Failed to run DNS_FROM_AHBL_RHSBL RBL SpamAssassin test, skipping:
>         (Can't call method "bgsend" on an undefined value at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Dns.pm line 112.
> )

What do you get if you, as root, run "sa-learn --sync"?

If that fails with a similar message your db is screwed and you need to
start over by deleting the files.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Tue Oct 26 21:43:29 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3988.1137101243.24926.mailscanner@lists.mailscanner.info>

On Tue, 26 Oct 2004, Scott Silva wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> | Scott Silva said the following on 26-Oct-04 17:30:
> |
> |> <<Snip>>
> |>|> But whatever I do i don't see any hits on the rules with
> |> URIBL/SURBL and
> |>|> or SPF. Although I couldn't find it back in the list I believe i need
> |>|> the latest beta for SPF support, but URIBL should work.
> |>|>
> |>|> I check some of the spam only minutes after they where received on
> |>|> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
> |>|> listed in one or more lists.
> |>|>
> |>|> The only rule scoring I modified in local.cf is:
> |>|> score ALL_TRUSTED 0
> |>|
> |>|
> |>| What does a SA --lint tell you ?
> |>|
> |>|> Is there somebody who can offer some adivce on how to troubleshoot
> |>|> and/or find the culprit for this?
> |> Check to see if you have a "/etc/mail/spamassassin/init.pre" You might
> |> find it instead in "/usr/etc/mail/spamassassin/init.pre". Copy (or link
> |> might work) to /etc/mail/spamassassin and restart MailScanner just to be
> |> safe
> Stijn Jonker wrote:
> | Scott,
> |
> | Thanks this fixed it, I'll do some more testing and remove it from
> | local.cf and/or /etc/MailScanner/spam.assassin.prefs.conf and will post
> | the results.
> |
> | And offcourse add a faq item ;-)
> |
> | Thanks
> | Stijn
> Your welcome. I was hit by the same prob. a few weeks back.
> Luckily, as I beat MY head against the wall, I didn't forget what I did.

I have the same problem but can't figure out the solution you describe
above?

[root@linux spamassassin]# locate init.pre
/etc/mail/spamassassin/init.pre


I have an init.pre already in /etc/mail/spamassassin how can I link or
copy it again to that?

Thanks!

> (top posting fixed)
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.1 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQFBfo7pRADw9lziUqQRAvi3AJ9ys5DnZdiQael0IeIsaqrdOlyEXwCfQlVC
> wRi5tr1QJMjJ8aJ+BCs6YWo=
> =Q1Ej
> -----END PGP SIGNATURE-----
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From SJCJonker at SJC.NL  Tue Oct 26 21:48:09 2004
From: SJCJonker at SJC.NL (Stijn Jonker)
Date: Thu Jan 12 21:27:23 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.3989.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Remco,

Remco Barendse said the following on 26-Oct-04 22:43:
> On Tue, 26 Oct 2004, Scott Silva wrote:
>
> | Scott Silva said the following on 26-Oct-04 17:30:
> |
> |> <<Snip>>
> |>|> But whatever I do i don't see any hits on the rules with
> |> URIBL/SURBL and
> |>|> or SPF. Although I couldn't find it back in the list I believe i need
> |>|> the latest beta for SPF support, but URIBL should work.
> |>|>
> |>|> I check some of the spam only minutes after they where received on
> |>|> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
> |>|> listed in one or more lists.
> |>|>
> |>|> The only rule scoring I modified in local.cf is:
> |>|> score ALL_TRUSTED 0
> |>|
> |>| What does a SA --lint tell you ?
> |>|
> |>|> Is there somebody who can offer some adivce on how to troubleshoot
> |>|> and/or find the culprit for this?
> |> Check to see if you have a "/etc/mail/spamassassin/init.pre" You might
> |> find it instead in "/usr/etc/mail/spamassassin/init.pre". Copy (or link
> |> might work) to /etc/mail/spamassassin and restart MailScanner just to be
> |> safe

> Stijn Jonker wrote:
> | Thanks this fixed it, I'll do some more testing and remove it from
> | local.cf and/or /etc/MailScanner/spam.assassin.prefs.conf and will post
> | the results.
> |
> | And offcourse add a faq item ;-)
> |

> Your welcome. I was hit by the same prob. a few weeks back.
> Luckily, as I beat MY head against the wall, I didn't forget what I did.
>
>
>> I have the same problem but can't figure out the solution you describe
>> above?
>
>> [root@linux spamassassin]# locate init.pre
>> /etc/mail/spamassassin/init.pre
>
>> I have an init.pre already in /etc/mail/spamassassin how can I link or
>> copy it again to that?
>

Maybe your default and/or user rules dir is set diffrently, if you do
spamassassin --prefs-file=<path>/spam.assassin.prefs.conf --lint -D and
see if it's indeed /etc/mail/spamassassin for your local rules?

P.S. Just a wild guess...

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
Met Vriendelijke groet/Yours Sincerely
Stijn Jonker <SJCJonker@sjc.nl>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wright at CYBERVALE.COM  Tue Oct 26 20:49:41 2004
From: wright at CYBERVALE.COM (Terran Wright)
Date: Thu Jan 12 21:27:23 2006
Subject: Bayes dir permissions
Message-ID: <mailman.3990.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> > Guy's
> >
> > running Postfix+MS+SA3
> >
> > what are the correct permissions for the bayes dir and files
> >

> What do you get if you, as root, run "sa-learn --sync"?
>
> If that fails with a similar message your db is screwed and you need to
> start over by deleting the files.


output below:

sa-learn --dbpath /etc/MailScanner/bayes --sync
Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/W: tie failed:
File exists
Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/W: tie failed:
File exists

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Tue Oct 26 22:01:20 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:23 2006
Subject: Bayes dir permissions
Message-ID: <mailman.3991.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Terran Wright wrote:
> output below:
>
> sa-learn --dbpath /etc/MailScanner/bayes --sync
> Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/W: tie failed:
> File exists
> Cannot open bayes databases /etc/MailScanner/bayes/bayes_* R/W: tie failed:
> File exists

You ran that as root and root has read and write permissions, am I
right? If so, the db is corrupt and I have never been able to fix mine
but you could try --import first. If that also fails you just delete the
files and SA will start over by creating them again. Don't worry, it
will learn pretty quick by itself.

This is usually caused by the infamous expire problem in my experience,
search the archives for it.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Tue Oct 26 22:12:50 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:23 2006
Subject: Bayes dir permissions
Message-ID: <mailman.3992.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Bonivart wrote:
> You ran that as root and root has read and write permissions, am I
> right? If so, the db is corrupt and I have never been able to fix mine
> but you could try --import first. If that also fails you just delete the
> files and SA will start over by creating them again. Don't worry, it
> will learn pretty quick by itself.

Sorry for replying to my own post but if you're really worried about
deleting your Bayes files you can of course just rename or move them
instead of deleting them. It doesn't matter to SA and you can switch
back if the problem is something else.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Tue Oct 26 23:16:10 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.3993.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

There is a new virus out called variously
    W32/Mabuto.B@mm (F-Prot)
    W32/Mabutu-A (Sophos)

This virus exploits a hole in the MIME-tools modules. I have added a
patch to MailScanner to save you having to mess with the MIME-tools
directly.

Attached is a patch to /usr/lib/MailScanner/MailScanner/Message.pm which
will add a function to solve the problem. If you don't know how to apply
a patch, then something like
    cd /usr/lib/MailScanner/MailScanner
    patch -p0 < Message.pm.patch
should do the trick. If it rejects the patch on your version of
MailScanner, just take a look at the patch file and insert the code by hand.

I am also putting together a new beta-release including this patch (and
an improvement to the phishing net) which I will publish very shortly.

The result of the patch will be that these infected messages are
rejected as unparsable. This is not ideal, but will have to do for now.
I will try to produce a better solution in the next few days. The MIME
header analysis code gets really difficult to follow :-(

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2: "Attached Text" ]

--- Message.pm.old      Tue Oct 26 22:11:47 2004
+++ Message.pm  Tue Oct 26 22:12:42 2004
@@ -4343,6 +4345,24 @@
   if(scalar(@{$arr}) && $arr->[0] =~ /\A\s*\Z/o);

  $me;
+}
+
+#
+# Over-ride the MIME boundary extracting code so that we fail to parse
+# messages with an empty MIME boundary. Best I can do for now.
+#
+
+package MIME::Parser::Reader;
+
+sub add_boundary {
+    my ($self, $bound) = @_;
+    unshift @{$self->{Bounds}}, $bound;   ### now at index 0
+    # JKF Fix problem with the Britney virus
+    $bound = "" if $bound eq '""';
+    # JKF End
+    $self->{BH}{"--$bound"}   = "DELIM $bound";
+    $self->{BH}{"--$bound--"} = "CLOSE $bound";
+    $self;
 }

 #

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From drew at THEMARSHALLS.CO.UK  Tue Oct 26 23:25:26 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:23 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.3994.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> There is a new virus out called variously
>    W32/Mabuto.B@mm (F-Prot)
>    W32/Mabutu-A (Sophos)
>
> This virus exploits a hole in the MIME-tools modules. I have added a
> patch to MailScanner to save you having to mess with the MIME-tools
> directly.
>
> Attached is a patch to /usr/lib/MailScanner/MailScanner/Message.pm which
> will add a function to solve the problem. If you don't know how to apply
> a patch, then something like
>    cd /usr/lib/MailScanner/MailScanner
>    patch -p0 < Message.pm.patch
> should do the trick. If it rejects the patch on your version of
> MailScanner, just take a look at the patch file and insert the code by
> hand.
>
> I am also putting together a new beta-release including this patch (and
> an improvement to the phishing net) which I will publish very shortly.
>
> The result of the patch will be that these infected messages are
> rejected as unparsable. This is not ideal, but will have to do for now.
> I will try to produce a better solution in the next few days. The MIME
> header analysis code gets really difficult to follow :-(

All patched fine, thanks Julian. Wonder if any one else has noticed this
'little' flaw...

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From pg at NEWHONEST.COM  Wed Oct 27 05:22:44 2004
From: pg at NEWHONEST.COM (Jason)
Date: Thu Jan 12 21:27:23 2006
Subject: failed installing the clam-8.0 and Spamassissin-3.0 package from
    MailScanner.info with "./INSTALL-rpm.sh"
Message-ID: <mailman.3995.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,
 
    I encountered the following error at the end of executing
"./INSTALL-rpm.sh". What should I do?
 
error: Failed dependencies:
        perl(Mail::SpamAssassin::CmdLearn) is needed by (installed)
spamassassin-2.63-1
        perl(Mail::SpamAssassin::NoMailAudit) is needed by (installed)
spamassassin-2.63-1
        perl(Mail::SpamAssassin::NoMailAudit) is needed by (installed)
spamassassin-tools-2.63-1
        perl-Mail-SpamAssassin = 2.63-1 is needed by (installed)
spamassassin-2.63-1
        perl-Mail-SpamAssassin = 2.63-1 is needed by (installed)
spamassassin-tools-2.63-1
 
Jason
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mark at TIPPINGMAR.COM  Wed Oct 27 05:39:51 2004
From: mark at TIPPINGMAR.COM (Mark Nienberg)
Date: Thu Jan 12 21:27:23 2006
Subject: failed installing the clam-8.0 and Spamassissin-3.0 package
    from MailScanner.info with "./INSTALL-rpm.sh"
Message-ID: <mailman.3996.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tuesday, October 26, 2004, at 09:22  PM, Jason wrote: 
    I encountered the following error at the end of executing "./INSTALL-rpm.sh". What should I do?
 
error: Failed dependencies:
        perl(Mail::SpamAssassin::CmdLearn) is needed by (installed) spamassassin-2.63-1
        perl(Mail::SpamAssassin::NoMailAudit) is needed by (installed) spamassassin-2.63-1
        perl(Mail::SpamAssassin::NoMailAudit) is needed by (installed) spamassassin-tools-2.63-1
        perl-Mail-SpamAssassin = 2.63-1 is needed by (installed) spamassassin-2.63-1
        perl-Mail-SpamAssassin = 2.63-1 is needed by (installed) spamassassin-tools-2.63-1

rpm -e spamassassin spamassassin-tools

then try the install script again

Mark Nienberg



From pg at NEWHONEST.COM  Wed Oct 27 06:23:40 2004
From: pg at NEWHONEST.COM (Jason)
Date: Thu Jan 12 21:27:23 2006
Subject: failed installing the clam-8.0 and Spamassissin-3.0 package
    from MailScanner.info with "./INSTALL-rpm.sh"
Message-ID: <mailman.3997.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Thank you. You solution solved my problem.
 
Jason
      ----- Original Message -----
From: Mark Nienberg
To: MAILSCANNER@JISCMAIL.AC.UK
Sent: Wednesday, October 27, 2004 12:39 PM
Subject: Re: failed installing the clam-8.0 and Spamassissin-3.0
package from MailScanner.info with "./INSTALL-rpm.sh"

On Tuesday, October 26, 2004, at 09:22 PM, Jason wrote: 
      <?fontfamily><?param Arial><?smaller>    I encountered
      the following error at the end of executing
      "./INSTALL-rpm.sh". What should I
      do?<?/smaller><?/fontfamily>
       
      <?fontfamily><?param Arial><?smaller>error: Failed
      dependencies:
              perl(Mail::SpamAssassin::CmdLearn) is needed by
      (installed) spamassassin-2.63-1
              perl(Mail::SpamAssassin::NoMailAudit) is needed
      by (installed) spamassassin-2.63-1
              perl(Mail::SpamAssassin::NoMailAudit) is needed
      by (installed) spamassassin-tools-2.63-1
              perl-Mail-SpamAssassin = 2.63-1 is needed by
      (installed) spamassassin-2.63-1
              perl-Mail-SpamAssassin = 2.63-1 is needed by
      (installed) spamassassin-tools-2.63-1
      <?/smaller><?/fontfamily>


rpm -e spamassassin spamassassin-tools

then try the install script again

Mark Nienberg

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From dfilchak at sympatico.ca  Wed Oct 27 06:41:45 2004
From: dfilchak at sympatico.ca (Dave Filchak)
Date: Thu Jan 12 21:27:23 2006
Subject: update_virus_scanners
Message-ID: <mailman.3998.1137101243.24926.mailscanner@lists.mailscanner.info>

So, I finally got this working but I need to have a few things clarified.
The fix seems to be that when I updated to ClamAV 0.80 that I ended up with
two sets of conf files. One freshclam.conf at /usr/local/etc/freshclam.conf
(the old one) and one at /etc/freshclam.conf (the new one). As well, I had
/usr/local/etc/clamd.conf (the old one) and /etc/clamd.conf. Have the
default directories changed from /usr/local/etc or is /etc/ the default
directory for these conf files?  Whatever the case, freshclam seems to be
looking for these conf files under /etc/. Where should these conf files be
and if mine are in the wrong place (even though it seems to be working) how
do I set it back to the default?

Cheers

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Dave Filchak
Sent: Tuesday, October 26, 2004 1:52 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] update_virus_scanners

Are you saying to add this to the update_virus_scanners script in
cron.hourly or if not, where are you referring to? My path is as follows and
should be OK:

/usr/kerberos/sbin:/usr/kerberos/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/loca
l/bin:/usr/local/sbin:/usr/bin/X11:/usr/X11R6/bin:/root/bin:/usr/local/mysql
:/usr/sbin:/sbin:/usr/local/bin

Thanks

Dave

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Hans Melgers
Sent: Tuesday, October 26, 2004 12:05 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: [MAILSCANNER] update_virus_scanners

Is your path ok ?
Try adding a path statement in the script, something like

# could be needed for cron
export PATH=$PATH:/bin:/usr/bin:/usr/local/bin

Hans

> -----Original Message-----
> From: MailScanner mailing list
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dave Filchak
> Sent: dinsdag 26 oktober 2004 16:38
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: update_virus_scanners
>
>
> Permissions on /tmp are right:
>
> stat /tmp
>   File: `/tmp'
>   Size: 11264           Blocks: 22         IO Block: 4096   Directory
> Device: 801h/2049d      Inode: 2           Links: 11
> Access: (1777/drwxrwxrwt)  Uid: (    0/    root)   Gid: (
> 0/    root)
> Access: 2004-10-26 09:15:24.000000000 -0400
> Modify: 2004-10-26 10:33:16.000000000 -0400
> Change: 2004-10-26 10:33:16.000000000 -0400
>
> And  perl -w /usr/lib/MailScanner/clamav-autoupdate shows no errors.
>
> Dave
>
> -----Original Message-----
> From: David Jacobson [mailto:davidj@synaq.com]
> Sent: Tuesday, October 26, 2004 10:03 AM
> To: dfilchak@sympatico.ca
> Cc: MAILSCANNER@JISCMAIL.AC.UK
> Subject: RE: update_virus_scanners
>
> Hi,
>
> Does "perl -w /usr/lib/MailScanner/clamav-autoupdate" show any errors?
>
> Also what are your /tmp directory permissions? (Should be
> 1777) you can see this by issuing "stat /tmp"
>
>
> On Tue, 2004-10-26 at 15:10, Dave Filchak wrote:
> > Thanks for your reply. Tried what you suggested and really
> cannot see
> > anything weird. It finds ClamAV installed and finds generic
> installed
> > but nothing else, which is normal.
> >
> > + SCANNERSCONF=/etc/MailScanner/virus.scanners.conf
> > + LOCKFILE=/tmp/MailScanner.autoupdate.lock
> > ++ perl -e 'print "young" if -f
> "/tmp/MailScanner.autoupdate.lock" &&
> > ++ -M
> > "/tmp/MailScanner.autoupdate.lock"<0.042'
> > + '[' x = xyoung ']'
> > + trap 'rm -f /tmp/MailScanner.autoupdate.lock' EXIT touch
> > + /tmp/MailScanner.autoupdate.lock umask 022
> > ++ uname
> > + OS=Linux
> > + '[' Linux = SunOS ']'
> > + GREP=grep
> > + cat /etc/MailScanner/virus.scanners.conf
> > + sed -e 's/#.*$//'
> > + grep -e -wrapper
> >
> > <SNIP>
> >
> > + read NAME WRAPPER PACKAGEDIR
> > ++ echo /usr/lib/MailScanner/clamav-wrapper
> > ++ sed -e 's/-wrapper$/-autoupdate/'
> > + UPDATER=/usr/lib/MailScanner/clamav-autoupdate
> > + '[' -n clamav -a -n /usr/lib/MailScanner/clamav-wrapper
> -a -n /usr ']'
> > + /usr/lib/MailScanner/clamav-wrapper /usr -IsItInstalled logger -p
> > + mail.info -t update.virus.scanners Found clamav installed '[' -x
> > + /usr/lib/MailScanner/clamav-autoupdate ']'
> > + logger -p mail.info -t update.virus.scanners Running
> autoupdate for
> > + clamav /usr/lib/MailScanner/clamav-autoupdate /usr
> >
> > <SNIP>
> >
> > + read NAME WRAPPER PACKAGEDIR
> > ++ echo /usr/lib/MailScanner/generic-wrapper
> > ++ sed -e 's/-wrapper$/-autoupdate/'
> > + UPDATER=/usr/lib/MailScanner/generic-autoupdate
> > + '[' -n generic -a -n /usr/lib/MailScanner/generic-wrapper
> -a -n / ']'
> > + /usr/lib/MailScanner/generic-wrapper / -IsItInstalled logger -p
> > + mail.info -t update.virus.scanners Found generic installed '[' -x
> > + /usr/lib/MailScanner/generic-autoupdate ']'
> > + logger -p mail.info -t update.virus.scanners Running
> autoupdate for
> > generic
> > + /usr/lib/MailScanner/generic-autoupdate /
> >
> > I have edited out the non-pertinent portions. So, as far as I can
> > tell, this part seems fine. The only thing might be the
> lockfile. I do
> > not see this being created when this is run but it is hard to tell.
> >
> > Any other ideas??
> >
> > Dave
> >
> > -----Original Message-----
> > From: David Jacobson [mailto:davidj@synaq.com]
> > Sent: Tuesday, October 26, 2004 2:49 AM
> > To: dfilchak@sympatico.ca
> > Subject: Re: update_virus_scanners
> >
> > Hi,
> >
> > Perhaps try appending -x to the end of the #!/bin/bash line in
> > /usr/sbin/update_virus_scanners and look for any glaring errors.
> >
> > On Tue, 2004-10-26 at 06:34, Dave Filchak wrote:
> > > OK .. I have managed to confuse the hell out of myself and really
> > > could use someone to put me out of my misery. I have just updated
> > > one of my servers to Mail::ClamAV 0.12 and MailScanner
> 4.35.5. After
> > > a bit of fiddling that went OK. However, while I was
> doing that, I
> > > decided to again tackle the update_virus_scanners issue I
> have been
> > > having in that I keep getting an error like the following
> when I run
> > > or cron runs
> > update_virus_scanners:
> > >
> > > Oct 26 00:00:21 ebony update.virus.scanners: Found clamav
> installed
> > > Oct 26 00:00:21 ebony update.virus.scanners: Running
> autoupdate for
> > > clamav Oct 26 00:00:21 ebony ClamAV-autoupdate[13664]: ClamAV
> > > updater failed
> > >
> > > However, if I run freshclam -v I get:
> > >
> > > Current working dir is /usr/local/share/clamav Max retries == 3
> > > ClamAV update process started at Tue Oct 26 00:01:13 2004
> Connected
> > > to database.clamav.net (65.110.48.11).
> > > Reading CVD header (main.cvd): OK
> > > main.cvd is up to date (version: 27, sigs: 23982,
> f-level: 2, builder:
> > > tomek)
> > > Connected to database.clamav.net (65.110.48.11).
> > > Reading CVD header (daily.cvd): OK daily.cvd is up to date
> > > (version: 550, sigs: 1607,
> f-level: 3, builder:
> > > trog)
> > > Freeing option list...done
> > >
> > > Finally, if I run /usr/lib/MailScanner/clamav-autoupdate I get:
> > >
> > > Oct 26 00:03:29 ebony ClamAV-autoupdate[14073]: ClamAV
> did not need
> > > updating
> > >
> > > in my maillog. Also, in clamav-autoupdate, I have changed the log
> > > directory to /var/log/clamav/ClamAV.update.log and in there I get:
> > >
> > > ClamAV update process started at Tue Oct 26 00:03:28 2004
> main.cvd
> > > is up to date (version: 27, sigs: 23982, f-level: 2, builder:
> > > tomek)
> > > daily.cvd is up to date (version: 550, sigs: 1607,
> f-level: 3, builder:
> > > trog)
> > >
> > > So, apparently /etc/cron.hourly/update_virus_scanners if
> not working
> > > and also apparently, I am too dull to figure out why.
> > >
> > > Can someone PLEASE help me out and tell me what they
> think is going
> > > on
> > here?
> > > I know it is probably stupid of me but sometimes you just gotta
> > > throw your hands in the air and yell for help.
> > >
> > > Dave
> > >
> > > ------------------------ MailScanner list
> ------------------------
> > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > > 'leave mailscanner' in the body of the email.
> > > Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and
> > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> > --
> > Regards,
> >
> > David Jacobson
> > Technical Director
> > SYNAQ (Pty) Ltd
> >
> > Tel:  011 290 6388
> > Cell: 083 235 0760
> > Mail: davidj@synaq.com
> > WWW:  http://www.synaq.com
> >
> > Key Fingerprint
> > 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
> --
> Regards,
>
> David Jacobson
> Technical Director
> SYNAQ (Pty) Ltd
>
> Tel:    011 290 6388
> Cell:   083 235 0760
> Mail:   davidj@synaq.com
> WWW:    http://www.synaq.com
>
> Key Fingerprint
> 8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1
>
> ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ
> (http://www.mailscanner.biz/maq/) and the archives
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From vlado at AGENDA.SI  Wed Oct 27 08:01:06 2004
From: vlado at AGENDA.SI (Vladimir Nikolic)
Date: Thu Jan 12 21:27:23 2006
Subject: mailscanner strange problem
Message-ID: <mailman.3999.1137101243.24926.mailscanner@lists.mailscanner.info>

I've realized that everything is working ok except option 'Restart Every
= 14400'. I see lines in log - 'MailScanner child dying of old age'
approximately every 4 hours but sometimes there is not 5 these lines
(for every MailScanner child). Process which is not restarted then eats
up resources and by some time MailScanner stops.

Regards,
Vlado

Martin Hepworth wrote:
> Vladimir
>
> quite a jump...
>
> anyway what O/S. MTA etc.
>
> what does mailscanner -v give you, so we can check the versions of perl
> modules.
>
> Are you using SA? If you are what version?
>
> Are you using any anti-virus, if so which on and wnat version.
>
> Have you tried putting MS into debug mode and running check mailscanner
> to see if you can spot where it's doing odd things?
>
> have you looked in the log files to see if there's anything
> 'interesting' there?
>
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Vladimir Nikolic wrote:
>
>> Hi!
>>
>> After upgrade to 4.34.8 (from 4.21.9) mailscanner doesn't work right.
>> Trouble is that mailscanner child processes are creating their own child
>> processes which then run without control and by the time take all
>> resources.
>> I've tried wiht downgrade to 4.21.9 but it didn't help. Mailscanner acts
>>  the same.
>>
>> Regards,
>> Vlado
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mlm at LOANPROCESSING.NET  Tue Oct 26 23:38:18 2004
From: mlm at LOANPROCESSING.NET (Mike McMullen)
Date: Thu Jan 12 21:27:23 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4000.1137101243.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> >    cd /usr/lib/MailScanner/MailScanner
> >    patch -p0 < Message.pm.patch
> > should do the trick. If it rejects the patch on your version of
> > MailScanner, just take a look at the patch file and insert the code by
> > hand.

Hi Julian,

What versions of MailScanner will this patch work on or do you at least recommend?

Thanks,

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 08:47:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:23 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4001.1137101243.24926.mailscanner@lists.mailscanner.info>

It made need to be applied manually, but the code will work with almost any
version beyond 4.00.1.


On 26/10/04 11:38 pm, "Mike McMullen" <mlm@LOANPROCESSING.NET> wrote:

>>>    cd /usr/lib/MailScanner/MailScanner
>>>    patch -p0 < Message.pm.patch
>>> should do the trick. If it rejects the patch on your version of
>>> MailScanner, just take a look at the patch file and insert the code by
>>> hand.
>
> Hi Julian,
>
> What versions of MailScanner will this patch work on or do you at least
> recommend?
>
> Thanks,
>
> Mike
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Wed Oct 27 09:40:21 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:24 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4002.1137101243.24926.mailscanner@lists.mailscanner.info>

Julian

FYI i patched my 4.32.5 on FreeBSD with no issues.

However I did catch a Mabutu-A last night without the patch, both
SophosSAVI and CLAMAV (command line, not module) caught it.

my MIME:: modules are the following versions (prob from about a year ago
when I first installed MS)

5.403   MIME::Decoder
5.403   MIME::Decoder::UU
5.403   MIME::Head
5.406   MIME::Parser
5.411   MIME::Tools

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Julian Field wrote:
> It made need to be applied manually, but the code will work with almost any
> version beyond 4.00.1.
>
>
> On 26/10/04 11:38 pm, "Mike McMullen" <mlm@LOANPROCESSING.NET> wrote:
>
>
>>>>   cd /usr/lib/MailScanner/MailScanner
>>>>   patch -p0 < Message.pm.patch
>>>>should do the trick. If it rejects the patch on your version of
>>>>MailScanner, just take a look at the patch file and insert the code by
>>>>hand.
>>
>>Hi Julian,
>>
>>What versions of MailScanner will this patch work on or do you at least
>>recommend?
>>
>>Thanks,
>>
>>Mike
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From martinh at SOLID-STATE-LOGIC.COM  Wed Oct 27 09:50:28 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:24 2006
Subject: OT - JISCmail listserv oddity
Message-ID: <mailman.4003.1137101244.24926.mailscanner@lists.mailscanner.info>

All

I just sent and email to the list where the first line was 'OK' and only
that word on the frst line.

The  listserv software on jiscmail treated this as a listserv command,
and rejected it....

Could someone (Julian?) have a word with the nice admins at jiscmail and
see if they can sort out this little 'feature'


Ta
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From davidj at synaq.com  Wed Oct 27 11:39:43 2004
From: davidj at synaq.com (David Jacobson)
Date: Thu Jan 12 21:27:24 2006
Subject: Redundancy ... again
Message-ID: <mailman.4004.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi all,

MailScanner, as everyone knows is an unbelievable product.  The backend
is superb and it does exactly what we require and more.

Mailwatch is also a great product in terms of giving people the
flexibility to learn/release messages etc. (Been at version 0.5.1 for
quite a while now due to Steve getting married!)

Now setting up redundancy with MailScanner is not rocket science, you
setup a few identical machines and you append multiple MX records.

The problem we are experiencing is some of our customers love the web
interface and do not want to get rid of it.  Therefore with our new
servers we need to somehow consolidate it so to the end user they
still have one interface to see all mail.  There is a distributed
setup option in mailwatch, however I'm not 100% sure if its quite there
yet.  My question to the list is, is there anyone out there who has
full redundancy and also provide their customers with a web interface
which shows all the information and provides them with the ability to
release/learn etc.

Anyone who has done such a setup I would love to know how you did it
and the way you went about it, as we are trying to spec out how to do
this with still giving the customers the functionality that they require
and bettering our service by putting in a lot of redundancy.

Any pointers/stories would be great.

Look forward to hearing what other people have done...

-- 
Regards,

David Jacobson
Technical Director
SYNAQ (Pty) Ltd

Tel:    011 290 6388
Cell:   083 235 0760
Mail:   davidj@synaq.com
WWW:    http://www.synaq.com	

Key Fingerprint
8246 FCE1 3C22 7EFB E61B  18DF 6E8B 65E8 BD50 78A1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, "This is a digitally signed message part"  ]
    [ Application/PGP-SIGNATURE  196bytes. ]
    [ Unable to print this part. ]


From tonioli at gmail.com  Wed Oct 27 12:44:55 2004
From: tonioli at gmail.com (Felipe Tonioli)
Date: Thu Jan 12 21:27:24 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4005.1137101244.24926.mailscanner@lists.mailscanner.info>

Catch here too without the patch...

Worm.Mabutu.A-unp ClamAV 29/09/04 02:16:53 2
Win32.Mabutu.A@mm BitDefender 29/09/04 02:16:53 2



On Wed, 27 Oct 2004 09:40:21 +0100, Martin Hepworth
<martinh@solid-state-logic.com> wrote:
> Julian
>
> FYI i patched my 4.32.5 on FreeBSD with no issues.
>
> However I did catch a Mabutu-A last night without the patch, both
> SophosSAVI and CLAMAV (command line, not module) caught it.
>
> my MIME:: modules are the following versions (prob from about a year ago
> when I first installed MS)
>
> 5.403   MIME::Decoder
> 5.403   MIME::Decoder::UU
> 5.403   MIME::Head
> 5.406   MIME::Parser
> 5.411   MIME::Tools
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
>
>
> Julian Field wrote:
> > It made need to be applied manually, but the code will work with almost any
> > version beyond 4.00.1.
> >
> >
> > On 26/10/04 11:38 pm, "Mike McMullen" <mlm@LOANPROCESSING.NET> wrote:
> >
> >
> >>>>   cd /usr/lib/MailScanner/MailScanner
> >>>>   patch -p0 < Message.pm.patch
> >>>>should do the trick. If it rejects the patch on your version of
> >>>>MailScanner, just take a look at the patch file and insert the code by
> >>>>hand.
> >>
> >>Hi Julian,
> >>
> >>What versions of MailScanner will this patch work on or do you at least
> >>recommend?
> >>
> >>Thanks,
> >>
> >>Mike
> >>
> >>------------------------ MailScanner list ------------------------
> >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> >>'leave mailscanner' in the body of the email.
> >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >>
> >
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > Buy the MailScanner book at www.MailScanner.info/store
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>


--
Felipe Tonioli

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jaearick at COLBY.EDU  Wed Oct 27 12:54:50 2004
From: jaearick at COLBY.EDU (Jeff A. Earickson)
Date: Thu Jan 12 21:27:24 2006
Subject: Quarantine: don't save core files
Message-ID: <mailman.4006.1137101244.24926.mailscanner@lists.mailscanner.info>

Julian,

I reported a few days ago about an ancient boot virus that caused
sophos to core.  MailScanner obligingly moved the core files to
quarantine, filling up my filesystem.  I know this is an oddball
case, but maybe MS can do an unlink("core") as part of the quarantine
step to keep cores outta there.  One could always recreate the
core by hand for Sophos Inc from the contents of the quarantine.

Jeff Earickson
Colby College

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct 27 13:11:50 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:24 2006
Subject: Quarantine: don't save core files
Message-ID: <mailman.4007.1137101244.24926.mailscanner@lists.mailscanner.info>

> Julian,
>
> I reported a few days ago about an ancient boot virus that
> caused sophos to core.  MailScanner obligingly moved the core
> files to quarantine, filling up my filesystem.  I know this
> is an oddball case, but maybe MS can do an unlink("core") as
> part of the quarantine step to keep cores outta there.  One
> could always recreate the core by hand for Sophos Inc from
> the contents of the quarantine.
>
> Jeff Earickson
> Colby College
Jeff

Couldn't you add that virus to the "silent" list and not quarantine it?

Michele



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Wed Oct 27 13:13:12 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:24 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4008.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi!

> Catch here too without the patch...
>
> Worm.Mabutu.A-unp ClamAV 29/09/04 02:16:53 2
> Win32.Mabutu.A@mm BitDefender 29/09/04 02:16:53 2

Same here:

21      (first @ 01:16:06, last = 13:51:00)     Worm.Mabutu.A-unp

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ryan at MARINOCRANE.COM  Wed Oct 27 13:28:01 2004
From: ryan at MARINOCRANE.COM (Ryan Pitt)
Date: Thu Jan 12 21:27:24 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4009.1137101244.24926.mailscanner@lists.mailscanner.info>

At the risk of being redundant...
Here too, without the patch...
Does this mean that it is not necessary to patch right away?
Can we wait until the next stable release which should include the patch?

***This output from MailWatch***
Sophos: >>> Virus 'W32/Mabutu-A' found in file
./i9P19KD1011381/britney.zip/britney.jpg .scr ClamAV: britney.zip
contains Worm.Mabutu.A-unp
Bitdefender: Found virus Win32.Mabutu.A@mm in file britney.zip
Sophos: >>> Virus 'W32/Mabutu-A' found in file
./i9P19KD1011381/britney.jpg .scr
ClamAV: britney.jpg .scr contains Worm.Mabutu.A-unp
Bitdefender: Found virus Win32.Mabutu.A@mm in file britney.jpg .scr
MailScanner: Very long filenames are good signs of attacks against
Microsoft e-mail packages (britney.jpg .scr)

Sophos: >>> Virus 'W32/Mabutu-A' found in file
./i9P19KD1011381/britney.jpg .scr ClamAV: britney.jpg .scr contains
Worm.Mabutu.A-unp
Bitdefender: Found virus Win32.Mabutu.A@mm in file britney.jpg .scr
MailScanner: Very long filenames are good signs of attacks against
Microsoft e-mail packages (britney.jpg .scr)

Thanks and Regards
Ryan

Felipe Tonioli wrote:

>Catch here too without the patch...
>
>Worm.Mabutu.A-unp ClamAV 29/09/04 02:16:53 2
>Win32.Mabutu.A@mm BitDefender 29/09/04 02:16:53 2
>
>
>
>On Wed, 27 Oct 2004 09:40:21 +0100, Martin Hepworth
><martinh@solid-state-logic.com> wrote:
>
>
>>Julian
>>
>>FYI i patched my 4.32.5 on FreeBSD with no issues.
>>
>>However I did catch a Mabutu-A last night without the patch, both
>>SophosSAVI and CLAMAV (command line, not module) caught it.
>>
>>my MIME:: modules are the following versions (prob from about a year ago
>>when I first installed MS)
>>
>>5.403   MIME::Decoder
>>5.403   MIME::Decoder::UU
>>5.403   MIME::Head
>>5.406   MIME::Parser
>>5.411   MIME::Tools
>>
>>--
>>Martin Hepworth
>>Snr Systems Administrator
>>Solid State Logic
>>Tel: +44 (0)1865 842300
>>
>>
>>
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 13:44:51 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Patch for new virus - Mabuto.B or Mabutu-A
Message-ID: <mailman.4010.1137101244.24926.mailscanner@lists.mailscanner.info>

If it works for you without the patch, then carry on as you are. A
properly-fixed version of MIME-tools will be released at some point later
today (though I don't know the timezone of that statement), at which point
I'll do another beta release.

Hopefully that will be the last update before the next stable release.


On 27/10/04 1:28 pm, "Ryan Pitt" <ryan@MARINOCRANE.COM> wrote:

> At the risk of being redundant...
> Here too, without the patch...
> Does this mean that it is not necessary to patch right away?
> Can we wait until the next stable release which should include the patch?
>
> ***This output from MailWatch***
> Sophos: >>> Virus 'W32/Mabutu-A' found in file
> ./i9P19KD1011381/britney.zip/britney.jpg .scr ClamAV: britney.zip
> contains Worm.Mabutu.A-unp
> Bitdefender: Found virus Win32.Mabutu.A@mm in file britney.zip
> Sophos: >>> Virus 'W32/Mabutu-A' found in file
> ./i9P19KD1011381/britney.jpg .scr
> ClamAV: britney.jpg .scr contains Worm.Mabutu.A-unp
> Bitdefender: Found virus Win32.Mabutu.A@mm in file britney.jpg .scr
> MailScanner: Very long filenames are good signs of attacks against
> Microsoft e-mail packages (britney.jpg .scr)
>
> Sophos: >>> Virus 'W32/Mabutu-A' found in file
> ./i9P19KD1011381/britney.jpg .scr ClamAV: britney.jpg .scr contains
> Worm.Mabutu.A-unp
> Bitdefender: Found virus Win32.Mabutu.A@mm in file britney.jpg .scr
> MailScanner: Very long filenames are good signs of attacks against
> Microsoft e-mail packages (britney.jpg .scr)
>
> Thanks and Regards
> Ryan
>
> Felipe Tonioli wrote:
>
>> Catch here too without the patch...
>>
>> Worm.Mabutu.A-unp ClamAV 29/09/04 02:16:53 2
>> Win32.Mabutu.A@mm BitDefender 29/09/04 02:16:53 2
>>
>>
>>
>> On Wed, 27 Oct 2004 09:40:21 +0100, Martin Hepworth
>> <martinh@solid-state-logic.com> wrote:
>>
>>
>>> Julian
>>>
>>> FYI i patched my 4.32.5 on FreeBSD with no issues.
>>>
>>> However I did catch a Mabutu-A last night without the patch, both
>>> SophosSAVI and CLAMAV (command line, not module) caught it.
>>>
>>> my MIME:: modules are the following versions (prob from about a year ago
>>> when I first installed MS)
>>>
>>> 5.403   MIME::Decoder
>>> 5.403   MIME::Decoder::UU
>>> 5.403   MIME::Head
>>> 5.406   MIME::Parser
>>> 5.411   MIME::Tools
>>>
>>> --
>>> Martin Hepworth
>>> Snr Systems Administrator
>>> Solid State Logic
>>> Tel: +44 (0)1865 842300
>>>
>>>
>>>
>>
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 27 13:42:14 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4011.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi Julian,

MS seems to forget to clean file names when a virus is detected in a ZIP 
file:
Oct 27 07:56:05 132.210.244.90 MailScanner[12979]: 
/i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM 
virus !!!
Oct 27 07:56:05 132.210.244.90 MailScanner[12979]: 
/i9RBth1s025464/message.zip/MESSAGE.TXT                                                                                                                                                      
.SCR        Found the W32/Mabutu.a@MM virus !!!

This is McAfee syslog output on MS 4.35.1.  The first line is OK but the 
second one has lots of white space...

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 27 13:49:57 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:24 2006
Subject: Quarantine: don't save core files
Message-ID: <mailman.4012.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jeff A. Earickson wrote:

> Julian,
>
> I reported a few days ago about an ancient boot virus that caused
> sophos to core.  MailScanner obligingly moved the core files to
> quarantine, filling up my filesystem.  I know this is an oddball
> case, but maybe MS can do an unlink("core") as part of the quarantine
> step to keep cores outta there.  One could always recreate the
> core by hand for Sophos Inc from the contents of the quarantine.
>
> Jeff Earickson
> Colby College


Jeff,

Couldn't you use "ulimit -c 0" in your MS start file to make core files 
nonexistent for MS and all its children?

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From rob at THEHOSTMASTERS.COM  Wed Oct 27 14:06:04 2004
From: rob at THEHOSTMASTERS.COM (Rob)
Date: Thu Jan 12 21:27:24 2006
Subject: Fw: Bayes expire results
Message-ID: <mailman.4013.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

What does this actually mean?

Just wondering if there is something I should be looking for?
:)


Rob...


Sent: Wednesday, October 27, 2004 9:04 AM
Subject: Bayes expire results


> synced Bayes databases from journal in 0 seconds: 729 unique entries (1055
> total entries)
> expired old Bayes database entries in 207 seconds
> 152020 entries kept, 56648 deleted
> token frequency: 1-occurence tokens: 58.21%
> token frequency: less than 8 occurrences: 17.40%
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From gercke at HNM.DE  Wed Oct 27 14:11:59 2004
From: gercke at HNM.DE (Daniel Gercke)
Date: Thu Jan 12 21:27:24 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.4014.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Okay i will wait until 1st November :-)

Are there any things that i must know or change before i update my 
system? Will the RPM Package obverwrite Config.pm or other Configuration 
files?

Daniel Gercke

Julian Field schrieb:
> I would advise you wait for the 1st November 4.35 stable release. 4.34 was a
> bit bumpy...
> 
> 
> On 26/10/04 12:41 pm, "Daniel Gercke" <gercke@HNM.DE> wrote:
> 
> 
>><x-flowed>
>>Hello all,
>>
>>i want to update from 4.28.5-2 to the current stable release. Are there
>>any hints that i musst know to update without runnings into Problems?
>>I´m using PRM Version.
> 
> 


--
haus neuer medien GmbH . agentur fuer neuen antrieb
.
Tel 03834 8313 0 . Fax 8313 13 . info@hnm.de . www.hnm.de
Wolgaster Strasse 146  (Ollmannsche Villa) . 17489 Greifswald
AG Stralsund HRB 5089 . Geschaeftsfuehrer RA Daniel Scheibner
.
-- 
[Diese Nachricht gilt als frei von Viren und gefaehrlichen Dateianhaengen.
Schutz vor Viren und Spam von haus neuer medien. Bei Fragen oder Interesse Kontakt ueber mailscanner@hnm.de oder 03834 83130.]

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Wed Oct 27 13:17:43 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:24 2006
Subject: Empty Zip Files
Message-ID: <mailman.4015.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm receiving a lot of empty zip files sended by some viruses... Is there
some way to block empty zip files in attachments using mailscanner? This
would be great!

Regards

Roger Jochem

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Wed Oct 27 14:52:32 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:24 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.4016.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Daniel Gercke wrote:
> Okay i will wait until 1st November :-)
>
> Are there any things that i must know or change before i update my
> system? Will the RPM Package obverwrite Config.pm or other Configuration
> files?
>

You should always check for *.rpmnew files when upgrading.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 15:28:02 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Update from 4.28.5-2
Message-ID: <mailman.4017.1137101244.24926.mailscanner@lists.mailscanner.info>

It should leave modified configuration files alone, and it should leave
CustomConfig.pm alone.

But always make sure you have a backup copy first anyway.


On 27/10/04 2:52 pm, "Ugo Bellavance" <ugob@CAMO-ROUTE.COM> wrote:

> Daniel Gercke wrote:
>> Okay i will wait until 1st November :-)
>>
>> Are there any things that i must know or change before i update my
>> system? Will the RPM Package obverwrite Config.pm or other Configuration
>> files?
>>
>
> You should always check for *.rpmnew files when upgrading.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 15:27:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4018.1137101244.24926.mailscanner@lists.mailscanner.info>

Unfortunately that one isn't easy to fix, it comes straight from the virus
report, and I'm not sure whether I can get at the real name safely from
there. Judging by the fact that it's also listed in upper case, I suspect I
can't find the safe name. The lookup table will have the lower case version.
I can't just generally force the names to lower case as that may cause other
filename clashes.


On 27/10/04 1:42 pm, "Denis Beauchemin" <Denis.Beauchemin@USHERBROOKE.CA>
wrote:

> Hi Julian,
>
> MS seems to forget to clean file names when a virus is detected in a ZIP
> file:
> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
> /i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
> virus !!!
> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
> /i9RBth1s025464/message.zip/MESSAGE.TXT
> .SCR        Found the W32/Mabutu.a@MM virus !!!
>
> This is McAfee syslog output on MS 4.35.1.  The first line is OK but the
> second one has lots of white space...
>
> Denis

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 15:30:12 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: MailScanner 4.35.7 beta release
Message-ID: <mailman.4019.1137101244.24926.mailscanner@lists.mailscanner.info>

I have just released a new beta, including a far better implementation of my
fix from last night to catch messages with null MIME boundaries. They are
now properly handled and parsed correctly, instead of being rejected as last
night's code did.

This will hopefully be the last update before the stable release on 1st
November.
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 27 15:54:13 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4020.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>Unfortunately that one isn't easy to fix, it comes straight from the virus
>report, and I'm not sure whether I can get at the real name safely from
>there. Judging by the fact that it's also listed in upper case, I suspect I
>can't find the safe name. The lookup table will have the lower case version.
>I can't just generally force the names to lower case as that may cause other
>filename clashes.
>
>
>On 27/10/04 1:42 pm, "Denis Beauchemin" <Denis.Beauchemin@USHERBROOKE.CA>
>wrote:
>  
>
>>MS seems to forget to clean file names when a virus is detected in a ZIP
>>file:
>>Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>/i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
>>virus !!!
>>Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>/i9RBth1s025464/message.zip/MESSAGE.TXT
>>.SCR        Found the W32/Mabutu.a@MM virus !!!
>>
>>This is McAfee syslog output on MS 4.35.1.  The first line is OK but the
>>second one has lots of white space...
>>    
>>
Julian,

Understood.  But what was really annoying me was the long file name 
(many spaces before the .scr).

Couldn't you just sanitize this with something like s/\s+/ /g before 
using it in reports and logs?

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 16:22:33 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4021.1137101244.24926.mailscanner@lists.mailscanner.info>

Sure. Patch for SweepViruses.pm attached.

Please let me know if it fixes the problem for you.


On 27/10/04 3:54 pm, "Denis Beauchemin" <Denis.Beauchemin@USHERBROOKE.CA>
wrote:

> Julian Field wrote:
>
>> Unfortunately that one isn't easy to fix, it comes straight from the virus
>> report, and I'm not sure whether I can get at the real name safely from
>> there. Judging by the fact that it's also listed in upper case, I suspect I
>> can't find the safe name. The lookup table will have the lower case version.
>> I can't just generally force the names to lower case as that may cause other
>> filename clashes.
>>
>>
>> On 27/10/04 1:42 pm, "Denis Beauchemin" <Denis.Beauchemin@USHERBROOKE.CA>
>> wrote:
>>
>>
>>> MS seems to forget to clean file names when a virus is detected in a ZIP
>>> file:
>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>> /i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
>>> virus !!!
>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>
>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK but the
>>> second one has lots of white space...
>>>
>>>
> Julian,
>
> Understood.  But what was really annoying me was the long file name
> (many spaces before the .scr).
>
> Couldn't you just sanitize this with something like s/\s+/ /g before
> using it in reports and logs?
>
> Denis

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/OCTET-STREAM (Name: "SweepViruses.pm.patch")  ]
    [ 728bytes. ]
    [ Unable to print this part. ]


From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 27 17:08:15 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4022.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>Sure. Patch for SweepViruses.pm attached.
>
>Please let me know if it fixes the problem for you.
>
>
>On 27/10/04 3:54 pm, "Denis Beauchemin" <Denis.Beauchemin@USHERBROOKE.CA>
>wrote:
>
>  
>
>>Julian Field wrote:
>>
>>    
>>
>>>Unfortunately that one isn't easy to fix, it comes straight from the virus
>>>report, and I'm not sure whether I can get at the real name safely from
>>>there. Judging by the fact that it's also listed in upper case, I suspect I
>>>can't find the safe name. The lookup table will have the lower case version.
>>>I can't just generally force the names to lower case as that may cause other
>>>filename clashes.
>>>
>>>
>>>On 27/10/04 1:42 pm, "Denis Beauchemin" <Denis.Beauchemin@USHERBROOKE.CA>
>>>wrote:
>>>
>>>
>>>      
>>>
>>>>MS seems to forget to clean file names when a virus is detected in a ZIP
>>>>file:
>>>>Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>/i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
>>>>virus !!!
>>>>Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>/i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>.SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>
>>>>This is McAfee syslog output on MS 4.35.1.  The first line is OK but the
>>>>second one has lots of white space...
>>>>
>>>>
>>>>        
>>>>
>>Julian,
>>
>>Understood.  But what was really annoying me was the long file name
>>(many spaces before the .scr).
>>
>>Couldn't you just sanitize this with something like s/\s+/ /g before
>>using it in reports and logs?
>>
>>Denis
>>
Julian,

It's not working.  I stopped and restarted MS and I still get the 
following in my logs (McAfee and Bitdefender output):

Oct 27 12:03:28 smtpi2 MailScanner[29112]: /i9RG3KwO029166/message.zip/MESSAGE.TXT                                                                                                                                                      .SCR        Found the W32/Mabutu.a@MM virus !!!

Oct 27 12:03:29 smtpi2 MailScanner[29112]: /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt                                                                                                                                                      .scr    infected: Win32.Mabutu.A@mm


Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ssilva at SGVWATER.COM  Wed Oct 27 17:02:46 2004
From: ssilva at SGVWATER.COM (Scott Silva)
Date: Thu Jan 12 21:27:24 2006
Subject: MailScanner & SURBL / URIBL and SPF checks
Message-ID: <mailman.4023.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stijn Jonker wrote:
| Remco,
|
| Remco Barendse said the following on 26-Oct-04 22:43:
|
|> On Tue, 26 Oct 2004, Scott Silva wrote:
|>
|> | Scott Silva said the following on 26-Oct-04 17:30:
|> |
|> |> <<Snip>>
|> |>|> But whatever I do i don't see any hits on the rules with
|> |> URIBL/SURBL and
|> |>|> or SPF. Although I couldn't find it back in the list I believe i
|> need
|> |>|> the latest beta for SPF support, but URIBL should work.
|> |>|>
|> |>|> I check some of the spam only minutes after they where received on
|> |>|> http://www.rulesemporium.com/cgi-bin/uribl.cgi and they where indeed
|> |>|> listed in one or more lists.
|> |>|>
|> |>|> The only rule scoring I modified in local.cf is:
|> |>|> score ALL_TRUSTED 0
|> |>|
|> |>| What does a SA --lint tell you ?
|> |>|
|> |>|> Is there somebody who can offer some adivce on how to troubleshoot
|> |>|> and/or find the culprit for this?
|> |> Check to see if you have a "/etc/mail/spamassassin/init.pre" You might
|> |> find it instead in "/usr/etc/mail/spamassassin/init.pre". Copy (or
|> link
|> |> might work) to /etc/mail/spamassassin and restart MailScanner just
|> to be
|> |> safe
|
|
|> Stijn Jonker wrote:
|> | Thanks this fixed it, I'll do some more testing and remove it from
|> | local.cf and/or /etc/MailScanner/spam.assassin.prefs.conf and will post
|> | the results.
|> |
|> | And offcourse add a faq item ;-)
|> |
|
|
|> Your welcome. I was hit by the same prob. a few weeks back.
|> Luckily, as I beat MY head against the wall, I didn't forget what I did.
|>
|>
|>> I have the same problem but can't figure out the solution you describe
|>> above?
|>
|>
|>> [root@linux spamassassin]# locate init.pre
|>> /etc/mail/spamassassin/init.pre
|>
|>
|>> I have an init.pre already in /etc/mail/spamassassin how can I link or
|>> copy it again to that?
|>
|>
|
| Maybe your default and/or user rules dir is set diffrently, if you do
| spamassassin --prefs-file=<path>/spam.assassin.prefs.conf --lint -D and
| see if it's indeed /etc/mail/spamassassin for your local rules?
|
| P.S. Just a wild guess...
Try this;
post results of
grep "SpamAssassin Prefs File" /etc/MailScanner/MailScanner.conf
and maybe that will give a clue.
Maybe also a MailScanner -v
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBf8alRADw9lziUqQRAkFrAJ9wXWrrYkCnceom1oXAub66ZeS1owCeMlbT
MqpHEklcV6opUMtsWYuYmq0=
=byQz
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 17:22:34 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4024.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Denis Beauchemin wrote:

> Julian Field wrote:
>
>> Sure. Patch for SweepViruses.pm attached.
>>
>> Please let me know if it fixes the problem for you.
>>
>>
>> On 27/10/04 3:54 pm, "Denis Beauchemin"
>> <Denis.Beauchemin@USHERBROOKE.CA>
>> wrote:
>>
>>
>>
>>> Julian Field wrote:
>>>
>>>
>>>
>>>> Unfortunately that one isn't easy to fix, it comes straight from
>>>> the virus
>>>> report, and I'm not sure whether I can get at the real name safely
>>>> from
>>>> there. Judging by the fact that it's also listed in upper case, I
>>>> suspect I
>>>> can't find the safe name. The lookup table will have the lower case
>>>> version.
>>>> I can't just generally force the names to lower case as that may
>>>> cause other
>>>> filename clashes.
>>>>
>>>>
>>>> On 27/10/04 1:42 pm, "Denis Beauchemin"
>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>> wrote:
>>>>
>>>>
>>>>
>>>>
>>>>> MS seems to forget to clean file names when a virus is detected in
>>>>> a ZIP
>>>>> file:
>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>> /i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
>>>>> virus !!!
>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>
>>>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK
>>>>> but the
>>>>> second one has lots of white space...
>>>>>
>>>>>
>>>>>
>>>>
>>> Julian,
>>>
>>> Understood.  But what was really annoying me was the long file name
>>> (many spaces before the .scr).
>>>
>>> Couldn't you just sanitize this with something like s/\s+/ /g before
>>> using it in reports and logs?
>>>
>>> Denis
>>>
> Julian,
>
> It's not working.  I stopped and restarted MS and I still get the
> following in my logs (McAfee and Bitdefender output):
>
> Oct 27 12:03:28 smtpi2 MailScanner[29112]:
> /i9RG3KwO029166/message.zip/MESSAGE.TXT
> .SCR        Found the W32/Mabutu.a@MM virus !!!
>
> Oct 27 12:03:29 smtpi2 MailScanner[29112]:
> /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt
> .scr    infected: Win32.Mabutu.A@mm

It wasn't the syslog output I fixed, it was the output that goes in the
user report. I would rather have the genuine text in the syslog, it's
length-limited by the syslog spec anyway.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From spamfilter2 at MUPP.NET  Wed Oct 27 17:56:07 2004
From: spamfilter2 at MUPP.NET (j2)
Date: Thu Jan 12 21:27:24 2006
Subject: PERL error?
Message-ID: <mailman.4025.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Upgraded my Debian Box yesterday, and have started to see;
 
Oct 27 18:54:13 scooter MailScanner[8712]: New Batch: Scanning 1
messages, 3820 bytes
Oct 27 18:54:13 scooter MailScanner[8712]: MCP Checks completed at 3820
bytes per second
Oct 27 18:54:13 scooter MailScanner[8712]: Spam Checks: Starting
Oct 27 18:54:13 scooter MailScanner[8712]: Message 1CMr3p-0002v9-Bx from
212.69.217.31 (owner-mailings@fortuna.dsvr.co.uk) to rubbermanor.com is
ej spam, SpamAssassin (resultat=1.936, krav 4, HTML_30_40 0.81,
HTML_FONTCOLOR_BLUE 0.10, HTML_FONTCOLOR_RED 0.10, HTML_FONT_BIG 0.10,
HTML_MESSAGE 0.00, HTML_TITLE_EMPTY 0.54, ORDER_NOW 0.28)
Oct 27 18:54:13 scooter MailScanner[8712]: Spam Checks completed at 3820
bytes per second
Oct 27 18:54:13 scooter MailScanner[8712]: Cannot parse
/var/spool/MailScanner/incoming/8712/1CMr3p-0002v9-Bx.header and , Can't
locate object method "init" via package "MIME::Decoder::QuotedPrint" at
/usr/share/perl5/MIME/Decoder.pm line 173.
Oct 27 18:54:13 scooter MailScanner[8712]: Virus and Content Scanning:
Starting
Oct 27 18:54:14 scooter MailScanner[8712]: Virus Scanning completed at
3820 bytes per second
Oct 27 18:54:14 scooter MailScanner[8712]: Saved entire message to
/var/spool/MailScanner/quarantine/20041027/1CMr3p-0002v9-Bx
Oct 27 18:54:14 scooter MailScanner[8712]: Cleaned: Delivered 1 cleaned
messages
Oct 27 18:54:14 scooter MailScanner[8712]: Virus Processing completed at
3820 bytes per second
Oct 27 18:54:14 scooter MailScanner[8712]: Disinfection completed at 3820
bytes per second
Oct 27 18:54:14 scooter MailScanner[8712]: Batch completed at 3820 bytes
per second (3820 / 1)
Oct 27 18:54:14 scooter exim: 2004-10-27 18:54:14 1CMr3p-0002v9-Bx Spool
file 1CMr3p-0002v9-Bx-D not found
What does it all mean, part from my box not delivering mail properly? Im
tried searching for an answer, but cant find anything.
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From DERMODYR at ITCARLOW.IE  Wed Oct 27 17:35:25 2004
From: DERMODYR at ITCARLOW.IE (Ray Dermody)
Date: Thu Jan 12 21:27:24 2006
Subject: Problems with Silent Viruses
Message-ID: <mailman.4026.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi,

Im trying to get MailScanner to drop (discard) email with infections. e.g
not to notify sender or recipient. Notably Netsky and Bagle.
Looking down through the documentation I conclude incorrectly that
this should work in my MailScanner.conf file

Silent Viruses = /etc/MailScanner/viruses.to.delete.conf
Still Deliver Silent Viruses = no

And my viruses.to.delete.conf file has these entries for example
W32/Klez.gen@MM
W32/Sobig.f@MM
W32/Dumaru.a@MM
W32/Bagle@MM
W32/Bagle.ai@MM
W32/Bagle.aa@MM
W32/Netsky.p@MM
W32/Netsky.z@MM
W32/Netsky.d@MM

Any ideas why the recipient is still getting notified that a virus was being
sent to them?
Any help would be greatly appreciated.

Ray.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From brent.bolin at gmail.com  Wed Oct 27 18:06:01 2004
From: brent.bolin at gmail.com (BB)
Date: Thu Jan 12 21:27:24 2006
Subject: Upgraded mailscanner and perl. Now seeing these errors in
    /var/log/messages
Message-ID: <mailman.4027.1137101244.24926.mailscanner@lists.mailscanner.info>

Oct 27 09:58:45 mail MailScanner[34011]: Uninfected: Delivered 1 messages
Oct 27 09:58:45 mail root: Process did not exit cleanly, returned 255
with signal 0
Oct 27 09:58:45 mail MailScanner[34220]: MailScanner E-Mail Virus
Scanner version 4.35.5 starting...
Oct 27 09:58:45 mail MailScanner[34220]: Config: calling custom init
function MailWatchLogging
Oct 27 09:58:45 mail sendmail[34219]: i9REwfaG034201:
to=<brent@somewhere.com>, delay=00:00:04, xdelay=00:00:00,
mailer=local,
 pri=121685, dsn=2.0.0, stat=Sent
Oct 27 10:00:01 mail pflogd[536]: Reopened logfile


The above error was captured using these two commands

tail -f /var/log/messages &

Then

tail -f /var/log/maillog

Here is the error message in /var/log/messages

root: Process did not exit cleanly, returned 255 with signal 0

Mail is still delivered fine with this error message.

If I turn spamassassin off in mailscanner.conf the error message stops.

Any ideas

FreeBSD 5.2
MailScanner-devel-4.35.5
perl-5.8.5

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wagner at MILLER-ENGINEERING.COM  Wed Oct 27 17:58:16 2004
From: wagner at MILLER-ENGINEERING.COM (Joseph Wagner)
Date: Thu Jan 12 21:27:24 2006
Subject: PLEASE HELP
Message-ID: <mailman.4028.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I keep getting this error when I run MailScanner in Debug mode.
Can someone please help me.  I haven't been able to find an answer anywhere.


ack! no binary decoder! at /usr/lib/perl5/site_perl/5.8.3/MIME/Entity.pm
line 1851

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From spamfilter2 at MUPP.NET  Wed Oct 27 18:06:51 2004
From: spamfilter2 at MUPP.NET (j2)
Date: Thu Jan 12 21:27:24 2006
Subject: PERL error?
Message-ID: <mailman.4029.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

also; my relevant packages
 
scooter:~# dpkg -l | grep perl
ii  libdbi-perl    1.45-1         The Perl5 Database Interface by Tim
Bunce
ii  libfcgi-perl   0.67-1         FastCGI Perl module
ii  libmailtools-p 1.62-1         Manipulate email in perl programs
ii  libmd5-perl    2.03-1         backwards-compatible wrapper for
Digest::MD5
ii  libmime-explod 0.36-1         perl MIME::Explode - Perl extension for
expl
ii  libmime-perl   5.414-1        Perl5 modules for MIME-compliant
messages (M
ii  libmon-perl    0.11-2         mon Perl modules for clients and server
ii  libmsgcat-perl 1.03-3         Locale::Msgcat perl module
ii  libnet-perl    1.19-1         Implementation of Internet protocols
for Per
ii  libperl5.6     5.6.1-8.2      Shared Perl library.
ii  libperl5.8     5.8.4-2.3      Shared Perl library
ii  libplrpc-perl  0.2017-1       Perl extensions for writing PlRPC
servers an
ii  liburi-perl    1.30-1         Manipulates and accesses URI strings
ii  libwww-perl    5.800-2        WWW client/server library for Perl (aka
LWP)
ii  perl           5.8.4-2.3      Larry Wall's Practical Extraction and
Report
ii  perl-base      5.8.4-2.3      The Pathologically Eclectic Rubbish
Lister
ii  perl-modules   5.8.4-2.3      Core Perl modules
ii  perl-suid      5.8.4-2.3      Runs setuid Perl scripts
ii  spamc          2.64-1         Client for perl-based spam filtering
daemon
scooter:~# dpkg -l | grep mailscanner
ii  mailscanner    4.35.3-1       An email virus scanner and spam tagger
scooter:~# dpkg -l | grep mime
ii  libmime-explod 0.36-1         perl MIME::Explode - Perl extension for
expl
ii  libmime-perl   5.414-1        Perl5 modules for MIME-compliant
messages (M
ii  libmime-types- 1.12-1         Perl extension for determining MIME
types an
ii  mime-support   3.28-1         MIME files 'mime.types' & 'mailcap',
and sup
scooter:~#
------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

From mailscanner at ecs.soton.ac.uk  Wed Oct 27 18:10:52 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Problems with Silent Viruses
Message-ID: <mailman.4030.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Virtually all viruses forge the sender so whatever you do, don't notify
senders about viruses. Please!
All you really need to do is set
    Silent Viruses = All-Viruses
    Still Deliver Silent Viruses = no
That is by far the most sensible setup. If you still want to notify for
a few particular viruses such as macro viruses which don't forge the
sender address, take a look at Non-Forging Viruses.

Ray Dermody wrote:

>Hi,
>
>Im trying to get MailScanner to drop (discard) email with infections. e.g
>not to notify sender or recipient. Notably Netsky and Bagle.
>Looking down through the documentation I conclude incorrectly that
>this should work in my MailScanner.conf file
>
>Silent Viruses = /etc/MailScanner/viruses.to.delete.conf
>Still Deliver Silent Viruses = no
>
>And my viruses.to.delete.conf file has these entries for example
>W32/Klez.gen@MM
>W32/Sobig.f@MM
>W32/Dumaru.a@MM
>W32/Bagle@MM
>W32/Bagle.ai@MM
>W32/Bagle.aa@MM
>W32/Netsky.p@MM
>W32/Netsky.z@MM
>W32/Netsky.d@MM
>
>Any ideas why the recipient is still getting notified that a virus was being
>sent to them?
>Any help would be greatly appreciated.
>
>Ray.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Wed Oct 27 18:16:31 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:24 2006
Subject: Problems with Silent Viruses
Message-ID: <mailman.4031.1137101244.24926.mailscanner@lists.mailscanner.info>

> Im trying to get MailScanner to drop (discard) email with
> infections. e.g not to notify sender or recipient. Notably Netsky and
> Bagle. Looking down through the documentation I conclude incorrectly
> that this should work in my MailScanner.conf file
>
> Silent Viruses = /etc/MailScanner/viruses.to.delete.conf
> Still Deliver Silent Viruses = no
>
> And my viruses.to.delete.conf file has these entries for
> example W32/Klez.gen@MM W32/Sobig.f@MM W32/Dumaru.a@MM
> W32/Bagle@MM W32/Bagle.ai@MM W32/Bagle.aa@MM W32/Netsky.p@MM
> W32/Netsky.z@MM W32/Netsky.d@MM
>
> Any ideas why the recipient is still getting notified that a virus
> was being sent to them? Any help would be greatly appreciated.
>
> Ray.
>
Ray

You might want to look at some of the notification options as well. The
default options can result in a lot of unwanted emails being sent :)

HTH

Michele


Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Wed Oct 27 18:09:09 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:24 2006
Subject: Problems with Silent Viruses
Message-ID: <mailman.4032.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Ray Dermody wrote:
> Hi,
>
> Im trying to get MailScanner to drop (discard) email with infections. e.g
> not to notify sender or recipient. Notably Netsky and Bagle.
> Looking down through the documentation I conclude incorrectly that
> this should work in my MailScanner.conf file
>
> Silent Viruses = /etc/MailScanner/viruses.to.delete.conf
> Still Deliver Silent Viruses = no
>
> And my viruses.to.delete.conf file has these entries for example
> W32/Klez.gen@MM
> W32/Sobig.f@MM
> W32/Dumaru.a@MM
> W32/Bagle@MM
> W32/Bagle.ai@MM
> W32/Bagle.aa@MM
> W32/Netsky.p@MM
> W32/Netsky.z@MM
> W32/Netsky.d@MM
>
> Any ideas why the recipient is still getting notified that a virus was being
> sent to them?
> Any help would be greatly appreciated.

Hi Ray,

        Please read the EXAMPLE file in the rules directory, your answer is there.

>
> Ray.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 18:02:03 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: PERL error?
Message-ID: <mailman.4033.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

What does MailScanner -v produce.

j2 wrote:

> Upgraded my Debian Box yesterday, and have started to see;
>
> Oct 27 18:54:13 scooter MailScanner[8712]: New Batch: Scanning 1
> messages, 3820 bytes
> Oct 27 18:54:13 scooter MailScanner[8712]: MCP Checks completed at
> 3820 bytes per second
> Oct 27 18:54:13 scooter MailScanner[8712]: Spam Checks: Starting
> Oct 27 18:54:13 scooter MailScanner[8712]: Message 1CMr3p-0002v9-Bx
> from 212.69.217.31 (owner-mailings@fortuna.dsvr.co.uk
> <mailto:owner-mailings@fortuna.dsvr.co.uk>) to rubbermanor.com is ej
> spam, SpamAssassin (resultat=1.936, krav 4, HTML_30_40 0.81,
> HTML_FONTCOLOR_BLUE 0.10, HTML_FONTCOLOR_RED 0.10, HTML_FONT_BIG 0.10,
> HTML_MESSAGE 0.00, HTML_TITLE_EMPTY 0.54, ORDER_NOW 0.28)
> Oct 27 18:54:13 scooter MailScanner[8712]: Spam Checks completed at
> 3820 bytes per second
> Oct 27 18:54:13 scooter MailScanner[8712]: Cannot parse
> /var/spool/MailScanner/incoming/8712/1CMr3p-0002v9-Bx.header and ,
> Can't locate object method "init" via package
> "MIME::Decoder::QuotedPrint" at /usr/share/perl5/MIME/Decoder.pm line 173.

--

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From spamfilter2 at MUPP.NET  Wed Oct 27 18:38:45 2004
From: spamfilter2 at MUPP.NET (j2)
Date: Thu Jan 12 21:27:24 2006
Subject: PERL error?
Message-ID: <mailman.4034.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> What does MailScanner -v produce.

As below.

Another thing. I would like to relase the quaratine. But, i have not saved
as queue-file (didnt see the option, now i do),  i have found that

exim -f original@from.address.here -ti < message

sends the mail off, and i have been trying to do a script to go through my
captured mails, and sending them off. Does anyone have a nice script to help
me here? I have thousands of mails :-/ Didnt notice this error fast enough,
since MOST mails went through fine.


scooter:/var/spool/MailScanner/quarantine/20041027# MailScanner -v
Running on
Linux scooter 2.4.18-bf2.4 #1 Son Apr 14 09:53:28 CEST 2002 i686 GNU/Linux
This is Perl version 5.008004 (5.8.4)

This is MailScanner version 4.35.2
Module versions are:
1.00    AnyDBM_File
1.13    Archive::Zip
1.02    Carp
1.119   Convert::BinHex
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.07    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.123   IO::Pipe
3.04    MIME::Base64
5.414   MIME::Decoder
5.414   MIME::Decoder::UU
5.414   MIME::Head
5.414   MIME::Parser
3.03    MIME::QuotedPrint
5.414   MIME::Tools
0.10    Net::CIDR
1.08    POSIX
1.77    Socket
0.05    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.808   DB_File
1.06    Digest
missing Digest::HMAC
2.33    Digest::MD5
missing Digest::SHA1
missing Inline
missing Mail::ClamAV
2.64    Mail::SpamAssassin
missing Mail::SPF::Query
missing Net::CIDR::Lite
missing Net::DNS
0.32    Net::LDAP
missing Parse::RecDescent
missing SAVI
missing Sys::Hostname::Long
2.40    Test::Harness
0.47    Test::Simple
1.95    Text::Balanced
1.30    URI

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mkettler at EVI-INC.COM  Wed Oct 27 18:51:40 2004
From: mkettler at EVI-INC.COM (Matt Kettler)
Date: Thu Jan 12 21:27:24 2006
Subject: PLEASE HELP
Message-ID: <mailman.4035.1137101244.24926.mailscanner@lists.mailscanner.info>

At 12:58 PM 10/27/2004, Joseph Wagner wrote:
>I keep getting this error when I run MailScanner in Debug mode.
>Can someone please help me.  I haven't been able to find an answer anywhere.
>
>
>ack! no binary decoder! at /usr/lib/perl5/site_perl/5.8.3/MIME/Entity.pm
>line 1851

This is generated by the mime decoder, and it happens when it's unable to
decode a section...

Any chance you can track down the mime types for the contents of the
message that generated it? This would help point out what to look at.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 27 19:13:32 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4036.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

> Denis Beauchemin wrote:
>
>> Julian Field wrote:
>>
>>> Sure. Patch for SweepViruses.pm attached.
>>>
>>> Please let me know if it fixes the problem for you.
>>>
>>>
>>> On 27/10/04 3:54 pm, "Denis Beauchemin"
>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>> wrote:
>>>
>>>
>>>
>>>> Julian Field wrote:
>>>>
>>>>
>>>>
>>>>> Unfortunately that one isn't easy to fix, it comes straight from
>>>>> the virus
>>>>> report, and I'm not sure whether I can get at the real name safely
>>>>> from
>>>>> there. Judging by the fact that it's also listed in upper case, I
>>>>> suspect I
>>>>> can't find the safe name. The lookup table will have the lower case
>>>>> version.
>>>>> I can't just generally force the names to lower case as that may
>>>>> cause other
>>>>> filename clashes.
>>>>>
>>>>>
>>>>> On 27/10/04 1:42 pm, "Denis Beauchemin"
>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>> wrote:
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> MS seems to forget to clean file names when a virus is detected in
>>>>>> a ZIP
>>>>>> file:
>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>> /i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
>>>>>> virus !!!
>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>>
>>>>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK
>>>>>> but the
>>>>>> second one has lots of white space...
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>> Julian,
>>>>
>>>> Understood.  But what was really annoying me was the long file name
>>>> (many spaces before the .scr).
>>>>
>>>> Couldn't you just sanitize this with something like s/\s+/ /g before
>>>> using it in reports and logs?
>>>>
>>>> Denis
>>>>
>> Julian,
>>
>> It's not working.  I stopped and restarted MS and I still get the
>> following in my logs (McAfee and Bitdefender output):
>>
>> Oct 27 12:03:28 smtpi2 MailScanner[29112]:
>> /i9RG3KwO029166/message.zip/MESSAGE.TXT
>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>
>> Oct 27 12:03:29 smtpi2 MailScanner[29112]:
>> /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt 
>>
>> .scr    infected: Win32.Mabutu.A@mm
>
>
> It wasn't the syslog output I fixed, it was the output that goes in the
> user report. I would rather have the genuine text in the syslog, it's
> length-limited by the syslog spec anyway.


Julian,

Then it is working, but it was not what I was looking for... 8-(

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 19:17:35 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4037.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Denis Beauchemin wrote:

> Julian Field wrote:
>
>> Denis Beauchemin wrote:
>>
>>> Julian Field wrote:
>>>
>>>> Sure. Patch for SweepViruses.pm attached.
>>>>
>>>> Please let me know if it fixes the problem for you.
>>>>
>>>>
>>>> On 27/10/04 3:54 pm, "Denis Beauchemin"
>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>> wrote:
>>>>
>>>>
>>>>
>>>>> Julian Field wrote:
>>>>>
>>>>>
>>>>>
>>>>>> Unfortunately that one isn't easy to fix, it comes straight from
>>>>>> the virus
>>>>>> report, and I'm not sure whether I can get at the real name safely
>>>>>> from
>>>>>> there. Judging by the fact that it's also listed in upper case, I
>>>>>> suspect I
>>>>>> can't find the safe name. The lookup table will have the lower case
>>>>>> version.
>>>>>> I can't just generally force the names to lower case as that may
>>>>>> cause other
>>>>>> filename clashes.
>>>>>>
>>>>>>
>>>>>> On 27/10/04 1:42 pm, "Denis Beauchemin"
>>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>>> wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>> MS seems to forget to clean file names when a virus is detected in
>>>>>>> a ZIP
>>>>>>> file:
>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>> /i9RBth1s025464/message.txt   .scr        Found the W32/Mabutu.a@MM
>>>>>>> virus !!!
>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>>>
>>>>>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK
>>>>>>> but the
>>>>>>> second one has lots of white space...
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>
>>>>> Julian,
>>>>>
>>>>> Understood.  But what was really annoying me was the long file name
>>>>> (many spaces before the .scr).
>>>>>
>>>>> Couldn't you just sanitize this with something like s/\s+/ /g before
>>>>> using it in reports and logs?
>>>>>
>>>>> Denis
>>>>>
>>> Julian,
>>>
>>> It's not working.  I stopped and restarted MS and I still get the
>>> following in my logs (McAfee and Bitdefender output):
>>>
>>> Oct 27 12:03:28 smtpi2 MailScanner[29112]:
>>> /i9RG3KwO029166/message.zip/MESSAGE.TXT
>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>
>>> Oct 27 12:03:29 smtpi2 MailScanner[29112]:
>>> /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt
>>>
>>> .scr    infected: Win32.Mabutu.A@mm
>>
>>
>>
>> It wasn't the syslog output I fixed, it was the output that goes in the
>> user report. I would rather have the genuine text in the syslog, it's
>> length-limited by the syslog spec anyway.
>
>
>
> Julian,
>
> Then it is working, but it was not what I was looking for... 8-(

That's a shame. I could edit every single output parser to do the same
trick if you like.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 19:33:42 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4038.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]



Julian Field wrote:

> Denis Beauchemin wrote:
>
>> Julian Field wrote:
>>
>>> Denis Beauchemin wrote:
>>>
>>>> Julian Field wrote:
>>>>
>>>>> Sure. Patch for SweepViruses.pm attached.
>>>>>
>>>>> Please let me know if it fixes the problem for you.
>>>>>
>>>>>
>>>>> On 27/10/04 3:54 pm, "Denis Beauchemin"
>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>> wrote:
>>>>>
>>>>>
>>>>>
>>>>>> Julian Field wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>> Unfortunately that one isn't easy to fix, it comes straight from
>>>>>>> the virus
>>>>>>> report, and I'm not sure whether I can get at the real name safely
>>>>>>> from
>>>>>>> there. Judging by the fact that it's also listed in upper case, I
>>>>>>> suspect I
>>>>>>> can't find the safe name. The lookup table will have the lower case
>>>>>>> version.
>>>>>>> I can't just generally force the names to lower case as that may
>>>>>>> cause other
>>>>>>> filename clashes.
>>>>>>>
>>>>>>>
>>>>>>> On 27/10/04 1:42 pm, "Denis Beauchemin"
>>>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>>>> wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>> MS seems to forget to clean file names when a virus is detected in
>>>>>>>> a ZIP
>>>>>>>> file:
>>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>>> /i9RBth1s025464/message.txt   .scr        Found the
>>>>>>>> W32/Mabutu.a@MM
>>>>>>>> virus !!!
>>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>>>>
>>>>>>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK
>>>>>>>> but the
>>>>>>>> second one has lots of white space...
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>> Julian,
>>>>>>
>>>>>> Understood.  But what was really annoying me was the long file name
>>>>>> (many spaces before the .scr).
>>>>>>
>>>>>> Couldn't you just sanitize this with something like s/\s+/ /g before
>>>>>> using it in reports and logs?
>>>>>>
>>>>>> Denis
>>>>>>
>>>> Julian,
>>>>
>>>> It's not working.  I stopped and restarted MS and I still get the
>>>> following in my logs (McAfee and Bitdefender output):
>>>>
>>>> Oct 27 12:03:28 smtpi2 MailScanner[29112]:
>>>> /i9RG3KwO029166/message.zip/MESSAGE.TXT
>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>
>>>> Oct 27 12:03:29 smtpi2 MailScanner[29112]:
>>>> /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt
>>>>
>>>>
>>>> .scr    infected: Win32.Mabutu.A@mm
>>>
>>>
>>>
>>>
>>> It wasn't the syslog output I fixed, it was the output that goes in the
>>> user report. I would rather have the genuine text in the syslog, it's
>>> length-limited by the syslog spec anyway.
>>
>>
>>
>>
>> Julian,
>>
>> Then it is working, but it was not what I was looking for... 8-(
>
>
> That's a shame. I could edit every single output parser to do the same
> trick if you like.

Attached is a new SweepViruses.pm. Let me know how you get on.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Application/X-GZIP  31KB. ]
    [ Unable to print this part. ]


From Denis.Beauchemin at USHERBROOKE.CA  Wed Oct 27 19:59:09 2004
From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4039.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>
>
> Julian Field wrote:
>
>> Denis Beauchemin wrote:
>>
>>> Julian Field wrote:
>>>
>>>> Denis Beauchemin wrote:
>>>>
>>>>> Julian Field wrote:
>>>>>
>>>>>> Sure. Patch for SweepViruses.pm attached.
>>>>>>
>>>>>> Please let me know if it fixes the problem for you.
>>>>>>
>>>>>>
>>>>>> On 27/10/04 3:54 pm, "Denis Beauchemin"
>>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>>> wrote:
>>>>>>
>>>>>>
>>>>>>
>>>>>>> Julian Field wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>> Unfortunately that one isn't easy to fix, it comes straight from
>>>>>>>> the virus
>>>>>>>> report, and I'm not sure whether I can get at the real name safely
>>>>>>>> from
>>>>>>>> there. Judging by the fact that it's also listed in upper case, I
>>>>>>>> suspect I
>>>>>>>> can't find the safe name. The lookup table will have the lower 
>>>>>>>> case
>>>>>>>> version.
>>>>>>>> I can't just generally force the names to lower case as that may
>>>>>>>> cause other
>>>>>>>> filename clashes.
>>>>>>>>
>>>>>>>>
>>>>>>>> On 27/10/04 1:42 pm, "Denis Beauchemin"
>>>>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>>>>> wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>> MS seems to forget to clean file names when a virus is 
>>>>>>>>> detected in
>>>>>>>>> a ZIP
>>>>>>>>> file:
>>>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>>>> /i9RBth1s025464/message.txt   .scr        Found the
>>>>>>>>> W32/Mabutu.a@MM
>>>>>>>>> virus !!!
>>>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>>>>>
>>>>>>>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK
>>>>>>>>> but the
>>>>>>>>> second one has lots of white space...
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>
>>>>>>> Julian,
>>>>>>>
>>>>>>> Understood.  But what was really annoying me was the long file name
>>>>>>> (many spaces before the .scr).
>>>>>>>
>>>>>>> Couldn't you just sanitize this with something like s/\s+/ /g 
>>>>>>> before
>>>>>>> using it in reports and logs?
>>>>>>>
>>>>>>> Denis
>>>>>>>
>>>>> Julian,
>>>>>
>>>>> It's not working.  I stopped and restarted MS and I still get the
>>>>> following in my logs (McAfee and Bitdefender output):
>>>>>
>>>>> Oct 27 12:03:28 smtpi2 MailScanner[29112]:
>>>>> /i9RG3KwO029166/message.zip/MESSAGE.TXT
>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>
>>>>> Oct 27 12:03:29 smtpi2 MailScanner[29112]:
>>>>> /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt 
>>>>>
>>>>>
>>>>>
>>>>> .scr    infected: Win32.Mabutu.A@mm
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> It wasn't the syslog output I fixed, it was the output that goes in 
>>>> the
>>>> user report. I would rather have the genuine text in the syslog, it's
>>>> length-limited by the syslog spec anyway.
>>>
>>>
>>>
>>>
>>>
>>> Julian,
>>>
>>> Then it is working, but it was not what I was looking for... 8-(
>>
>>
>>
>> That's a shame. I could edit every single output parser to do the same
>> trick if you like.
>
>
> Attached is a new SweepViruses.pm. Let me know how you get on.


Julian,

This is exactly what I was looking for!  Muchas gracias again!

Will it be included in the next release?

Denis

-- 
   _
  °v°   Denis Beauchemin, analyste
 /(_)\  Université de Sherbrooke, S.T.I.
  ^ ^   T: 819.821.8000x2252 F: 819.821.8045

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wagner at MILLER-ENGINEERING.COM  Wed Oct 27 19:58:16 2004
From: wagner at MILLER-ENGINEERING.COM (Joseph Wagner)
Date: Thu Jan 12 21:27:24 2006
Subject: PLEASE HELP
Message-ID: <mailman.4040.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I believe this is it
MIME-Version: 1.0
Content-Type: multipart/signed;
    protocol="application/x-pkcs7-signature";
    micalg=SHA1;
    boundary="----=_NextPart_000_0064_01C05EA5.93F0A3D0"
X-Loop-Detect:1

I have Digest::SHA1 module installed.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 20:06:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Small problem
Message-ID: <mailman.4041.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Denis Beauchemin wrote:

> Julian Field wrote:
>
>>
>>
>> Julian Field wrote:
>>
>>> Denis Beauchemin wrote:
>>>
>>>> Julian Field wrote:
>>>>
>>>>> Denis Beauchemin wrote:
>>>>>
>>>>>> Julian Field wrote:
>>>>>>
>>>>>>> Sure. Patch for SweepViruses.pm attached.
>>>>>>>
>>>>>>> Please let me know if it fixes the problem for you.
>>>>>>>
>>>>>>>
>>>>>>> On 27/10/04 3:54 pm, "Denis Beauchemin"
>>>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>>>> wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>> Julian Field wrote:
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>> Unfortunately that one isn't easy to fix, it comes straight from
>>>>>>>>> the virus
>>>>>>>>> report, and I'm not sure whether I can get at the real name
>>>>>>>>> safely
>>>>>>>>> from
>>>>>>>>> there. Judging by the fact that it's also listed in upper case, I
>>>>>>>>> suspect I
>>>>>>>>> can't find the safe name. The lookup table will have the lower
>>>>>>>>> case
>>>>>>>>> version.
>>>>>>>>> I can't just generally force the names to lower case as that may
>>>>>>>>> cause other
>>>>>>>>> filename clashes.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> On 27/10/04 1:42 pm, "Denis Beauchemin"
>>>>>>>>> <Denis.Beauchemin@USHERBROOKE.CA>
>>>>>>>>> wrote:
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>> MS seems to forget to clean file names when a virus is
>>>>>>>>>> detected in
>>>>>>>>>> a ZIP
>>>>>>>>>> file:
>>>>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>>>>> /i9RBth1s025464/message.txt   .scr        Found the
>>>>>>>>>> W32/Mabutu.a@MM
>>>>>>>>>> virus !!!
>>>>>>>>>> Oct 27 07:56:05 132.210.244.90 MailScanner[12979]:
>>>>>>>>>> /i9RBth1s025464/message.zip/MESSAGE.TXT
>>>>>>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>>>>>>
>>>>>>>>>> This is McAfee syslog output on MS 4.35.1.  The first line is OK
>>>>>>>>>> but the
>>>>>>>>>> second one has lots of white space...
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>
>>>>>>>> Julian,
>>>>>>>>
>>>>>>>> Understood.  But what was really annoying me was the long file
>>>>>>>> name
>>>>>>>> (many spaces before the .scr).
>>>>>>>>
>>>>>>>> Couldn't you just sanitize this with something like s/\s+/ /g
>>>>>>>> before
>>>>>>>> using it in reports and logs?
>>>>>>>>
>>>>>>>> Denis
>>>>>>>>
>>>>>> Julian,
>>>>>>
>>>>>> It's not working.  I stopped and restarted MS and I still get the
>>>>>> following in my logs (McAfee and Bitdefender output):
>>>>>>
>>>>>> Oct 27 12:03:28 smtpi2 MailScanner[29112]:
>>>>>> /i9RG3KwO029166/message.zip/MESSAGE.TXT
>>>>>> .SCR        Found the W32/Mabutu.a@MM virus !!!
>>>>>>
>>>>>> Oct 27 12:03:29 smtpi2 MailScanner[29112]:
>>>>>> /var/spool/MailScanner/incoming/29112/./i9RG3KwO029166/message.zip=>message.txt
>>>>>>
>>>>>>
>>>>>>
>>>>>> .scr    infected: Win32.Mabutu.A@mm
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> It wasn't the syslog output I fixed, it was the output that goes
>>>>> in the
>>>>> user report. I would rather have the genuine text in the syslog, it's
>>>>> length-limited by the syslog spec anyway.
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> Julian,
>>>>
>>>> Then it is working, but it was not what I was looking for... 8-(
>>>
>>>
>>>
>>>
>>> That's a shame. I could edit every single output parser to do the same
>>> trick if you like.
>>
>>
>>
>> Attached is a new SweepViruses.pm. Let me know how you get on.
>
>
>
> Julian,
>
> This is exactly what I was looking for!  Muchas gracias again!
>
> Will it be included in the next release?

Definitely. Next release will be the stable one for November.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hywel.burris at COMTEC-EUROPE.CO.UK  Wed Oct 27 20:11:18 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:24 2006
Subject: MailScanner 4.35.7 beta release
Message-ID: <mailman.4042.1137101244.24926.mailscanner@lists.mailscanner.info>

 

> -----Original Message-----
> From: Julian Field [mailto:mailscanner@ECS.SOTON.AC.UK] 
> Sent: 27 October 2004 15:30
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: MailScanner 4.35.7 beta release
> 
> I have just released a new beta, including a far better 
> implementation of my fix from last night to catch messages 
> with null MIME boundaries. They are now properly handled and 
> parsed correctly, instead of being rejected as last night's code did.
> 
> This will hopefully be the last update before the stable 
> release on 1st November.
> --

Seems to be working fine here, thanks

************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From isp-list at TULSACONNECT.COM  Wed Oct 27 22:09:08 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:24 2006
Subject: MailScanner on-demand?
Message-ID: <mailman.4043.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I'm sure this has been answered before, but I can't find a clear answer.
  We are considering migrating to SurgeMail, http://www.surgemail.com
from NetWinSite.  MailScanner does not support this MTA natively, but it
  can pass a message to an external process for filtering.  So, my
thought was if somehow we can use MailScanner as a command line "on
demand" type scanner where SurgeMail passes the message to MS, and MS
does its thing and passes it back to SurgeMail.

Possible?

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Wed Oct 27 22:26:26 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: MailScanner on-demand?
Message-ID: <mailman.4044.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Check out the Communigate Pro support for MailScanner. I believe they
did a similar trick.
All you basically have to do is write a couple of scripts:
1) Take a message from SurgeMail and create a sendmail qf and df file
(pretty simple, you can just make up most of the information)
2) Take a message from MailScanner and create a Surgemail message from it.

I recommend using the sendmail handling in MailScanner for this for two
reasons:
a) The qf file is very simple
b) The qf file is well documented in the Bat Book.

If what Surgemail is passing is an RFC822 message, then this isn't a big
job.

Mike Bacher wrote:

> I'm sure this has been answered before, but I can't find a clear answer.
>  We are considering migrating to SurgeMail, http://www.surgemail.com
> from NetWinSite.  MailScanner does not support this MTA natively, but it
>  can pass a message to an external process for filtering.  So, my
> thought was if somehow we can use MailScanner as a command line "on
> demand" type scanner where SurgeMail passes the message to MS, and MS
> does its thing and passes it back to SurgeMail.
>
> Possible?


--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From danielk at AVALONPUB.COM  Thu Oct 28 00:16:06 2004
From: danielk at AVALONPUB.COM (Daniel Kleinsinger)
Date: Thu Jan 12 21:27:24 2006
Subject: Fw: Bayes expire results
Message-ID: <mailman.4045.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dumb Question Alert!

Peter Bonivart wrote:

>>> token frequency: 1-occurence tokens: 58.21%
>>
>
> 58% of all tokens occur only once in the db.
>
>>> token frequency: less than 8 occurrences: 17.40%
>>
>
> 17% occur less than eight times in the db.


If 58% of all tokens occur only once in the db, how is it that only 17%
occur less than eight times?  Isn't once less than eight times?  Isn't
58% more than 17%?

Thanks,
Daniel

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From darren at TORSION.CO.UK  Wed Oct 27 22:45:35 2004
From: darren at TORSION.CO.UK (Darren Walker)
Date: Thu Jan 12 21:27:24 2006
Subject: MailScanner on-demand?
Message-ID: <mailman.4046.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi,

We did a lot of work with surgemail in the early days. We had a similar
problem but overcame it using sendmail to forward all mail to surgemail.

Incoming mail went to junky old server with sendmail, mailscanne, f-prot.
Once scanned was forwarded to surgemail. 


Regards

Darren

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf
Of Mike Bacher
Sent: 27 October 2004 22:09
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: MailScanner on-demand?

I'm sure this has been answered before, but I can't find a clear answer.
  We are considering migrating to SurgeMail, http://www.surgemail.com
from NetWinSite.  MailScanner does not support this MTA natively, but it
  can pass a message to an external process for filtering.  So, my
thought was if somehow we can use MailScanner as a command line "on
demand" type scanner where SurgeMail passes the message to MS, and MS
does its thing and passes it back to SurgeMail.

Possible?

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Wed Oct 27 23:44:53 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:24 2006
Subject: Fw: Bayes expire results
Message-ID: <mailman.4047.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Rob wrote:
> What does this actually mean?
>
> Just wondering if there is something I should be looking for?
> :)

>> synced Bayes databases from journal in 0 seconds: 729 unique entries
>> (1055
>> total entries)

The sync of the temporary journal into the main db was quick (usually
0-1 seconds).

>> expired old Bayes database entries in 207 seconds

This took a long time (usually a lot quicker on my systems but still
often 30-45 seconds).

>> 152020 entries kept, 56648 deleted

Lots of old tokens were deleted from the db due to age.

>> token frequency: 1-occurence tokens: 58.21%

58% of all tokens occur only once in the db.

>> token frequency: less than 8 occurrences: 17.40%

17% occur less than eight times in the db.

It looks fine except for taking 207 seconds which is a fairly long time.
How do you expire your old tokens? Through cron or MS and how often?

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Thu Oct 28 09:32:17 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:24 2006
Subject: Enhancement request 'message too large'
Message-ID: <mailman.4048.1137101244.24926.mailscanner@lists.mailscanner.info>

For some reason our M$ Exchange server that it's time to silently drop
messages above approx. 3 Mb in size. The sender doesn't get any message
and the recipient gets nothing.

I used the MailScanner feature message size restriction to at least notify
both parties. The messages are quarantined nicely :)

Would it be possible to have the attachments saved separately of the df/qf
pair in the quarantine directory? In 99.9% of the cases the exceeded
size message problem will be caused by attachments.

(Can I extract an attachment manually from the df file?)

Thanks!!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From spamfilter2 at MUPP.NET  Thu Oct 28 09:37:12 2004
From: spamfilter2 at MUPP.NET (j2)
Date: Thu Jan 12 21:27:24 2006
Subject: PERL error?
Message-ID: <mailman.4049.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> What does MailScanner -v produce.

Crap.. i killed all my mail from the last 12 hours. Was there any help in
what i sent?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Oct 28 09:44:47 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Enhancement request 'message too large'
Message-ID: <mailman.4050.1137101244.24926.mailscanner@lists.mailscanner.info>

You could do it with a Custom Function. Look at the message object to
determine whether it is too large or not, and set the quarantine directory
to a different value depending on what it finds.


On 28/10/04 9:32 am, "Remco Barendse" <mailscanner@BARENDSE.TO> wrote:

> For some reason our M$ Exchange server that it's time to silently drop
> messages above approx. 3 Mb in size. The sender doesn't get any message
> and the recipient gets nothing.
>
> I used the MailScanner feature message size restriction to at least notify
> both parties. The messages are quarantined nicely :)
>
> Would it be possible to have the attachments saved separately of the df/qf
> pair in the quarantine directory? In 99.9% of the cases the exceeded
> size message problem will be caused by attachments.
>
> (Can I extract an attachment manually from the df file?)
>
> Thanks!!
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jase at SENSIS.COM  Thu Oct 28 14:20:55 2004
From: jase at SENSIS.COM (Desai, Jason)
Date: Thu Jan 12 21:27:24 2006
Subject: Enhancement request 'message too large'
Message-ID: <mailman.4051.1137101244.24926.mailscanner@lists.mailscanner.info>

Remco Barendse wrote:
> (Can I extract an attachment manually from the df file?)

I use uudeview to do just that.  http://www.fpx.de/fp/Software/UUDeview/

Jase

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From billy at PLANETGEEK.BIZ  Thu Oct 28 14:57:59 2004
From: billy at PLANETGEEK.BIZ (Billy Pumphrey)
Date: Thu Jan 12 21:27:24 2006
Subject: Crontab job problem
Message-ID: <mailman.4052.1137101244.24926.mailscanner@lists.mailscanner.info>

I went and did it, I messed up the Cron jobs that happen, trying to figure
out they work and so on.  I might just have the crons fixed but my log watch
is messed up.  I found out that log watch already has a filter for
mailscanner, as I didn't even know what a filter was.  Anyway..here are the
details, any help is greatly apprecitated.



--------------------- crontab
----------------------------------------------------------

I did a (logged in as root) crontab -L before anything was messed up and
here is what it said:
[root@MailScanner cron.daily]# crontab -l
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.5900 installed on Tue Apr  6 10:05:20 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
0-59/5 * * * * /etc/mail/mailstats.pl >> /dev/null 2>&1
28 1 * * *      /usr/local/bin/rules_du_jour

I did some command and erased all these.  So I got them back by doing a
crontab -e and putting them in the .tmp file it created.  Now it reads this
when I do a crontab -L

[root@MailScanner root]# crontab -l
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.11584 installed on Wed Oct 27 15:08:32 2004)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
0-59/5 * * * * /etc/mail/mailstats.pl >> /dev/null 2>&1
28 1 * * * /usr/local/bin/rules_du_jour
[root@MailScanner root]#

Please confirm that the error on my part is corrected from what I did.

If you could take a minute and explain to me the difference between what is
in crontab and how the logwatch runs or something.  The logwatch is
abviously not in the crontab -l but it runs.  Do the dail, monthly, etc just
run if they are setup and don't have to be in crontab?


Thank you for your help
Billy Pumphrey
IT Manager
Wooden & McLaughlin

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Thu Oct 28 15:24:25 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:24 2006
Subject: Crontab job problem
Message-ID: <mailman.4053.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Billy Pumphrey wrote:
> I went and did it, I messed up the Cron jobs that happen, trying to figure
> out they work and so on.  I might just have the crons fixed but my log watch
> is messed up.  I found out that log watch already has a filter for
> mailscanner, as I didn't even know what a filter was.  Anyway..here are the
> details, any help is greatly apprecitated.
>
>
>
> --------------------- crontab
> ----------------------------------------------------------
>
> I did a (logged in as root) crontab -L before anything was messed up and
> here is what it said:
> [root@MailScanner cron.daily]# crontab -l
> # DO NOT EDIT THIS FILE - edit the master and reinstall.
> # (/tmp/crontab.5900 installed on Tue Apr  6 10:05:20 2004)
> # (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
> 0-59/5 * * * * /etc/mail/mailstats.pl >> /dev/null 2>&1
> 28 1 * * *      /usr/local/bin/rules_du_jour
>
> I did some command and erased all these.  So I got them back by doing a
> crontab -e and putting them in the .tmp file it created.  Now it reads this
> when I do a crontab -L
>
> [root@MailScanner root]# crontab -l
> # DO NOT EDIT THIS FILE - edit the master and reinstall.
> # (/tmp/crontab.11584 installed on Wed Oct 27 15:08:32 2004)
> # (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
> 0-59/5 * * * * /etc/mail/mailstats.pl >> /dev/null 2>&1
> 28 1 * * * /usr/local/bin/rules_du_jour
> [root@MailScanner root]#
>
> Please confirm that the error on my part is corrected from what I did.
>
> If you could take a minute and explain to me the difference between what is
> in crontab and how the logwatch runs or something.  The logwatch is
> abviously not in the crontab -l but it runs.  Do the dail, monthly, etc just
> run if they are setup and don't have to be in crontab?

There are many places where cron looks for executing tasks.  By calling
crontab -e, you are editing your (the user you're logged in as) personal
crontab file.  There are also other cron-related files in /etc/cron.d
and /etc/cron.daily, /etc/cron/hourly and so on (redhat).  Look in
/etc/cron.daily for logwatch.

>
>
> Thank you for your help
> Billy Pumphrey
> IT Manager
> Wooden & McLaughlin
>
> ------------------------ MailScanner list ------------------------ To
> unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From chardlist at CHARD.NET  Thu Oct 28 17:03:02 2004
From: chardlist at CHARD.NET (Brendan Chard)
Date: Thu Jan 12 21:27:24 2006
Subject: Restrict Incoming Mail
Message-ID: <mailman.4054.1137101244.24926.mailscanner@lists.mailscanner.info>

This is more of a post installation, big picture question but hopefully some
of you have done this.

I now have a FreeBSD box up and running with MS that is serving as a mail
relay for 4 other FreeBSD boxes that actually have the user accounts on
them.

How can I restrict the FreeBSD boxes behind the mail relay server to only
accept incoming mail from the MS relay server and localhost?  Can this be
done while still allowing the users to send mail out through the FreeBSD
boxes that they log into?

Thanks,
-Brendan
brendan@chard.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Thu Oct 28 17:07:54 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:24 2006
Subject: Restrict Incoming Mail
Message-ID: <mailman.4055.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Brendan Chard wrote:

>This is more of a post installation, big picture question but hopefully some
>of you have done this.
>
>I now have a FreeBSD box up and running with MS that is serving as a mail
>relay for 4 other FreeBSD boxes that actually have the user accounts on
>them.
>
>How can I restrict the FreeBSD boxes behind the mail relay server to only
>accept incoming mail from the MS relay server and localhost?  Can this be
>done while still allowing the users to send mail out through the FreeBSD
>boxes that they log into?
>
>

i would configure Sendmail to block the initial connections with the
access file and maybe even use AUTH for the users.

--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #90: The cause of the problem is: Mouse chewed through power cable

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Thu Oct 28 17:40:25 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:24 2006
Subject: Restrict Incoming Mail
Message-ID: <mailman.4056.1137101244.24926.mailscanner@lists.mailscanner.info>

> I now have a FreeBSD box up and running with MS that is
> serving as a mail relay for 4 other FreeBSD boxes that
> actually have the user accounts on them.
>
> How can I restrict the FreeBSD boxes behind the mail relay
> server to only accept incoming mail from the MS relay server
> and localhost?  Can this be done while still allowing the
> users to send mail out through the FreeBSD boxes that they log into?

You could use IP tables (or similar) to drop all connections bar those from
your MS box - presuming I've understood your query



Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Thu Oct 28 17:49:30 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:24 2006
Subject: Restrict Incoming Mail
Message-ID: <mailman.4057.1137101244.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Brendan Chard
> Sent: Thursday, October 28, 2004 12:03 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Restrict Incoming Mail
>
> This is more of a post installation, big picture question but hopefully
> some
> of you have done this.
>
> I now have a FreeBSD box up and running with MS that is serving as a mail
> relay for 4 other FreeBSD boxes that actually have the user accounts on
> them.
>
> How can I restrict the FreeBSD boxes behind the mail relay server to only
> accept incoming mail from the MS relay server and localhost?  Can this be
> done while still allowing the users to send mail out through the FreeBSD
> boxes that they log into?
>
> Thanks,
> -Brendan
> brendan@chard.net

First Method - Look at the MAQ. specifically:

        0.5 What if I want just a gateway that filters mail sends to
        my other (Exchange, Notes...) server
        (and block emails to unknown recipients)?

The exact methods will depend on which MTA you use but the basic idea is the
same.

1. Write scripts that create a map or DB of the users on the mail hubs. The
links in the MAQ describe a few way's to do this but your setup will
probably require custom scripts.

2. Modify your Mat to use this map to validate the recipient before
accepting the mail. Again the links in the MAQ describe a few way's to do
this.

I have a script that does this for one backend POP/IMAP server. Drop me a
line off list if you want a copy

Second Method- Milter-Ahead:

I tried testing this very quickly but couldn't get it to work with an
Exchange 2003 server on the back end, but the problem could have been that
since the mail was queued for MailScanner, milter-ahead  thought the user
was local. This is what the logs appeared to reflect.

This is a very promising method of blocking email at the gateway. It is dead
easy to install and configure.

Does anyone have this working with MailScanner?

Thanks,

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Thu Oct 28 17:57:48 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:24 2006
Subject: Restrict Incoming Mail
Message-ID: <mailman.4058.1137101244.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Steve Swaney
> Sent: Thursday, October 28, 2004 12:50 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Restrict Incoming Mail
>
> > -----Original Message-----
> > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> > Behalf Of Brendan Chard
> > Sent: Thursday, October 28, 2004 12:03 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Restrict Incoming Mail
> >
> > This is more of a post installation, big picture question but hopefully
> > some
> > of you have done this.
> >
> > I now have a FreeBSD box up and running with MS that is serving as a
> mail
> > relay for 4 other FreeBSD boxes that actually have the user accounts on
> > them.
> >
> > How can I restrict the FreeBSD boxes behind the mail relay server to
> only
> > accept incoming mail from the MS relay server and localhost?  Can this
> be
> > done while still allowing the users to send mail out through the FreeBSD
> > boxes that they log into?
> >
> > Thanks,
> > -Brendan
> > brendan@chard.net
>
> First Method - Look at the MAQ. specifically:
>
>         0.5 What if I want just a gateway that filters mail sends to
>         my other (Exchange, Notes...) server
>         (and block emails to unknown recipients)?
>
> The exact methods will depend on which MTA you use but the basic idea is
> the
> same.
>
> 1. Write scripts that create a map or DB of the users on the mail hubs.
> The
> links in the MAQ describe a few way's to do this but your setup will
> probably require custom scripts.
>
> 2. Modify your Mat to use this map to validate the recipient before
> accepting the mail. Again the links in the MAQ describe a few way's to do
> this.
>
> I have a script that does this for one backend POP/IMAP server. Drop me a
> line off list if you want a copy
>
> Second Method- Milter-Ahead:
>
> I tried testing this very quickly but couldn't get it to work with an
> Exchange 2003 server on the back end, but the problem could have been that
> since the mail was queued for MailScanner, milter-ahead  thought the user
> was local. This is what the logs appeared to reflect.
>
> This is a very promising method of blocking email at the gateway. It is
> dead
> easy to install and configure.
>
> Does anyone have this working with MailScanner?
>
Sorry I meant to include the link for Milter-Ahead:

        http://www.milter.info/milter-ahead/index.shtml

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kevins at BMRB.CO.UK  Thu Oct 28 18:39:18 2004
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:27:24 2006
Subject: Enhancement request 'message too large'
Message-ID: <mailman.4059.1137101244.24926.mailscanner@lists.mailscanner.info>

On Thu, 2004-10-28 at 09:32, Remco Barendse wrote:
> For some reason our M$ Exchange server that it's time to silently drop
> messages above approx. 3 Mb in size. The sender doesn't get any message
> and the recipient gets nothing.
Why not just set the same limit in sendmail, so that the sender at least
gets a reject message.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at MANGO.ZW  Thu Oct 28 21:40:35 2004
From: mailscanner at MANGO.ZW (Jim Holland)
Date: Thu Jan 12 21:27:24 2006
Subject: Error: Failed to link message body between queues
Message-ID: <mailman.4060.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi all

I am running mailscanner-4.31.6-1 on Red Hat Linux release 7.1 (Seawolf)
with kernel 2.4.20-28.7.

I wonder if anyone could advise on the above error, which has appeared
twice in the maillog today after an upgrade from the Red Hat
sendmail-8.11.6 rpm to sendmail-8.13.1 which was compiled from the source
file: ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.13.1.tar.gz.

The detailed log entries are:

Oct 28 19:46:44 mail MailScanner[10952]: Failed to link message body between queues (/var/spool/mqueue/dfi9SHiYEl003400 --> /var/spool/mqueue.in/dfi9SHiYEl003400)

Oct 28 22:23:02 mail MailScanner[4888]: Failed to link message body between queues (/var/spool/mqueue/dfi9SKLSEO028329 --> /var/spool/mqueue.in/dfi9SKLSEO028329)

In each case the log indicated that the relevant message had been
delivered, but I wonder if the message was delivered with an empty message
body as a result.

Any help would be most appreciated.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Thu Oct 28 21:55:31 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:24 2006
Subject: Error: Failed to link message body between queues
Message-ID: <mailman.4061.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

You need to set "Lock Type = posix" in MailScanner.conf.
In sendmail 8.13 they have changed the default locking type on Linux
systems.

Jim Holland wrote:

>Hi all
>
>I am running mailscanner-4.31.6-1 on Red Hat Linux release 7.1 (Seawolf)
>with kernel 2.4.20-28.7.
>
>I wonder if anyone could advise on the above error, which has appeared
>twice in the maillog today after an upgrade from the Red Hat
>sendmail-8.11.6 rpm to sendmail-8.13.1 which was compiled from the source
>file: ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.13.1.tar.gz.
>
>The detailed log entries are:
>
>Oct 28 19:46:44 mail MailScanner[10952]: Failed to link message body between queues (/var/spool/mqueue/dfi9SHiYEl003400 --> /var/spool/mqueue.in/dfi9SHiYEl003400)
>
>Oct 28 22:23:02 mail MailScanner[4888]: Failed to link message body between queues (/var/spool/mqueue/dfi9SKLSEO028329 --> /var/spool/mqueue.in/dfi9SKLSEO028329)
>
>In each case the log indicated that the relevant message had been
>delivered, but I wonder if the message was delivered with an empty message
>body as a result.
>
>Any help would be most appreciated.
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Jan-Peter.Koopmann at SECEIDOS.DE  Fri Oct 29 06:59:06 2004
From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4062.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi,

> Long term though I 'd like to get the product running on
> FreeBSD, even if I have to install things by hand (I prefer

Well but what would be the benefit of using the commercial product then?
If you have to install everything by hand then probably the automatic
updates will not work either. So where is the point?

What's wrong with using the standard FreeBSD version? If there is
anything I can do to make the port better then please let me know your
suggestions! :-)

Steve, I can see the point in making a MS based commercial product but
the big benefits for end users probably are things like easy install,
automatic updates, configuration support etc. With easy install and
automatic updates not working (just an educated guess) on FreeBSD you
are "left" with support which is a strong argument for itself. On the
other hand: Someone "good" enough to install a FreeBSD box, MailScanner
etc. in the first place should (!) be good enough to get it configured
with FAQ, MAQ and this wounderful list.

I think a MS based appliance would be a great thing to have. At least
for customers and not for us consultants... :-)


Kind regards,
  JP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From kevins at BMRB.CO.UK  Fri Oct 29 07:51:50 2004
From: kevins at BMRB.CO.UK (Kevin Spicer)
Date: Thu Jan 12 21:27:24 2006
Subject: Enhancement request 'message too large'
Message-ID: <mailman.4063.1137101244.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-10-29 at 00:23, Remco Barendse wrote:
> On Thu, 28 Oct 2004, Kevin Spicer wrote:
> > Why not just set the same limit in sendmail, so that the sender at least
> > gets a reject message.
>
> MailScanner generates an error message too :)
>
> I could use sendmail but most of the `oversized' messages we actually
> want/need. It's just that Mr. Gates thought it would be useful not to fill
> exchange with large messages.

One thing that is worth mentioning in this context...

I set a limit of 10M in sendmail after someone send a 100M zip file to
one of our users.  Unfortunately my system didn't much like this, due
probably to the fact I'm using tmpfs for the work directory.  Whilst the
system continued to process mail this one message never completed
processing (and kept the CPU at 100% whilst it tried).  In the end I had
to delete it.




BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the
recipient and may contain confidential and/or privileged
material.  If you have received this in error, please contact the
sender and delete this message immediately.  Disclosure, copying
or other action taken in respect of this email or in
reliance on it is prohibited.  BMRB International Limited
accepts no liability in relation to any personal emails, or
content of any email which does not directly relate to our
business.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Thu Oct 28 23:58:48 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4064.1137101244.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mike Bacher
> Sent: Thursday, October 28, 2004 6:48 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Fortress Systems / SMGateway?
>
> Steve Swaney wrote:
>
> > I'll be happy to answer this one :)
> >
> > Release Candidate 1 of Fortress SMGateway will be out next week to our
> beta
> > testers. It will be supported on clean installs of RH 3.0, CentOS,
> Whitebox
> > and Tao Linux. We hope to have the first production release out sometime
> in
> > November.
>
> Hi Steve,
>
> Sounds promising.  We are an all FreeBSD shop and would love to beta
> test the product -- is running it on Linux a requirement (or is it just
> that you have it packaged up as RPMs?)
>
> --

Hey I like FreeBSD too but we needed to package using rpms for the larger
market. The install is actually +70+ rpms since we relocated just about
everything That MailScanner & SpamAssassin and Razor use to live in
/opt/Fortress (to comply with the RH developer directives).

I'd be happy to add you to the beta list for rc1 if you want to setup a
Linux system. CentOS (my today's favorite), WhiteBox and Tao Linux are
actually quite nice.

Steve
--
Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From isp-list at TULSACONNECT.COM  Fri Oct 29 00:06:52 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4065.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

> Hey I like FreeBSD too but we needed to package using rpms for the larger
> market. The install is actually +70+ rpms since we relocated just about
> everything That MailScanner & SpamAssassin and Razor use to live in
> /opt/Fortress (to comply with the RH developer directives).

Understood.  Isn't there a port of RPM for FreeBSD?  That might be
interesting to try, assuming the actual product doesn't use anything
Linux specific (hardcoded paths/libraries)..

> I'd be happy to add you to the beta list for rc1 if you want to setup a
> Linux system. CentOS (my today's favorite), WhiteBox and Tao Linux are
> actually quite nice.

I would certainly be willing to do so to try it out.

Long term though I 'd like to get the product running on FreeBSD, even
if I have to install things by hand (I prefer to do it that way anyway,
truth be told).  The soft-updates feature of the FreeBSD filesystem
makes it ideal as a MailScanner box.  I don't believe Linux has anything
that compares to it performance-wise.

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Fri Oct 29 00:21:30 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4066.1137101244.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mike Bacher
> Sent: Thursday, October 28, 2004 7:07 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Fortress Systems / SMGateway?
>
> Steve Swaney wrote:
>
> > Hey I like FreeBSD too but we needed to package using rpms for the
> larger
> > market. The install is actually +70+ rpms since we relocated just about
> > everything That MailScanner & SpamAssassin and Razor use to live in
> > /opt/Fortress (to comply with the RH developer directives).
>
> Understood.  Isn't there a port of RPM for FreeBSD?  That might be
> interesting to try, assuming the actual product doesn't use anything
> Linux specific (hardcoded paths/libraries)..
>
> > I'd be happy to add you to the beta list for rc1 if you want to setup a
> > Linux system. CentOS (my today's favorite), WhiteBox and Tao Linux are
> > actually quite nice.
>
> I would certainly be willing to do so to try it out.
>
> Long term though I 'd like to get the product running on FreeBSD, even
> if I have to install things by hand (I prefer to do it that way anyway,
> truth be told).  The soft-updates feature of the FreeBSD filesystem
> makes it ideal as a MailScanner box.  I don't believe Linux has anything
> that compares to it performance-wise.
>
> --
>

Let's take this off-list but I can definitely state that we'd obviously like
to be able to support the maximum number of platforms practical :)

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at BARENDSE.TO  Fri Oct 29 00:23:40 2004
From: mailscanner at BARENDSE.TO (Remco Barendse)
Date: Thu Jan 12 21:27:24 2006
Subject: Enhancement request 'message too large'
Message-ID: <mailman.4067.1137101244.24926.mailscanner@lists.mailscanner.info>

On Thu, 28 Oct 2004, Kevin Spicer wrote:

> On Thu, 2004-10-28 at 09:32, Remco Barendse wrote:
>> For some reason our M$ Exchange server that it's time to silently drop
>> messages above approx. 3 Mb in size. The sender doesn't get any message
>> and the recipient gets nothing.
> Why not just set the same limit in sendmail, so that the sender at least
> gets a reject message.

MailScanner generates an error message too :)

I could use sendmail but most of the `oversized' messages we actually
want/need. It's just that Mr. Gates thought it would be useful not to fill
exchange with large messages.

When MailScanner gets them I can still get the message from quarantine (as
long as people do not start e-mailing the latest Knoppix DVD iso all
should be well)

But thanks for the tip!

>
>
>
>
> BMRB International
> http://www.bmrb.co.uk
> +44 (0)20 8566 5000
> _________________________________________________________________
> This message (and any attachment) is intended only for the
> recipient and may contain confidential and/or privileged
> material.  If you have received this in error, please contact the
> sender and delete this message immediately.  Disclosure, copying
> or other action taken in respect of this email or in
> reliance on it is prohibited.  BMRB International Limited
> accepts no liability in relation to any personal emails, or
> content of any email which does not directly relate to our
> business.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ka at PACIFIC.NET  Fri Oct 29 00:58:48 2004
From: ka at PACIFIC.NET (Ken A)
Date: Thu Jan 12 21:27:24 2006
Subject: Restrict Incoming Mail
Message-ID: <mailman.4068.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

... snip...

>>Second Method- Milter-Ahead:
>>
>>I tried testing this very quickly but couldn't get it to work with an
>>Exchange 2003 server on the back end, but the problem could have been that
>>since the mail was queued for MailScanner, milter-ahead  thought the user
>>was local. This is what the logs appeared to reflect.
>>
>>This is a very promising method of blocking email at the gateway. It is
>>dead
>>easy to install and configure.
>>
>>Does anyone have this working with MailScanner?

Nice milter. I had not seen this before. We use scripts that write the
access db on several MailScanner machines. I see milter-ahead caches
responses - by default for 1 week. Do you know if it has a mechanism to
clear a specific cached entry? You'd want to clear a negative response
from the cache if you added a new user. I suppose you could just edit
the cache directly if file locking wasn't a problem?

Ken A
Pacific.Net


>
> Sorry I meant to include the link for Milter-Ahead:
>
>         http://www.milter.info/milter-ahead/index.shtml
>
> Steve
>
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
> Fortress Systems Ltd.
> www.fsl.com
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From nerijus at USERS.SOURCEFORGE.NET  Fri Oct 29 01:14:53 2004
From: nerijus at USERS.SOURCEFORGE.NET (Nerijus Baliunas)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4069.1137101244.24926.mailscanner@lists.mailscanner.info>

On Thu, 28 Oct 2004 18:06:52 -0500 Mike Bacher <isp-list@TULSACONNECT.COM> wrote:

> Understood.  Isn't there a port of RPM for FreeBSD?

Even AIX has it so I see no problems for FreeBSD...
I even see /usr/ports/archivers/rpm directory on my FreeBSD box.

Regards,
Nerijus

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Steve.Swaney at FSL.COM  Thu Oct 28 22:54:04 2004
From: Steve.Swaney at FSL.COM (Steve Swaney)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4070.1137101244.24926.mailscanner@lists.mailscanner.info>

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Mike Bacher
> Sent: Thursday, October 28, 2004 5:26 PM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Fortress Systems / SMGateway?
>
> Does anyone know the status of the commercial product based on
> MailScanner (SMGateway/SMCluster?).  We're curious on how the product is
> shaping up and when the release date might be..
>

I'll be happy to answer this one :)

Release Candidate 1 of Fortress SMGateway will be out next week to our beta
testers. It will be supported on clean installs of RH 3.0, CentOS, Whitebox
and Tao Linux. We hope to have the first production release out sometime in
November.

There will also be an appliance available with the software preloaded but I
do not yet have a ship date for that product.

The product will be available for download at NO cost. We will charge a fee
only for fully automated updates and support. The yearly fee for updates for
a single server will be $849.00 including web based support. There is no
limit on the number of users. Other support options will also be available.
A lower priced subscription will be available for non-profit institutions.

We have very carefully designed SMGateway to be "self-contained" with little
dependency on the operating system packages and modules. While this required
a great deal of time and effort, this design will allow is to very quickly
provide automated updates that will safely co-exist with the operating
system. I'm sure you C-panel and Ensim users understand what I'm talking
about.

A more detailed description of the product may be found at
http://www.fsl.com/products/fsmg.html

I'll also be happy to answer any specific questions by email off list.

Fortress SMCluster is still in the design phase and will probably be
released sometime in mid 2005.

Steve

Steve Swaney
President
Fortress Systems Ltd.
www.fsl.com
steve.swaney@fsl.com




--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Fortress Systems Ltd.
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From hywel.burris at COMTEC-EUROPE.CO.UK  Thu Oct 28 23:06:43 2004
From: hywel.burris at COMTEC-EUROPE.CO.UK (Hywel Burris)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4071.1137101244.24926.mailscanner@lists.mailscanner.info>

Hi Steve, 

After seening this email and my previous mails is the RC version still
up for trailing, I may put this as a secondary and see how it fairs?
Althought may be better as the primary ;)

Hywel

 

> -----Original Message-----
> From: Steve Swaney [mailto:Steve.Swaney@FSL.COM] 
> Sent: 28 October 2004 22:54
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: Fortress Systems / SMGateway?
> 
> > -----Original Message-----
> > From: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On 
> > Behalf Of Mike Bacher
> > Sent: Thursday, October 28, 2004 5:26 PM
> > To: MAILSCANNER@JISCMAIL.AC.UK
> > Subject: Fortress Systems / SMGateway?
> >
> > Does anyone know the status of the commercial product based on 
> > MailScanner (SMGateway/SMCluster?).  We're curious on how 
> the product 
> > is shaping up and when the release date might be..
> >
> 
> I'll be happy to answer this one :)
> 
> Release Candidate 1 of Fortress SMGateway will be out next 
> week to our beta testers. It will be supported on clean 
> installs of RH 3.0, CentOS, Whitebox and Tao Linux. We hope 
> to have the first production release out sometime in November.
> 
> There will also be an appliance available with the software 
> preloaded but I do not yet have a ship date for that product.
> 
> The product will be available for download at NO cost. We 
> will charge a fee only for fully automated updates and 
> support. The yearly fee for updates for a single server will 
> be $849.00 including web based support. There is no limit on 
> the number of users. Other support options will also be available.
> A lower priced subscription will be available for non-profit 
> institutions.
> 
> We have very carefully designed SMGateway to be 
> "self-contained" with little dependency on the operating 
> system packages and modules. While this required a great deal 
> of time and effort, this design will allow is to very quickly 
> provide automated updates that will safely co-exist with the 
> operating system. I'm sure you C-panel and Ensim users 
> understand what I'm talking about.
> 
> A more detailed description of the product may be found at 
> http://www.fsl.com/products/fsmg.html
> 
> I'll also be happy to answer any specific questions by email off list.
> 
> Fortress SMCluster is still in the design phase and will 
> probably be released sometime in mid 2005.
> 
> Steve
> 
> Steve Swaney
> President
> Fortress Systems Ltd.
> www.fsl.com
> steve.swaney@fsl.com
> 
> 
> 
> 
> --
> This message has been scanned for viruses and dangerous 
> content by MailScanner, and is believed to be clean.
> 
> Fortress Systems Ltd.
> www.fsl.com
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ 
> (http://www.mailscanner.biz/maq/) and the archives 
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> 
> 

************************************************************************
This e-mail and any attachments are strictly confidential and intended solely for the addressee. They may contain information which is covered by legal, professional or other privilege. If you are not the intended addressee, you must not copy the e-mail or the attachments, or use them for any purpose or disclose their contents to any other person. To do so may be unlawful. If you have received this transmission in error, please notify us as soon as possible and delete the message and attachments from all places in your computer where they are stored. 

Although we have scanned this e-mail and any attachments for viruses, it is your responsibility to ensure that they are actually virus free.
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From isp-list at TULSACONNECT.COM  Thu Oct 28 23:48:25 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:24 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4072.1137101244.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Steve Swaney wrote:

> I'll be happy to answer this one :)
>
> Release Candidate 1 of Fortress SMGateway will be out next week to our beta
> testers. It will be supported on clean installs of RH 3.0, CentOS, Whitebox
> and Tao Linux. We hope to have the first production release out sometime in
> November.

Hi Steve,

Sounds promising.  We are an all FreeBSD shop and would love to beta
test the product -- is running it on Linux a requirement (or is it just
that you have it packaged up as RPMs?)

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at MANGO.ZW  Thu Oct 28 23:29:14 2004
From: mailscanner at MANGO.ZW (Jim Holland)
Date: Thu Jan 12 21:27:24 2006
Subject: Error: Failed to link message body between queues
Message-ID: <mailman.4073.1137101244.24926.mailscanner@lists.mailscanner.info>

On Thu, 28 Oct 2004, Julian Field wrote:

> You need to set "Lock Type = posix" in MailScanner.conf.
> In sendmail 8.13 they have changed the default locking type on Linux
> systems.

Thanks so much for the quick response.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From engled at TRILLION21.COM  Thu Oct 28 21:46:41 2004
From: engled at TRILLION21.COM (Darryl Engle)
Date: Thu Jan 12 21:27:25 2006
Subject: outlook express html problem
Message-ID: <mailman.4074.1137101245.24926.mailscanner@lists.mailscanner.info>

Hardware : P@ 2GHZ, 1 GB Ram, 40GB IDE
Software : RH Enterprise, Sendmail-8.12.11-4.RHEL3.1,
MailScanner-4.34.8-4, SpamAssassin-3.0.1., ClamAV 0.8.0
RBLs : ORDB-RBL SBL+XBL
Virus Scanners: ClamAV 
Volume: 6,000 message/day
Average Load: ~1

Our old MailScanner died (hardware failure) so I finally had time to
upgrade to the above specs from a rather old setup. After I get every
thing working and put back in to production we have had trouble with
customers sending us e-mail with outlook express. If OE is set up to use
HTML and they send to us they get back the error in the
sender.error.report.txt file. I was able to reproduce this locally, if I
change to plain text it works fine. 

If I use Eudora I can send HTML or plain text. Is there something I'm
missing, I have set up several MS boxes (all as relays) and have never
seen this. I can't remember the version on the old box that worked or I
would post it.

The closest I found in the archives was something about stylized text
causing a problem.

On a side note, I have been running MS boxes for over 2 years without
one single hiccup. Great piece of work guys.


Thx
Darryl Engle
Trillion Digital

#Do not remove the following line, or various programs
#that require network functionality will fail.
127.0.0.1             localhost.localdomain localhost

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From wietse at BOUDISQUE.NL  Thu Oct 28 22:01:06 2004
From: wietse at BOUDISQUE.NL (Wietse Muizelaar)
Date: Thu Jan 12 21:27:25 2006
Subject: Error: Failed to link message body between queues
Message-ID: <mailman.4075.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi,

On Thursday, October 28, 2004 10:55 PM [GMT+1=CET],
Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:

> You need to set "Lock Type = posix" in MailScanner.conf.
> In sendmail 8.13 they have changed the default locking type on Linux
> systems.

A little side-note on that one: when I upgrade MailScanner, and use the
upgrade_MailScanner_conf script; it ignores this value always. I'm not sure
whether this is a bug, or a feature? :)

Wietse

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From isp-list at TULSACONNECT.COM  Thu Oct 28 22:25:31 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:25 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4076.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Does anyone know the status of the commercial product based on
MailScanner (SMGateway/SMCluster?).  We're curious on how the product is
shaping up and when the release date might be..

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 09:08:58 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: outlook express html problem
Message-ID: <mailman.4077.1137101245.24926.mailscanner@lists.mailscanner.info>

But what does the MailScanner warning message actually say? The reason it
was rejected will be written in there.


On 28/10/04 9:46 pm, "Darryl Engle" <engled@TRILLION21.COM> wrote:

> Hardware : P@ 2GHZ, 1 GB Ram, 40GB IDE
> Software : RH Enterprise, Sendmail-8.12.11-4.RHEL3.1,
> MailScanner-4.34.8-4, SpamAssassin-3.0.1., ClamAV 0.8.0
> RBLs : ORDB-RBL SBL+XBL
> Virus Scanners: ClamAV
> Volume: 6,000 message/day
> Average Load: ~1
>
> Our old MailScanner died (hardware failure) so I finally had time to
> upgrade to the above specs from a rather old setup. After I get every
> thing working and put back in to production we have had trouble with
> customers sending us e-mail with outlook express. If OE is set up to use
> HTML and they send to us they get back the error in the
> sender.error.report.txt file. I was able to reproduce this locally, if I
> change to plain text it works fine.
>
> If I use Eudora I can send HTML or plain text. Is there something I'm
> missing, I have set up several MS boxes (all as relays) and have never
> seen this. I can't remember the version on the old box that worked or I
> would post it.
>
> The closest I found in the archives was something about stylized text
> causing a problem.
>
> On a side note, I have been running MS boxes for over 2 years without
> one single hiccup. Great piece of work guys.
>
>
> Thx
> Darryl Engle
> Trillion Digital
>
> #Do not remove the following line, or various programs
> #that require network functionality will fail.
> 127.0.0.1             localhost.localdomain localhost
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 09:11:14 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Error: Failed to link message body between queues
Message-ID: <mailman.4078.1137101245.24926.mailscanner@lists.mailscanner.info>

Slightly undesirable feature.
As the setting is commented out in the default settings file, it gets
deleted when you upgrade. Need to take a look at this. Maybe set the default
file to blank rather than commented out.


On 28/10/04 10:01 pm, "Wietse Muizelaar" <wietse@BOUDISQUE.NL> wrote:
> Hi,
>
> On Thursday, October 28, 2004 10:55 PM [GMT+1=CET],
> Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>
>> You need to set "Lock Type = posix" in MailScanner.conf.
>> In sendmail 8.13 they have changed the default locking type on Linux
>> systems.
>
> A little side-note on that one: when I upgrade MailScanner, and use the
> upgrade_MailScanner_conf script; it ignores this value always. I'm not sure
> whether this is a bug, or a feature? :)
>
> Wietse
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Janssen at RZ.UNI-FRANKFURT.DE  Fri Oct 29 11:48:59 2004
From: Janssen at RZ.UNI-FRANKFURT.DE (Michael Janssen)
Date: Thu Jan 12 21:27:25 2006
Subject: Sophos needs Upgrade to find latest Bagle-Gen
Message-ID: <mailman.4079.1137101245.24926.mailscanner@lists.mailscanner.info>

Dear list,


on our site, we got many virusses this morning unrecognized by sophos. We
needed to install the next monthly version of Sophos to fix this despite
our installed version was "fresh" (september version) enough to download
and use all IDEs.

I can't say what causes this, but I want to inform you that you should
consider updating sophos-not-just-ide when you see virusses slipping
through.

regards

Michael Janssen

Student Assistent
Computer Centre
University of Frankfurt - Germany

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 11:50:21 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Error: Failed to link message body between queues
Message-ID: <mailman.4080.1137101245.24926.mailscanner@lists.mailscanner.info>

I have fixed this and it will be in the next release.


On 29/10/04 9:11 am, "Julian Field" <mailscanner@ecs.soton.ac.uk> wrote:

> Slightly undesirable feature.
> As the setting is commented out in the default settings file, it gets
> deleted when you upgrade. Need to take a look at this. Maybe set the default
> file to blank rather than commented out.
>
>
> On 28/10/04 10:01 pm, "Wietse Muizelaar" <wietse@BOUDISQUE.NL> wrote:
>> Hi,
>>
>> On Thursday, October 28, 2004 10:55 PM [GMT+1=CET],
>> Julian Field <mailscanner@ECS.SOTON.AC.UK> wrote:
>>
>>> You need to set "Lock Type = posix" in MailScanner.conf.
>>> In sendmail 8.13 they have changed the default locking type on Linux
>>> systems.
>>
>> A little side-note on that one: when I upgrade MailScanner, and use the
>> upgrade_MailScanner_conf script; it ignores this value always. I'm not sure
>> whether this is a bug, or a feature? :)
>>
>> Wietse
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From xterm1 at TATORZ.COM  Fri Oct 29 12:37:48 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:25 2006
Subject: OT: Logging question?
Message-ID: <mailman.4081.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

        Does anyone have an idea to stop mailscanner from listing whitelisted
address's
in the maillog. I am tring to clean up logwatch without losing the logging
of actual spam
but to no avail!

TIA

Brian

RedHat 9.0
MailScanner-4.34.8-4
logwatch-5.2.2-1


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Mark.Pottage at SELECTION.CO.UK  Fri Oct 29 13:14:52 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:25 2006
Subject: DnS for delivery of mail?
Message-ID: <mailman.4082.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Can someone tell me whether mailscanner uses the dns from resolv.conf to
deliver mail or if there are other entries for delivering mail.
 
Can it use different dns servers for outgoing mail as opposed to internal
mail?
 
 
 
many thanks
 
Mark Pottage
Systems Administrator
0870 411 7914
07740 578 647
mark.pottage@selection.co.uk

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  18 lines. ]
    [ Unable to print this part. ]


From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 29 13:28:03 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:25 2006
Subject: DnS for delivery of mail?
Message-ID: <mailman.4083.1137101245.24926.mailscanner@lists.mailscanner.info>

Mark

MailScanner doesn't do any email delivery, rather it sends it to the MTA
  (via placing the message in the correct queue) and the MTA does the
delivery

Why not merely use the internal DNS server in the resolve.conf and have
the local DNS server forward unknown queries to the outside world?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mark Pottage wrote:
> Can someone tell me whether mailscanner uses the dns from resolv.conf to
> deliver mail or if there are other entries for delivering mail.
>
> Can it use different dns servers for outgoing mail as opposed to
> internal mail?
>
>
>
> many thanks
>
> Mark Pottage
> Systems Administrator
> 0870 411 7914
> 07740 578 647
> mark.pottage@selection.co.uk <mailto:mark.pottage@selection.co.uk>
>
> --
> This message has been scanned for viruses and
> dangerous content by *Selection Services MailScanner*
> <http://www.selection.co.uk>, and is
> believed to be clean.. ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> ------------------------------------------------------------------------
>
> BEGIN:VCARD
> VERSION:2.1
> X-GWTYPE:USER
> FN:Mark Pottage
> TEL;WORK:0870 411 7914
> ORG:;Internal Support
> TEL;PREF;FAX:0870 163 9001
> EMAIL;WORK;PREF;NGW:Mark.Pottage@selection.co.uk
> N:Pottage;Mark
> TITLE:Systems Administrator
> END:VCARD
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From isp-list at TULSACONNECT.COM  Fri Oct 29 13:36:30 2004
From: isp-list at TULSACONNECT.COM (Mike Bacher)
Date: Thu Jan 12 21:27:25 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4084.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Jan-Peter Koopmann wrote:

> Well but what would be the benefit of using the commercial product then?
> If you have to install everything by hand then probably the automatic
> updates will not work either. So where is the point?
>
> What's wrong with using the standard FreeBSD version? If there is
> anything I can do to make the port better then please let me know your
> suggestions! :-)

SMGateway isn't just MS -- it is a combination of MS, MailWatch, SA, and some
custom web interface stuff that FSL has come up with (at least, that is my
understanding).

--

-----------------------------------------
Mike Bacher / isp-list@tulsaconnect.com
TCIS - TulsaConnect Internet Services
Phone: 918-584-1100x110 Fax: 918-582-5776
-----------------------------------------

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From Mark.Pottage at SELECTION.CO.UK  Fri Oct 29 13:44:24 2004
From: Mark.Pottage at SELECTION.CO.UK (Mark Pottage)
Date: Thu Jan 12 21:27:25 2006
Subject: DnS for delivery of mail?
Message-ID: <mailman.4085.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

would that not slow down external mail delivery?
 
many thanks
 
Mark Pottage
Systems Administrator
0870 411 7914
07740 578 647
mark.pottage@selection.co.uk

>>> martinh@SOLID-STATE-LOGIC.COM 29/10/2004 13:28:03 >>>
Mark

MailScanner doesn't do any email delivery, rather it sends it to the MTA
  (via placing the message in the correct queue) and the MTA does the
delivery

Why not merely use the internal DNS server in the resolve.conf and have
the local DNS server forward unknown queries to the outside world?

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mark Pottage wrote:
> Can someone tell me whether mailscanner uses the dns from resolv.conf
to
> deliver mail or if there are other entries for delivering mail.
>
> Can it use different dns servers for outgoing mail as opposed to
> internal mail?
>
>
>
> many thanks
>
> Mark Pottage
> Systems Administrator
> 0870 411 7914
> 07740 578 647
> mark.pottage@selection.co.uk <mailto:mark.pottage@selection.co.uk>
>
> --
> This message has been scanned for viruses and
> dangerous content by *Selection Services MailScanner*
> <http://www.selection.co.uk>, and is
> believed to be clean.. ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>
------------------------------------------------------------------------
>
> BEGIN:VCARD
> VERSION:2.1
> X-GWTYPE:USER
> FN:Mark Pottage
> TEL;WORK:0870 411 7914
> ORG:;Internal Support
> TEL;PREF;FAX:0870 163 9001
> EMAIL;WORK;PREF;NGW:Mark.Pottage@selection.co.uk
> N:Pottage;Mark
> TITLE:Systems Administrator
> END:VCARD
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.



--
This message has been scanned for viruses and
dangerous content by Selection Services MailScanner, and is
believed to be clean.. ------------------------ MailScanner list
------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

    [ Part 2, Text/PLAIN (Name: "Mark Pottage.vcf")  18 lines. ]
    [ Unable to print this part. ]


From martinh at SOLID-STATE-LOGIC.COM  Fri Oct 29 13:48:58 2004
From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth)
Date: Thu Jan 12 21:27:25 2006
Subject: DnS for delivery of mail?
Message-ID: <mailman.4086.1137101245.24926.mailscanner@lists.mailscanner.info>

mark

only a few milliseconds....

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Mark Pottage wrote:
> would that not slow down external mail delivery?
>
> many thanks
>
> Mark Pottage
> Systems Administrator
> 0870 411 7914
> 07740 578 647
> mark.pottage@selection.co.uk <mailto:mark.pottage@selection.co.uk>
>
>  >>> martinh@SOLID-STATE-LOGIC.COM 29/10/2004 13:28:03 >>>
> Mark
>
> MailScanner doesn't do any email delivery, rather it sends it to the MTA
>   (via placing the message in the correct queue) and the MTA does the
> delivery
>
> Why not merely use the internal DNS server in the resolve.conf and have
> the local DNS server forward unknown queries to the outside world?
>
> --
> Martin Hepworth
> Snr Systems Administrator
> Solid State Logic
> Tel: +44 (0)1865 842300
>
>
> Mark Pottage wrote:
>  > Can someone tell me whether mailscanner uses the dns from resolv.conf to
>  > deliver mail or if there are other entries for delivering mail.
>  >
>  > Can it use different dns servers for outgoing mail as opposed to
>  > internal mail?
>  >
>  >
>  >
>  > many thanks
>  >
>  > Mark Pottage
>  > Systems Administrator
>  > 0870 411 7914
>  > 07740 578 647
>  > mark.pottage@selection.co.uk <mailto:mark.pottage@selection.co.uk>
>  >
>  > --
>  > This message has been scanned for viruses and
>  > dangerous content by *Selection Services MailScanner*
>  > <http://www.selection.co.uk>, and is
>  > believed to be clean.. ------------------------ MailScanner list
>  > ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
>  > with the words:
>  > 'leave mailscanner' in the body of the email.
>  > Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
>  > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>  >
>  >
>  > ------------------------------------------------------------------------
>  >
>  > BEGIN:VCARD
>  > VERSION:2.1
>  > X-GWTYPE:USER
>  > FN:Mark Pottage
>  > TEL;WORK:0870 411 7914
>  > ORG:;Internal Support
>  > TEL;PREF;FAX:0870 163 9001
>  > EMAIL;WORK;PREF;NGW:Mark.Pottage@selection.co.uk
>  > N:Pottage;Mark
>  > TITLE:Systems Administrator
>  > END:VCARD
>  >
>  >
>  > ------------------------ MailScanner list ------------------------
>  > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>  > 'leave mailscanner' in the body of the email.
>  > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>  > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> **********************************************************************
>
> This email and any files transmitted with it are confidential and
> intended solely for the use of the individual or entity to whom they
> are addressed. If you have received this email in error please notify
> the system manager.
>
> This footnote confirms that this email message has been swept
> for the presence of computer viruses and is believed to be clean.
>
> **********************************************************************
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> --
> This message has been scanned for viruses and
> dangerous content by Selection Services MailScanner, and is
> believed to be clean.
>
>
>
> --
> This message has been scanned for viruses and
> dangerous content by *Selection Services MailScanner*
> <http://www.selection.co.uk>, and is
> believed to be clean.. ------------------------ MailScanner list
> ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk
> with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/)
> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
> ------------------------------------------------------------------------
>
> BEGIN:VCARD
> VERSION:2.1
> X-GWTYPE:USER
> FN:Mark Pottage
> TEL;WORK:0870 411 7914
> ORG:;Internal Support
> TEL;PREF;FAX:0870 163 9001
> EMAIL;WORK;PREF;NGW:Mark.Pottage@selection.co.uk
> N:Pottage;Mark
> TITLE:Systems Administrator
> END:VCARD
>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Fri Oct 29 13:49:45 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:25 2006
Subject: OT: Logging question?
Message-ID: <mailman.4087.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

xterm1 wrote:
>         Does anyone have an idea to stop mailscanner from listing whitelisted
> address's
> in the maillog. I am tring to clean up logwatch without losing the logging
> of actual spam
> but to no avail!
>
> TIA
>
> Brian
>
> RedHat 9.0
> MailScanner-4.34.8-4
> logwatch-5.2.2-1

Isn't it possible to make logwatch ignore these entries instead?

>
>
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
> MailScanner thanks transtec Computers for their support.
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From engled at TRILLION21.COM  Fri Oct 29 14:07:54 2004
From: engled at TRILLION21.COM (Darryl Engle)
Date: Thu Jan 12 21:27:25 2006
Subject: outlook express html problem
Message-ID: <mailman.4088.1137101245.24926.mailscanner@lists.mailscanner.info>

Sorry,

> Our virus detector failed to completely analyse a message you sent:-
>   To: support@XXXXXX.com
>   Subject: Email - Bessemer, AL
>   Date: Thu Oct 28 11:16:40 2004
> Any parts of the message that could not be analysed will not have been
> delivered.
> 
> If you are using Microsoft Outlook, we strongly recommend you change
your
> outgoing message format from "Rich Text" to "HTML" or "Plain Text".
> 
> 1) Click on the "Tools" menu and choose "Options..."
> 2) Got to the "Mail Format" tab
> 3) For message format, select "HTML" or "Plain text"
> 4) Click OK
> 
> The virus detector said this about the message:
> Report: MailScanner: Could not analyze message
> 
> 
> --
> MailScanner
> Email Virus Scanner
> www.mailscanner.info
> MailScanner thanks transtec Computers for their support
> ________________________________________
> From: Greg Davis [mailto:jgdavis@XXXXXX.org]
> Sent: Thursday, October 28, 2004 10:19 AM
> To: Support (support@XXXXX.com)
> Subject: Email - Bessemer, AL
> 
>

Darryl Engle
Trillion Digital

#Do not remove the following line, or various programs
#that require network functionality will fail.
127.0.0.1             localhost.localdomain localhost


> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
> Behalf Of Julian Field
> Sent: Friday, October 29, 2004 3:09 AM
> To: MAILSCANNER@JISCMAIL.AC.UK
> Subject: Re: outlook express html problem
> 
> But what does the MailScanner warning message actually say? The reason
it
> was rejected will be written in there.
> 
> 
> On 28/10/04 9:46 pm, "Darryl Engle" <engled@TRILLION21.COM> wrote:
> 
> > Hardware : P@ 2GHZ, 1 GB Ram, 40GB IDE
> > Software : RH Enterprise, Sendmail-8.12.11-4.RHEL3.1,
> > MailScanner-4.34.8-4, SpamAssassin-3.0.1., ClamAV 0.8.0
> > RBLs : ORDB-RBL SBL+XBL
> > Virus Scanners: ClamAV
> > Volume: 6,000 message/day
> > Average Load: ~1
> >
> > Our old MailScanner died (hardware failure) so I finally had time to
> > upgrade to the above specs from a rather old setup. After I get
every
> > thing working and put back in to production we have had trouble with
> > customers sending us e-mail with outlook express. If OE is set up to
use
> > HTML and they send to us they get back the error in the
> > sender.error.report.txt file. I was able to reproduce this locally,
if I
> > change to plain text it works fine.
> >
> > If I use Eudora I can send HTML or plain text. Is there something
I'm
> > missing, I have set up several MS boxes (all as relays) and have
never
> > seen this. I can't remember the version on the old box that worked
or I
> > would post it.
> >
> > The closest I found in the archives was something about stylized
text
> > causing a problem.
> >
> > On a side note, I have been running MS boxes for over 2 years
without
> > one single hiccup. Great piece of work guys.
> >
> >
> > Thx
> > Darryl Engle
> > Trillion Digital
> >
> > #Do not remove the following line, or various programs
> > #that require network functionality will fail.
> > 127.0.0.1             localhost.localdomain localhost
> >
> > ------------------------ MailScanner list ------------------------
> > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> 
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Fri Oct 29 13:51:29 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:25 2006
Subject: Fortress Systems / SMGateway?
Message-ID: <mailman.4089.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Mike Bacher wrote:
> Jan-Peter Koopmann wrote:
>
>> Well but what would be the benefit of using the commercial product then?
>> If you have to install everything by hand then probably the automatic
>> updates will not work either. So where is the point?
>>
>> What's wrong with using the standard FreeBSD version? If there is
>> anything I can do to make the port better then please let me know your
>> suggestions! :-)
>
>
> SMGateway isn't just MS -- it is a combination of MS, MailWatch, SA, and
> some
> custom web interface stuff that FSL has come up with (at least, that is my
> understanding).

Yes, you're right.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From shrek-m at gmx.de  Fri Oct 29 14:16:06 2004
From: shrek-m at gmx.de (shrek-m@gmx.de)
Date: Thu Jan 12 21:27:25 2006
Subject: Sophos needs Upgrade to find latest Bagle-Gen
Message-ID: <mailman.4090.1137101245.24926.mailscanner@lists.mailscanner.info>

Michael Janssen schrieb:

>on our site, we got many virusses this morning unrecognized by sophos. We
>needed to install the next monthly version of Sophos to fix this despite
>our installed version was "fresh" (september version) enough to download
>and use all IDEs.
>
>I can't say what causes this, but I want to inform you that you should
>consider updating sophos-not-just-ide when you see virusses slipping
>through.
>

thanks,
this was the solution.

--
shrek-m

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From xterm1 at TATORZ.COM  Fri Oct 29 14:06:52 2004
From: xterm1 at TATORZ.COM (xterm1)
Date: Thu Jan 12 21:27:25 2006
Subject: OT: Logging question?
Message-ID: <mailman.4091.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

|Isn't it possible to make logwatch ignore these entries instead?


  I tried that inside the ../scripts/mailscanner  script but it did not
work!
right below where it stated ignore these!

TIA


--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Fri Oct 29 15:10:29 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:25 2006
Subject: Ruleset query / feature request
Message-ID: <mailman.4092.1137101245.24926.mailscanner@lists.mailscanner.info>

Hi

We have multiple domains for clients (and ourselves) that share a common
"branch" ie. Blacknight.ie / blacknightsolutions.com /
blacknightsolutions.it  etc
Quite a few of our clients would have reqistered similar things ie.
Companyname-division.tld companyname-otherdivision.tld etc etc

Unless I am mistaken (which is always possible especially when I don't get
enough caffeine) rulesets at the moment need to be in the format of:

user@domain.tld
Or *@domain.tld
While

*@keyword* will not work

Is that correct?

Would it be possible to implement something like

*@blacknight* so that it would work against blacknight.ie
/blacknightsolutions.ie / blacknight-solutions.com etc ??

Thanks

Michele

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dustin.baer at IHS.COM  Fri Oct 29 15:36:13 2004
From: dustin.baer at IHS.COM (Dustin Baer)
Date: Thu Jan 12 21:27:25 2006
Subject: Ruleset query / feature request
Message-ID: <mailman.4093.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Michele Neylon :: Blacknight Solutions wrote:

>Hi
>
>We have multiple domains for clients (and ourselves) that share a common
>"branch" ie. Blacknight.ie / blacknightsolutions.com /
>blacknightsolutions.it  etc
>Quite a few of our clients would have reqistered similar things ie.
>Companyname-division.tld companyname-otherdivision.tld etc etc
>
>Unless I am mistaken (which is always possible especially when I don't get
>enough caffeine) rulesets at the moment need to be in the format of:
>
>user@domain.tld
>Or *@domain.tld
>While
>
>*@keyword* will not work
>
>Is that correct?
>
I don't think so.  I have:

    From:  *tony.sperduti*@mailchimp.com  no

In my SpamChecks.rules for a mailing list that changes the username
portion all the time and it works fine.  What does your testing show?

Dustin
--
Dustin Baer
Transport Extranet Network Services
Information Handling Services
15 Inverness Way East
Englewood, CO 80112
303-397-2836

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 15:48:32 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Ruleset query / feature request
Message-ID: <mailman.4094.1137101245.24926.mailscanner@lists.mailscanner.info>

Without "/" characters around the address match, * means any number of any
characters. With "/" characters round it, it can accept any syntax that can
be handled as a Perl regular expression (which means you can implement all
sorts of clever rules).

So *.domain.* will work just fine.
And *@blacknight* will work just fine too.


On 29/10/04 3:10 pm, "Michele Neylon :: Blacknight Solutions"
<michele@BLACKNIGHTSOLUTIONS.COM> wrote:

> Hi
>
> We have multiple domains for clients (and ourselves) that share a common
> "branch" ie. Blacknight.ie / blacknightsolutions.com /
> blacknightsolutions.it  etc
> Quite a few of our clients would have reqistered similar things ie.
> Companyname-division.tld companyname-otherdivision.tld etc etc
>
> Unless I am mistaken (which is always possible especially when I don't get
> enough caffeine) rulesets at the moment need to be in the format of:
>
> user@domain.tld
> Or *@domain.tld
> While
>
> *@keyword* will not work
>
> Is that correct?
>
> Would it be possible to implement something like
>
> *@blacknight* so that it would work against blacknight.ie
> /blacknightsolutions.ie / blacknight-solutions.com etc ??
>
> Thanks
>
> Michele
>
> Mr Michele Neylon
> Blacknight Internet Solutions Ltd
> Hosting, co-location & domains
> http://www.blacknight.ie/
> Tel. +353 59 9137101
> Proud sponsors of MM04 {http://www.mm04.net}
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From michele at BLACKNIGHTSOLUTIONS.COM  Fri Oct 29 16:46:24 2004
From: michele at BLACKNIGHTSOLUTIONS.COM (Michele Neylon :: Blacknight Solutions)
Date: Thu Jan 12 21:27:25 2006
Subject: Ruleset query / feature request
Message-ID: <mailman.4095.1137101245.24926.mailscanner@lists.mailscanner.info>

Julian

Thanks for the clarification :)

Michele

Mr Michele Neylon
Blacknight Internet Solutions Ltd
Hosting, co-location & domains
http://www.blacknight.ie/
Tel. +353 59 9137101
Proud sponsors of MM04 {http://www.mm04.net}

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 17:17:43 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-AU
Message-ID: <mailman.4096.1137101245.24926.mailscanner@lists.mailscanner.info>

Are we allowed to sit around feeling smug?
:o)

My MailScanners are currently trapping this for 5 separate reasons.

I think next week might be a busy downloads week for the MailScanner
website. I'll get the new stable release out on Sunday for you all.

Time for the bar, me thinks...

Have a good weekend, and have an extra drink for all those sysadmins out
there who had to rely on the AV vendors to get their signature update out in
time, and who therefore have this thing circulating on their network.
--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From drew at THEMARSHALLS.CO.UK  Fri Oct 29 17:37:46 2004
From: drew at THEMARSHALLS.CO.UK (Drew Marshall)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-AU
Message-ID: <mailman.4097.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Julian Field wrote:

>Are we allowed to sit around feeling smug?
>:o)
>
>
Oh yes, very much so!

>My MailScanners are currently trapping this for 5 separate reasons.
>
>
I caught my first at 08:52:58 BST and there were no signature updates
(In fact Clam updated on it's cron job at 08:53:00 - amazing what
difference 2 seconds can make (So my wife says :-P )).

>I think next week might be a busy downloads week for the MailScanner
>website. I'll get the new stable release out on Sunday for you all.
>
>
Looking forward to it as I only run the stable version here.

>Time for the bar, me thinks...
>
>
Yup!

>Have a good weekend, and have an extra drink for all those sysadmins out
>there who had to rely on the AV vendors to get their signature update out in
>time, and who therefore have this thing circulating on their network.
>
>
:-)

Thanks for all your efforts. A day like today really shows MailScanner
off at it's best.

Drew

--
In line with our policy, this message has
been scanned for viruses and dangerous
content by MailScanner, and is believed to be clean.
www.themarshalls.co.uk/policy

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From roger at RUDNICK.COM.BR  Fri Oct 29 16:31:36 2004
From: roger at RUDNICK.COM.BR (Roger Jochem)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-AU
Message-ID: <mailman.4098.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

My McAfee updated for the third time in a single day... Lucky of us that
have MailScanner to help us...

----- Original Message -----
From: "Drew Marshall" <drew@THEMARSHALLS.CO.UK>
To: <MAILSCANNER@JISCMAIL.AC.UK>
Sent: Friday, October 29, 2004 2:37 PM
Subject: Re: Bagle-AU


> Julian Field wrote:
>
> >Are we allowed to sit around feeling smug?
> >:o)
> >
> >
> Oh yes, very much so!
>
> >My MailScanners are currently trapping this for 5 separate reasons.
> >
> >
> I caught my first at 08:52:58 BST and there were no signature updates
> (In fact Clam updated on it's cron job at 08:53:00 - amazing what
> difference 2 seconds can make (So my wife says :-P )).
>
> >I think next week might be a busy downloads week for the MailScanner
> >website. I'll get the new stable release out on Sunday for you all.
> >
> >
> Looking forward to it as I only run the stable version here.
>
> >Time for the bar, me thinks...
> >
> >
> Yup!
>
> >Have a good weekend, and have an extra drink for all those sysadmins out
> >there who had to rely on the AV vendors to get their signature update out
in
> >time, and who therefore have this thing circulating on their network.
> >
> >
> :-)
>
> Thanks for all your efforts. A day like today really shows MailScanner
> off at it's best.
>
> Drew
>
> --
> In line with our policy, this message has
> been scanned for viruses and dangerous
> content by MailScanner, and is believed to be clean.
> www.themarshalls.co.uk/policy
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mgt at STELLARCORE.NET  Fri Oct 29 17:42:41 2004
From: mgt at STELLARCORE.NET (Mike Tremaine)
Date: Thu Jan 12 21:27:25 2006
Subject: OT: Logging question?
Message-ID: <mailman.4099.1137101245.24926.mailscanner@lists.mailscanner.info>

On Fri, 2004-10-29 at 04:37, xterm1 wrote:
>         Does anyone have an idea to stop mailscanner from listing whitelisted
> address's
> in the maillog. I am tring to clean up logwatch without losing the logging
> of actual spam
> but to no avail!


1) You should ask on the logwatch list. :)

2) If you want to suppress and entire output section. You can do
something like this. Find where the keys are going to be interuppted, in
this case look for this line....

if (keys %Whitelisted_Host) {

Now add a conditional like so.. [make sure you set the detail value
higher then you normally run]

if ((keys %Whitelisted_Host) && ($Detail >= 15)) {

--
Mike Tremaine
mgt@stellarcore.net
http://www.stellarcore.net

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From joshua.hirsh at PARTNERSOLUTIONS.CA  Fri Oct 29 19:15:53 2004
From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua)
Date: Thu Jan 12 21:27:25 2006
Subject: New Archive::Zip fixes virus evasion bug
Message-ID: <mailman.4100.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi Everyone,

 I don't remember seeing anything about this recently, but I noticed this on
the wire today:

 http://rt.cpan.org/NoAuth/Bug.html?id=8077

 and

 http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities



 Julian: Can you add this version into your next Beta (or stable).


 Regards,
-Joshua

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 20:47:04 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: New Archive::Zip fixes virus evasion bug
Message-ID: <mailman.4101.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Already done. What distribution would you like?

Hirsh, Joshua wrote:

>Hi Everyone,
>
> I don't remember seeing anything about this recently, but I noticed this on
>the wire today:
>
> http://rt.cpan.org/NoAuth/Bug.html?id=8077
>
> and
>
> http://www.idefense.com/application/poi/display?id=153&type=vulnerabilities
>
>
>
> Julian: Can you add this version into your next Beta (or stable).
>
>
> Regards,
>-Joshua
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From joshua.hirsh at PARTNERSOLUTIONS.CA  Fri Oct 29 21:53:56 2004
From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua)
Date: Thu Jan 12 21:27:25 2006
Subject: New Archive::Zip fixes virus evasion bug
Message-ID: <mailman.4102.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

> Already done. What distribution would you like?

I already rebuilt my own.. I was just passing on the word ;-)

-Joshua

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Fri Oct 29 22:01:25 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: New Archive::Zip fixes virus evasion bug
Message-ID: <mailman.4103.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I've just put out a new beta. Can someone give it a go please, I don't
want to put this out as a stable release before it's been decently
tested. Thanks folks!

Hirsh, Joshua wrote:

>>Already done. What distribution would you like?
>>
>>
>
>I already rebuilt my own.. I was just passing on the word ;-)
>
>-Joshua
>
>
--

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jrudd at UCSC.EDU  Fri Oct 29 23:31:35 2004
From: jrudd at UCSC.EDU (John Rudd)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-AU
Message-ID: <mailman.4104.1137101245.24926.mailscanner@lists.mailscanner.info>

Julian Field wrote:
>
> Are we allowed to sit around feeling smug?
> :o)
>
> My MailScanners are currently trapping this for 5 separate reasons.
>

Just out of curiosity, what are the different reasons?

(we block all zips currently, because I haven't been able to upgrade our
MS since before the option to block encrypted zips only came out; I'm
sort of hoping that both of these new viruses are blockable via our zip
blocking alone)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From raymond at PROLOCATION.NET  Fri Oct 29 23:42:57 2004
From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn)
Date: Thu Jan 12 21:27:25 2006
Subject: New Archive::Zip fixes virus evasion bug
Message-ID: <mailman.4105.1137101245.24926.mailscanner@lists.mailscanner.info>

Hi!

> I've just put out a new beta. Can someone give it a go please, I don't
> want to put this out as a stable release before it's been decently
> tested. Thanks folks!

>> I already rebuilt my own.. I was just passing on the word ;-)

Installing! ;)

Bye,
Raymond.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Fri Oct 29 23:48:44 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-AU
Message-ID: <mailman.4106.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Rudd wrote:
> Just out of curiosity, what are the different reasons?

I get them with Clam, file name and file type. I guess Julian has more
scanners.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at ENGINENO9INC.COM  Sat Oct 30 00:10:26 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:25 2006
Subject: Errors after upgrade
Message-ID: <mailman.4107.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

My server was upgraded overnight, and I've been alternatively beating my
head against the wall and fixing problems my hosting co. created.

In any event, I *think* I have most everything back to normal, except for
those last little MailScanner steps.

When I set Debug = Yes in MailScanner.conf, I get the following error:
Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE / at
/usr/lib/MailScanner/MailScanner/SweepOther.pm line 197.

spamassassin -D --lint doesn't show any errors, and when I set Debug
SpamAssassin = yes, the only error I get is the one above.

Now using Fedora Core 1, Sendmail 8.12.10, perl 5.8.1.  Was using RH 7.3,
sendmail 8.10?, perl 5.6.1

A swift kick in the right direction would be much appreciated.

Thanks,
Alden

Alden Levy
Engine No. 9, Inc.
130 West 57th Street, Suite 12E
New York, NY 10019
(212) 981-1122
(212) 725-7202 (fax)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at ENGINENO9INC.COM  Sat Oct 30 01:12:07 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:25 2006
Subject: Errors after upgrade
Message-ID: <mailman.4108.1137101245.24926.mailscanner@lists.mailscanner.info>

On Fri, 29 Oct 2004 19:10:26 -0400, Alden Levy <alden@ENGINENO9INC.COM> wrote:

>My server was upgraded overnight, and I've been alternatively beating my
>head against the wall and fixing problems my hosting co. created.
>
>In any event, I *think* I have most everything back to normal, except for
>those last little MailScanner steps.
>
>When I set Debug = Yes in MailScanner.conf, I get the following error:
>Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE / at
>/usr/lib/MailScanner/MailScanner/SweepOther.pm line 197.
>
>spamassassin -D --lint doesn't show any errors, and when I set Debug
>SpamAssassin = yes, the only error I get is the one above.
>
>Now using Fedora Core 1, Sendmail 8.12.10, perl 5.8.1.  Was using RH 7.3,
>sendmail 8.10?, perl 5.6.1
>
>A swift kick in the right direction would be much appreciated.
>
>Thanks,
>Alden
>
Sorry, I forgot to add output of MailScanner -v:
Running on
Linux engine.engineno9inc.com 2.4.20-28.7 #1 Thu Dec 18 11:31:59 EST 2003 i686 i
686 i386 GNU/Linux
This is Fedora Core release 1 (Yarrow)
This is Perl version 5.008001 (5.8.1)

This is MailScanner version 4.34.8
Module versions are:
1.00    AnyDBM_File
1.14    Archive::Zip
1.01    Carp
1.00    DirHandle
1.05    Fcntl
2.72    File::Basename
2.06    File::Copy
2.01    FileHandle
1.06    File::Path
0.14    File::Temp
1.27    HTML::Entities
3.36    HTML::Parser
2.28    HTML::TokeParser
1.21    IO
1.10    IO::File
1.122   IO::Pipe
3.03    MIME::Base64
5.415   MIME::Decoder
5.415   MIME::Decoder::UU
5.413   MIME::Head
5.413   MIME::Parser
3.03    MIME::QuotedPrint
5.413   MIME::Tools
0.09    Net::CIDR
1.06    POSIX
1.76    Socket
0.04    Sys::Syslog
1.02    Time::localtime

Optional module versions are:
1.810   DB_File
1.08    Digest
1.01    Digest::HMAC
2.33    Digest::MD5
2.10    Digest::SHA1
0.44    Inline
0.13    Mail::ClamAV
3.000001        Mail::SpamAssassin
1.997   Mail::SPF::Query
0.15    Net::CIDR::Lite
0.48    Net::DNS
missing Net::LDAP
1.94    Parse::RecDescent
missing SAVI
1.2     Sys::Hostname::Long
2.30    Test::Harness
0.49    Test::Simple
1.95    Text::Balanced
1.34    URI

Alden Levy
Engine No. 9, Inc.
130 West 57th Street, Suite 12E
New York, NY 10019
(212) 981-1122
(212) 725-7202 (fax)

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alex at nkpanama.com  Sat Oct 30 02:03:06 2004
From: alex at nkpanama.com (Alex Neuman van der Hans)
Date: Thu Jan 12 21:27:25 2006
Subject: Way OT: SMTP/POP/IMAP (Whole mailserver, actually) redundancy
Message-ID: <mailman.4109.1137101245.24926.mailscanner@lists.mailscanner.info>

I'm about to embark on several projects where having total email server
redundancy would be a good thing to have. The servers would be in
geographically separate locations.

I've considered using a secondary MX that forwards everything to a primary
(after processing by MS) and then rsyncs the mailboxes from the primary so
that if you go to, say, mail2.company.com you can get a basic webmail page
that lets you read the last known copy of the user's mailbox (and home
directory, etc.) before whatever failure (connectivity, hardware) took down
the primary. Problem would be that since the primary MX is supposed to
receive the mail, new mail after the failure would get stuck in the outgoing
queue on the secondary unless the configuration was changed so that mail is
delivered to local users on said secondary - and re-rsyncing the mailboxes
to the primary on reconnection.

I guess one could write a script that would test for the existence and
connectivity of the first server, and make the changes automatically; I
would have to be absolutely sure the primary is down by checking for several
conditions.

I'm sure there's probably an easier way without reinventing the wheel,
specially if I want to keep using Sendmail/MailScanner/etc.

Any thoughts? If it's too off-topic replies off-list are welcome. Thanks in
advance.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From dhawal at NETMAGICSOLUTIONS.COM  Sat Oct 30 10:11:29 2004
From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy)
Date: Thu Jan 12 21:27:25 2006
Subject: Some Questions
Message-ID: <mailman.4110.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

A few question for the list..

1. Can I do this?
Only skip virus scan for some domains
Set "Virus Scanning = /etc/MailScanner/rules/virus.scanning.rules".
    FromOrTo:    *@scanme.com            no
    FromOrTo:    *@scanme-too.com        no
    FromOrTo:    default                 yes

2. Also does McAfee updates use the daily dat or the weekly + extra dats

3. How do I integrate a "Report as spam" mechanism with horde/imp,
squirrelmail and sqwebmail

4. Finally I use MS with postfix, in the mailwatch interface, release
from quarantine sends out mail in a raw (queue) format.. how do I
release the message from quarantine cleanly? I have the following option
  in MailScanner.conf
"Quarantine Whole Messages As Queue Files = yes"

MS: 4.34.8-4
MW: 0.5.1
Postfix: 2.0.16-14
OS: CentOS 3.3

regards,
- dhawal

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marcin.rozek at IOS.EDU.PL  Sat Oct 30 13:08:01 2004
From: marcin.rozek at IOS.EDU.PL (Marcin Rozek)
Date: Thu Jan 12 21:27:25 2006
Subject: New Archive::Zip fixes virus evasion bug
Message-ID: <mailman.4111.1137101245.24926.mailscanner@lists.mailscanner.info>

I've just downloaded MailScanner-4.35.8-1.rpm.tar.gz.
For some reason install.sh said:

Oh good, module Compress::Zlib version 1.33 is already installed.

Attempting to build and install perl-Archive-Zlib-1.14-1
(...)
error: failed dependencies:
perl(Compress::Zlib) is needed by perl-Archive-Zip-1.14-1

When i manually --rebuild and installed perl-Compress-Zlib-1.33-2.src.rpm
then perl-Archive-Zlib-1.14-1 didn't complain about dependencies anymore.
I guess install.sh should rebuild Compress::Zlib.

Regards,
Marcin

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From brose at MED.WAYNE.EDU  Sat Oct 30 18:29:50 2004
From: brose at MED.WAYNE.EDU (Rose, Bobby)
Date: Thu Jan 12 21:27:25 2006
Subject: Perl Error with 4.35.8-1
Message-ID: <mailman.4112.1137101245.24926.mailscanner@lists.mailscanner.info>

 
I can't seem to get this version to work on my Solaris 8 system.  I keep
getting a MIME-tools compile errors because of MIME::Base64.  If I
compile manually, it compiles ok but Mailscanner fails to start
complaining about MIME::Base64

Starting MailScanner...
MIME::Base64 object version 2.12 does not match bootstrap parameter 3.05
at
/usr/local/ActivePerl-5.8/lib/5.8.0/sun4-solaris-thread-multi/DynaLoader
.pm line 249.
Compilation failed in require at /opt/MailScanner/bin/MailScanner line
52.
BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner
line 56.


I've compiled MIME::Base64 manually and it tests ok but doesn't fix the
issue.  Does anyone know how to fix this bootstrap perl issue?  I see
this error on google for other versions of Mime::Base64 but no solution.
I've even gone into my perl folders and removed the Mime:Base64 files
and recompiled but still doesn't work.  So I must be missing something.

Thanks for any info.
-=B

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From alden at ENGINENO9INC.COM  Sat Oct 30 23:02:27 2004
From: alden at ENGINENO9INC.COM (Alden Levy)
Date: Thu Jan 12 21:27:25 2006
Subject: Errors after upgrade
Message-ID: <mailman.4113.1137101245.24926.mailscanner@lists.mailscanner.info>

After further examination, and the uninstall (rpm -e mailscanner) and
reinstall of MailScanner, I no longer receive the error when I set Debug =
yes in MailScanner.conf.
However, it seems that even though I have Max Children = 2, I am getting
processes dying and spawned very quickly.  I searched the archives and found
that sometimes SA is to blame, so I set Use SpamAssassin = no, but I get the
same problem.  Here is a sampling of my maillog:


Oct 30 17:46:50 engine MailScanner[11701]: MailScanner child caught a SIGHUP
Oct 30 17:50:34 engine sendmail[11863]: alias database /etc/aliases rebuilt
by root
Oct 30 17:50:34 engine sendmail[11863]: /etc/aliases: 46 aliases, longest 39
bytes, 565 bytes total
Oct 30 17:50:34 engine sendmail[11872]: starting daemon (8.12.10): SMTP
Oct 30 17:50:35 engine sm-msp-queue[11877]: starting daemon (8.12.10):
queueing@00:15:00
Oct 30 17:50:35 engine sendmail[11883]: starting daemon (8.12.10):
queueing@00:15:00
Oct 30 17:50:36 engine MailScanner[11902]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:50:36 engine MailScanner[11902]: Using locktype = flock
Oct 30 17:50:36 engine MailScanner[11902]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:50:37 engine MailScanner[11902]: Virus and Content Scanning: Starting
Oct 30 17:50:46 engine MailScanner[11943]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:50:46 engine MailScanner[11943]: Using locktype = flock
Oct 30 17:50:46 engine MailScanner[11943]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:50:47 engine MailScanner[11943]: Virus and Content Scanning: Starting
Oct 30 17:50:56 engine MailScanner[11980]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:50:56 engine MailScanner[11980]: Using locktype = flock
Oct 30 17:50:56 engine MailScanner[11980]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:50:57 engine MailScanner[11980]: Virus and Content Scanning: Starting
Oct 30 17:51:06 engine MailScanner[12020]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:51:06 engine MailScanner[12020]: Using locktype = flock
Oct 30 17:51:06 engine MailScanner[12020]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:51:07 engine MailScanner[12020]: Virus and Content Scanning: Starting
Oct 30 17:51:16 engine MailScanner[12057]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:51:16 engine MailScanner[12057]: Using locktype = flock
Oct 30 17:51:16 engine MailScanner[12057]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:51:17 engine MailScanner[12057]: Virus and Content Scanning: Starting
Oct 30 17:51:26 engine MailScanner[12095]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:51:26 engine MailScanner[12095]: Using locktype = flock
Oct 30 17:51:26 engine MailScanner[12095]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:51:27 engine MailScanner[12095]: Virus and Content Scanning: Starting
Oct 30 17:51:36 engine MailScanner[12132]: MailScanner E-Mail Virus Scanner
version 4.34.8 starting...
Oct 30 17:51:36 engine MailScanner[12132]: Using locktype = flock
Oct 30 17:51:36 engine MailScanner[12132]: New Batch: Scanning 15 messages,
110815 bytes
Oct 30 17:51:37 engine MailScanner[12132]: Virus and Content Scanning: Starting


I am wondering if the changes to sendmail might have something to do with
this.  Can someone please explain the relationship between the various
queues in sendmail and MS?  For example, is my outgoing queue directory for
MS supposed to be the same as some queue in sendmail?  Sorry if this is
silly or stupid, but MS was working like a dream a few days ago, and needed
very little input from me (except for the occassional upgrade/patch).

Any help would be appreciated.
Regards,
Alden

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sun Oct 31 01:18:28 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: MailScanner plugins for Exchange and Domino
Message-ID: <mailman.4114.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

This sounds brilliant, many thanks!

I'll post them to the list first, so that other people can try them out
first. I haven't got an Exchange or Domino system I can experiment with
(we only have production systems of those) so I can't check that they
work okay myself. Hope you understand!

Tonny Yu wrote:

>Hi,
>
>My developers have created free plugins for Exchange and Domino which works
>with MailScanner.
>
>http://www.mailshell.com/mail/client/oem2.html/step/dominoplugin
>This free Domino plugin can create a spam folder in each user's Domino mailbox and move any incoming message that is marked with a
>specific mail header by MailScanner, to that folder.
>
>
>http://www.mailshell.com/mail/client/oem2.html/step/exchangeplugin
>This free Exchange plugin can create a spam folder in each user's Exchange mailbox and move any incoming message that is marked with
>a specific mail header by MailScanner, to that folder.
>
>I think your users will find them very helpful. Can you add links to them on your
>site?
>
>Thanks.
>
>Regards,
>
>       Tonny
>
>____________________________________________
>Tonny Yu, CEO               Mailshell Inc.
>Tel: 415.348.8728 x109      The OEM Anti-Spam Leader
>Fax: 415.276.5749           http://www.mailshell.com
>
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sun Oct 31 01:30:39 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Errors after upgrade
Message-ID: <mailman.4115.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Alden Levy wrote:

>On Fri, 29 Oct 2004 19:10:26 -0400, Alden Levy <alden@ENGINENO9INC.COM> wrote:
>
>
>
>>My server was upgraded overnight, and I've been alternatively beating my
>>head against the wall and fixing problems my hosting co. created.
>>
>>In any event, I *think* I have most everything back to normal, except for
>>those last little MailScanner steps.
>>
>>When I set Debug = Yes in MailScanner.conf, I get the following error:
>>Quantifier follows nothing in regex; marked by <-- HERE in m/* <-- HERE / at
>>/usr/lib/MailScanner/MailScanner/SweepOther.pm line 197.
>>
>>spamassassin -D --lint doesn't show any errors, and when I set Debug
>>SpamAssassin = yes, the only error I get is the one above.
>>
>>Now using Fedora Core 1, Sendmail 8.12.10, perl 5.8.1.  Was using RH 7.3,
>>sendmail 8.10?, perl 5.6.1
>>
>>A swift kick in the right direction would be much appreciated.
>>
>>Thanks,
>>Alden
>>
>>
>>
>Sorry, I forgot to add output of MailScanner -v:
>Running on
>Linux engine.engineno9inc.com 2.4.20-28.7 #1 Thu Dec 18 11:31:59 EST 2003 i686 i
>686 i386 GNU/Linux
>This is Fedora Core release 1 (Yarrow)
>This is Perl version 5.008001 (5.8.1)
>
>This is MailScanner version 4.34.8
>
>
It doesn't like one of your filename.rules.conf lines. Have you got a
rule in there where the match expression starts with a "*"? In this file
(and filetype.rules.conf) the match expressions are regular expressions,
so you really meant ".*" and not just "*". Sorry for the lousy error
message.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sun Oct 31 01:26:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Bagle-AU
Message-ID: <mailman.4116.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

John Rudd wrote:

>Julian Field wrote:
>
>
>>Are we allowed to sit around feeling smug?
>>:o)
>>
>>My MailScanners are currently trapping this for 5 separate reasons.
>>
>>
>>
>
>Just out of curiosity, what are the different reasons?
>
>(we block all zips currently, because I haven't been able to upgrade our
>MS since before the option to block encrypted zips only came out; I'm
>sort of hoping that both of these new viruses are blockable via our zip
>blocking alone)
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sun Oct 31 01:34:00 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Some Questions
Message-ID: <mailman.4117.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Dhawal Doshy wrote:

> A few question for the list..
>
> 1. Can I do this?
> Only skip virus scan for some domains
> Set "Virus Scanning = /etc/MailScanner/rules/virus.scanning.rules".
>    FromOrTo:    *@scanme.com            no
>    FromOrTo:    *@scanme-too.com        no
>    FromOrTo:    default                 yes

Yes.
I'll have to leave other people to answer the others.

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mailscanner at ecs.soton.ac.uk  Sun Oct 31 01:37:30 2004
From: mailscanner at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Perl Error with 4.35.8-1
Message-ID: <mailman.4118.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Take a look in your perl directories for Base64.xs and QuotedPrint.xs
files (and/or any .so files of the same name).

Also, are you sure you are only ever using 1 Perl installation?
Hopefully your /usr/bin/perl either doesn't exist or is a link to
/usr/local/..../perl.

I only test the Solaris systems against the Sun-provided copy of Perl.

Rose, Bobby wrote:

> I can't seem to get this version to work on my Solaris 8 system.  I keep
>getting a MIME-tools compile errors because of MIME::Base64.  If I
>compile manually, it compiles ok but Mailscanner fails to start
>complaining about MIME::Base64
>
>Starting MailScanner...
>MIME::Base64 object version 2.12 does not match bootstrap parameter 3.05
>at
>/usr/local/ActivePerl-5.8/lib/5.8.0/sun4-solaris-thread-multi/DynaLoader
>.pm line 249.
>Compilation failed in require at /opt/MailScanner/bin/MailScanner line
>52.
>BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner
>line 56.
>
>
>I've compiled MIME::Base64 manually and it tests ok but doesn't fix the
>issue.  Does anyone know how to fix this bootstrap perl issue?  I see
>this error on google for other versions of Mime::Base64 but no solution.
>I've even gone into my perl folders and removed the Mime:Base64 files
>and recompiled but still doesn't work.  So I must be missing something.
>
>Thanks for any info.
>-=B
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From vlad at MAZEK.COM  Sun Oct 31 03:25:46 2004
From: vlad at MAZEK.COM (Vlad Mazek)
Date: Thu Jan 12 21:27:25 2006
Subject: bounce rules
Message-ID: <mailman.4119.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Greetings,

I had a question in regard to the bounce.rules file, in particular this
part:
/
/

    /# You must *only* enable this for mail from sites with which you have
    # agreed to bounce possible spam. Use it on low-scoring spam only (<10)/


How do you instruct MailScanner to bounce only low-scoring spam? I see
the option for "High Scoring Spam Actions" but is there a counterpart
for the low-scores as well?

-Vlad

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From vlad at MAZEK.COM  Sun Oct 31 03:30:56 2004
From: vlad at MAZEK.COM (Vlad Mazek)
Date: Thu Jan 12 21:27:25 2006
Subject: bounce rules
Message-ID: <mailman.4120.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Apparently little rtfm goes a long way: Spam actions =
%rules-dir%/bounce.rules

While I am at it, does anybody know which version this feature became
stable on?

Thanks in advance.

-Vlad

Vlad Mazek wrote:

> Greetings,
>
> I had a question in regard to the bounce.rules file, in particular this
> part:
> /
> /
>
>    /# You must *only* enable this for mail from sites with which you have
>    # agreed to bounce possible spam. Use it on low-scoring spam only
> (<10)/
>
>
> How do you instruct MailScanner to bounce only low-scoring spam? I see
> the option for "High Scoring Spam Actions" but is there a counterpart
> for the low-scores as well?
>
> -Vlad
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From peter at UCGBOOK.COM  Sun Oct 31 10:03:54 2004
From: peter at UCGBOOK.COM (Peter Bonivart)
Date: Thu Jan 12 21:27:25 2006
Subject: bounce rules
Message-ID: <mailman.4121.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Vlad Mazek wrote:
> Apparently little rtfm goes a long way: Spam actions =
> %rules-dir%/bounce.rules
>
> While I am at it, does anybody know which version this feature became
> stable on?

According to the change log:

http://www.sng.ecs.soton.ac.uk/mailscanner/ChangeLog

it was added in 4.27.

1/3/2004 New in Version 4.27.7
- Added "Enable Spam Bounce" ruleset for selectively switching on
permission to bounce spam for your most important customers.

--
/Peter Bonivart

--Unix lovers do it in the Sun

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From brose at MED.WAYNE.EDU  Sun Oct 31 15:10:24 2004
From: brose at MED.WAYNE.EDU (Rose, Bobby)
Date: Thu Jan 12 21:27:25 2006
Subject: Perl Error with 4.35.8-1
Message-ID: <mailman.4122.1137101245.24926.mailscanner@lists.mailscanner.info>

I've been using ActivePerl 5.8 for a long time (since Spamassassin
preferred using 5.8) and /usr/bin/perl is softlinked to it's perl
binary.  .xs?  Mine are .bs and .so files.  I haven't had any problems
with MS or AciveState's Perl before and I've been using MS for almost
3-4yrs now.


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Saturday, October 30, 2004 8:38 PM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Perl Error with 4.35.8-1

Take a look in your perl directories for Base64.xs and QuotedPrint.xs
files (and/or any .so files of the same name).

Also, are you sure you are only ever using 1 Perl installation?
Hopefully your /usr/bin/perl either doesn't exist or is a link to
/usr/local/..../perl.

I only test the Solaris systems against the Sun-provided copy of Perl.

Rose, Bobby wrote:

> I can't seem to get this version to work on my Solaris 8 system.  I 
>keep getting a MIME-tools compile errors because of MIME::Base64.  If I

>compile manually, it compiles ok but Mailscanner fails to start 
>complaining about MIME::Base64
>
>Starting MailScanner...
>MIME::Base64 object version 2.12 does not match bootstrap parameter 
>3.05 at 
>/usr/local/ActivePerl-5.8/lib/5.8.0/sun4-solaris-thread-multi/DynaLoade
>r
>.pm line 249.
>Compilation failed in require at /opt/MailScanner/bin/MailScanner line 
>52.
>BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner 
>line 56.
>
>
>I've compiled MIME::Base64 manually and it tests ok but doesn't fix the

>issue.  Does anyone know how to fix this bootstrap perl issue?  I see 
>this error on google for other versions of Mime::Base64 but no
solution.
>I've even gone into my perl folders and removed the Mime:Base64 files 
>and recompiled but still doesn't work.  So I must be missing something.
>
>Thanks for any info.
>-=B
>
>------------------------ MailScanner list ------------------------ To 
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the 
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz MailScanner thanks
transtec Computers for their support Buy the MailScanner book at
www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From jkf at ecs.soton.ac.uk  Sun Oct 31 15:17:04 2004
From: jkf at ecs.soton.ac.uk (Julian Field)
Date: Thu Jan 12 21:27:25 2006
Subject: Perl Error with 4.35.8-1
Message-ID: <mailman.4123.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

The MIME::Base64 module is now installed in the site_perl directories.
What is your @INC? "perl -V" should give you that.

Rose, Bobby wrote:

>I've been using ActivePerl 5.8 for a long time (since Spamassassin
>preferred using 5.8) and /usr/bin/perl is softlinked to it's perl
>binary.  .xs?  Mine are .bs and .so files.  I haven't had any problems
>with MS or AciveState's Perl before and I've been using MS for almost
>3-4yrs now.
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
>Behalf Of Julian Field
>Sent: Saturday, October 30, 2004 8:38 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Perl Error with 4.35.8-1
>
>Take a look in your perl directories for Base64.xs and QuotedPrint.xs
>files (and/or any .so files of the same name).
>
>Also, are you sure you are only ever using 1 Perl installation?
>Hopefully your /usr/bin/perl either doesn't exist or is a link to
>/usr/local/..../perl.
>
>I only test the Solaris systems against the Sun-provided copy of Perl.
>
>Rose, Bobby wrote:
>
>
>
>>I can't seem to get this version to work on my Solaris 8 system.  I
>>keep getting a MIME-tools compile errors because of MIME::Base64.  If I
>>
>>
>
>
>
>>compile manually, it compiles ok but Mailscanner fails to start
>>complaining about MIME::Base64
>>
>>Starting MailScanner...
>>MIME::Base64 object version 2.12 does not match bootstrap parameter
>>3.05 at
>>/usr/local/ActivePerl-5.8/lib/5.8.0/sun4-solaris-thread-multi/DynaLoade
>>r
>>.pm line 249.
>>Compilation failed in require at /opt/MailScanner/bin/MailScanner line
>>52.
>>BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner
>>line 56.
>>
>>
>>I've compiled MIME::Base64 manually and it tests ok but doesn't fix the
>>
>>
>
>
>
>>issue.  Does anyone know how to fix this bootstrap perl issue?  I see
>>this error on google for other versions of Mime::Base64 but no
>>
>>
>solution.
>
>
>>I've even gone into my perl folders and removed the Mime:Base64 files
>>and recompiled but still doesn't work.  So I must be missing something.
>>
>>Thanks for any info.
>>-=B
>>
>>------------------------ MailScanner list ------------------------ To
>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks
>transtec Computers for their support Buy the MailScanner book at
>www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
--
Julian Field                Teaching Systems Manager
jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                            Southampton SO17 1BJ

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From mike at CAMAROSS.NET  Sun Oct 31 15:54:44 2004
From: mike at CAMAROSS.NET (Mike Kercher)
Date: Thu Jan 12 21:27:25 2006
Subject: Time Difference
Message-ID: <mailman.4124.1137101245.24926.mailscanner@lists.mailscanner.info>

What would cause this:

Oct 31 07:52:33 www MailScanner[8666]: SophosSAVI::INFECTED:: W32/Bagle-AU::
./i9VFqOg14300/price.scr

Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: SophosSAVI found 1
infections

Oct 31 07:52:34 www MailScanner[8666]: Infected message i9VFqOg14300 came
from 70.113.52.139

Oct 31 07:52:34 www MailScanner[8666]: Virus Scanning: Found 1 viruses

Oct 31 07:52:34 www MailScanner[8666]: Filename Checks: Possible virus
hidden in a screensaver (i9VFqOg14300 price.scr)

Oct 31 07:52:34 www MailScanner[8666]: Other Checks: Found 1 problems

Oct 31 09:52:34 www sendmail[14306]: i9VFqY514306: from=postmaster,
size=1036, class=0, nrcpts=1,
msgid=<200410311552.i9VFqY514306@www.abby.com>, relay=root@localhost

Oct 31 07:52:34 www MailScanner[8666]: Notices: Warned about 1 messages

The time that sendmail stamps in the log is correct.  The time that
MailScanner (or perl) stamps in the log is 2 hours behind.

Mike

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From anders.andersson at LTKALMAR.SE  Sun Oct 31 16:31:22 2004
From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT)
Date: Thu Jan 12 21:27:25 2006
Subject: SV: MailScanner plugins for Exchange and Domino
Message-ID: <mailman.4125.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

I will give it at try as soon as I get some time over. Thanks in advance

/Anders 

> -----Ursprungligt meddelande-----
> Från: MailScanner mailing list 
> [mailto:MAILSCANNER@JISCMAIL.AC.UK] För Julian Field
> Skickat: den 31 oktober 2004 02:18
> Till: MAILSCANNER@JISCMAIL.AC.UK
> Ämne: Re: MailScanner plugins for Exchange and Domino
> 
> This sounds brilliant, many thanks!
> 
> I'll post them to the list first, so that other people can 
> try them out first. I haven't got an Exchange or Domino 
> system I can experiment with (we only have production systems 
> of those) so I can't check that they work okay myself. Hope 
> you understand!
> 
> Tonny Yu wrote:
> 
> >Hi,
> >
> >My developers have created free plugins for Exchange and 
> Domino which 
> >works with MailScanner.
> >
> >http://www.mailshell.com/mail/client/oem2.html/step/dominoplugin
> >This free Domino plugin can create a spam folder in each 
> user's Domino 
> >mailbox and move any incoming message that is marked with a 
> specific mail header by MailScanner, to that folder.
> >
> >
> >http://www.mailshell.com/mail/client/oem2.html/step/exchangeplugin
> >This free Exchange plugin can create a spam folder in each user's 
> >Exchange mailbox and move any incoming message that is 
> marked with a specific mail header by MailScanner, to that folder.
> >
> >I think your users will find them very helpful. Can you add links to 
> >them on your site?
> >
> >Thanks.
> >
> >Regards,
> >
> >       Tonny
> >
> >____________________________________________
> >Tonny Yu, CEO               Mailshell Inc.
> >Tel: 415.348.8728 x109      The OEM Anti-Spam Leader
> >Fax: 415.276.5749           http://www.mailshell.com
> >
> >
> >
> >
> 
> --
> Julian Field
> www.MailScanner.info
> Professional Support Services at www.MailScanner.biz 
> MailScanner thanks transtec Computers for their support Buy 
> the MailScanner book at www.MailScanner.info/store
> 
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> 
> ------------------------ MailScanner list 
> ------------------------ To unsubscribe, email 
> jiscmail@jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ 
> (http://www.mailscanner.biz/maq/) and the archives 
> (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From brose at MED.WAYNE.EDU  Sun Oct 31 18:14:06 2004
From: brose at MED.WAYNE.EDU (Rose, Bobby)
Date: Thu Jan 12 21:27:25 2006
Subject: Perl Error with 4.35.8-1
Message-ID: <mailman.4126.1137101245.24926.mailscanner@lists.mailscanner.info>

Thanks Julian that helped.  Looking at the @INC allowed me to find where
the duplicate old module which was installed which was under
lib/5.8.0/sun4-solaris-thread-multi/auto/MIME.


-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On
Behalf Of Julian Field
Sent: Sunday, October 31, 2004 10:17 AM
To: MAILSCANNER@JISCMAIL.AC.UK
Subject: Re: Perl Error with 4.35.8-1

The MIME::Base64 module is now installed in the site_perl directories.
What is your @INC? "perl -V" should give you that.

Rose, Bobby wrote:

>I've been using ActivePerl 5.8 for a long time (since Spamassassin 
>preferred using 5.8) and /usr/bin/perl is softlinked to it's perl 
>binary.  .xs?  Mine are .bs and .so files.  I haven't had any problems 
>with MS or AciveState's Perl before and I've been using MS for almost 
>3-4yrs now.
>
>
>-----Original Message-----
>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On 
>Behalf Of Julian Field
>Sent: Saturday, October 30, 2004 8:38 PM
>To: MAILSCANNER@JISCMAIL.AC.UK
>Subject: Re: Perl Error with 4.35.8-1
>
>Take a look in your perl directories for Base64.xs and QuotedPrint.xs 
>files (and/or any .so files of the same name).
>
>Also, are you sure you are only ever using 1 Perl installation?
>Hopefully your /usr/bin/perl either doesn't exist or is a link to 
>/usr/local/..../perl.
>
>I only test the Solaris systems against the Sun-provided copy of Perl.
>
>Rose, Bobby wrote:
>
>
>
>>I can't seem to get this version to work on my Solaris 8 system.  I 
>>keep getting a MIME-tools compile errors because of MIME::Base64.  If 
>>I
>>
>>
>
>
>
>>compile manually, it compiles ok but Mailscanner fails to start 
>>complaining about MIME::Base64
>>
>>Starting MailScanner...
>>MIME::Base64 object version 2.12 does not match bootstrap parameter
>>3.05 at
>>/usr/local/ActivePerl-5.8/lib/5.8.0/sun4-solaris-thread-multi/DynaLoad
>>e
>>r
>>.pm line 249.
>>Compilation failed in require at /opt/MailScanner/bin/MailScanner line

>>52.
>>BEGIN failed--compilation aborted at /opt/MailScanner/bin/MailScanner 
>>line 56.
>>
>>
>>I've compiled MIME::Base64 manually and it tests ok but doesn't fix 
>>the
>>
>>
>
>
>
>>issue.  Does anyone know how to fix this bootstrap perl issue?  I see 
>>this error on google for other versions of Mime::Base64 but no
>>
>>
>solution.
>
>
>>I've even gone into my perl folders and removed the Mime:Base64 files 
>>and recompiled but still doesn't work.  So I must be missing
something.
>>
>>Thanks for any info.
>>-=B
>>
>>------------------------ MailScanner list ------------------------ To 
>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the

>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>
>>
>>
>>
>
>--
>Julian Field
>www.MailScanner.info
>Professional Support Services at www.MailScanner.biz MailScanner thanks

>transtec Computers for their support Buy the MailScanner book at 
>www.MailScanner.info/store
>
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>------------------------ MailScanner list ------------------------ To 
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the 
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>------------------------ MailScanner list ------------------------ To 
>unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the 
>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>
>

--
--
Julian Field                Teaching Systems Manager
jkf@ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                            Southampton SO17 1BJ

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From marco at XSSNET.COM  Sun Oct 31 19:19:57 2004
From: marco at XSSNET.COM (Marco Benton)
Date: Thu Jan 12 21:27:25 2006
Subject: new rename feature or something
Message-ID: <mailman.4127.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

i was going through the Perl modules and was attempting to patch my own
new feature to rename an attachment instead of the standard "allow or
deny" from the filenames and filetypes rules.  i wanted to add a
"rename" to that list cuz pointy-haired managers want engineers to not
be hindered with blocked files but still not let virii through
unmolested.  another quagmire that can lead to a flame war!

so a long time ago i written a Sendmail milter to do this, but now
wanted to do it all within MailScanner.  i'm not a lover of Perl, i'm an
old fashion C programmer.  looking at Perl code makes me vomit, but i
can at least hack my way around and attempt to hack what i want.  but
where do i begin within MailScanner code?  or can i bribe someone here? ;-)

--

Marco Benton - BOFH, BSMFH
Network Consultant
Phone: (774) 808-4051
Fax  : (508) 519-6033

BOFH excuse #276: The cause of the problem is: Your Flux Capacitor has gone bad.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From james_gray at ocs.com  Sun Oct 31 20:29:51 2004
From: james_gray at ocs.com (James Gray)
Date: Thu Jan 12 21:27:25 2006
Subject: Calling Debian admins - this should be easy
Message-ID: <mailman.4128.1137101245.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi All,

I've been using the tar ball version of MailScanner on Debian (and fBSD) for a
while.  Due to an exponential increase in workload, and the expansion of our
mail network, I'd  like to switch to the ".deb"  version of MailScanner on
Debian stable (Woody).  We're retiring our fBSD boxes and replacing them with
"Linux on Opteron" systems...yummy!

I've successfully pulled the latest (3.0.1) SpamAssassin from backports.org
but I can't seem to cast the correct incantation to apt to install the latest
MailScanner.  I've tried "-t unstable" but no joy.  Do I need to pin
MailScanner to a particular version/release in apt?  Can someone send me a
sample apt.conf and sources.list - or maybe just the correct invocation of
apt?  Yes I've read the MAQ, FAQ and even the FM (as in RTFM)....I think I've
clued myself into a state of confusion - all clue-bats welcome at this stage.

Cheers,

James

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).


From ugob at CAMO-ROUTE.COM  Thu Oct 21 21:51:40 2004
From: ugob at CAMO-ROUTE.COM (Ugo Bellavance)
Date: Thu Jan 12 21:27:54 2006
Subject: perl-URI-1.31.1.src.rpm
Message-ID: <mailman.5779.1137101274.24926.mailscanner@lists.mailscanner.info>

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Terran Wright wrote:
> I've got 1.21 and apparently SA doesn't like it

I've got 1.21 and SA running on the same box.  Was SA 2.6x and now 3.0.

If you gave us more details, we might be of help.

hth

Ugo

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!


From sanjay.patel at REXWIRE.COM  Mon Oct 18 14:30:03 2004
From: sanjay.patel at REXWIRE.COM (Sanjay K. Patel)
Date: Thu Jan 12 21:28:46 2006
Subject: Sa-learn tricks
Message-ID: <mailman.8739.1137101326.24926.mailscanner@lists.mailscanner.info>

Although this is a bit of topic I was hoping someone here might have a
answer. I want to send spam not caught by mailscanner back to the server for
sa-learn to learn the spam. The question is "does sa-learn learn the content
of the spam or the headers also?". My concern is that all the headers will
have my info since I am forwarding it and I don't want sa-learn to think I
am a spammer.

Also has anyone noticed that the Outlook junk filter catch's almost all the
spam that makes it through. I think it uses keywords which is pretty weak
but makes it easier for me to set a rule that forwards anything that hits
that folder to go back to the server.

SKP

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail@jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!