From P.G.M.Peters at UTWENTE.NL Fri Apr 1 12:47:32 2005 From: P.G.M.Peters at UTWENTE.NL (Peter Peters) Date: Thu Jan 12 21:29:12 2006 Subject: Newlines (\n) in subjects Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stijn Jonker wrote on 31-3-2005 21:18: > First of all: I know this has been discussed recently but I can't find > it in the jiscmail archives. > > It seems that MailScanner is inserting a \n in subject lines somewhere > around char 80, I tried to dig the source on how to disable this, but > unfortunaly I couldn't find it. Are you sure MS is doing this? I know some MTA's (MS comes to mind) are doing that (incorrectly). -- Peter Peters, senior beheerder (Security) Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Fri Apr 1 14:52:41 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:13 2006 Subject: SA Timeouts & requeue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] My Spamassassin keeps timing out (SpamAssassin Timeout = 240) and keeps delivering the SPAM message. Is there anyway I can have these messages requeued until SA is available? My Specs are AMD K62/400, 128MB RAM. I have only 1 child process running cause of the limited RAM. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 1 15:08:44 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:13 2006 Subject: SA Timeouts & requeue Message-ID: Devon what version of SA, any RBL's an dany extra rules defined for SA? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Devon Harding wrote: > My Spamassassin keeps timing out (SpamAssassin Timeout = 240) and > keeps delivering the SPAM message. Is there anyway I can have these > messages requeued until SA is available? > > My Specs are AMD K62/400, 128MB RAM. I have only 1 child process > running cause of the limited RAM. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Fri Apr 1 15:34:56 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:13 2006 Subject: SA Timeouts & requeue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Using SA 3.0.2 In MailScanner: Spam List = dslb.org ORDB-RBL SBL+XBL spamhaus.org spamhaus-XBL spamcop.net NJABL CBL RSL DSBL SORBS-SPAM SURBL in /etc/mail/spamassassin/: -rw-r--r-- 1 root root 3.9K Apr 24 2004 70_sare_bayes_poison_nxm.cf -rw-r--r-- 1 root root 24K Mar 19 10:16 70_sare_evilnum0.cf -rw-r--r-- 1 root root 1.6K Mar 13 12:43 70_sare_evilnum1.cf -rw-r--r-- 1 root root 6.9K Mar 13 12:43 70_sare_evilnum2.cf -rw-r--r-- 1 root root 37K Mar 14 23:08 70_sare_html0.cf -rw-r--r-- 1 root root 44K Mar 14 23:08 70_sare_html1.cf -rw-r--r-- 1 root root 8.0K Mar 14 23:08 70_sare_html2.cf -rw-r--r-- 1 root root 19K Mar 14 23:08 70_sare_html3.cf -rw-r--r-- 1 root root 22K Mar 14 23:08 70_sare_html4.cf -rw-r--r-- 1 root root 2.8K Mar 14 23:08 70_sare_html_eng.cf -rw-r--r-- 1 root root 49K Mar 14 23:14 70_sare_uri.cf -rw-r--r-- 1 root root 18K Nov 16 18:05 71_sare_redirect_pre3.0.0.cf -rw-r--r-- 1 root root 16K Nov 16 18:06 72_sare_redirect_post3.0.0.cf -rw-r--r-- 1 root root 14K Apr 28 2004 antidrug.cf -rw-r--r-- 1 root root 935 Sep 22 2004 init.pre -rw-r--r-- 1 root root 331 Mar 29 08:35 local.cf On Apr 1, 2005 9:08 AM, Martin Hepworth wrote: > Devon > > what version of SA, any RBL's an dany extra rules defined for SA? > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Devon Harding wrote: > > My Spamassassin keeps timing out (SpamAssassin Timeout = 240) and > > keeps delivering the SPAM message. Is there anyway I can have these > > messages requeued until SA is available? > > > > My Specs are AMD K62/400, 128MB RAM. I have only 1 child process > > running cause of the limited RAM. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 1 15:51:08 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:13 2006 Subject: SA Timeouts & requeue Message-ID: Devon take out 71_sare_redirect_pre3.0.0.cf this is for pre 3.0 SA versions.. what have you got in spam.assassin.prefs.conf? esp anything to do with RBL's and/or URI-RBL's. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Devon Harding wrote: > Using SA 3.0.2 > > In MailScanner: > Spam List = dslb.org ORDB-RBL SBL+XBL spamhaus.org spamhaus-XBL > spamcop.net NJABL CBL RSL DSBL SORBS-SPAM SURBL > > in /etc/mail/spamassassin/: > -rw-r--r-- 1 root root 3.9K Apr 24 2004 70_sare_bayes_poison_nxm.cf > -rw-r--r-- 1 root root 24K Mar 19 10:16 70_sare_evilnum0.cf > -rw-r--r-- 1 root root 1.6K Mar 13 12:43 70_sare_evilnum1.cf > -rw-r--r-- 1 root root 6.9K Mar 13 12:43 70_sare_evilnum2.cf > -rw-r--r-- 1 root root 37K Mar 14 23:08 70_sare_html0.cf > -rw-r--r-- 1 root root 44K Mar 14 23:08 70_sare_html1.cf > -rw-r--r-- 1 root root 8.0K Mar 14 23:08 70_sare_html2.cf > -rw-r--r-- 1 root root 19K Mar 14 23:08 70_sare_html3.cf > -rw-r--r-- 1 root root 22K Mar 14 23:08 70_sare_html4.cf > -rw-r--r-- 1 root root 2.8K Mar 14 23:08 70_sare_html_eng.cf > -rw-r--r-- 1 root root 49K Mar 14 23:14 70_sare_uri.cf > -rw-r--r-- 1 root root 18K Nov 16 18:05 71_sare_redirect_pre3.0.0.cf > -rw-r--r-- 1 root root 16K Nov 16 18:06 72_sare_redirect_post3.0.0.cf > -rw-r--r-- 1 root root 14K Apr 28 2004 antidrug.cf > -rw-r--r-- 1 root root 935 Sep 22 2004 init.pre > -rw-r--r-- 1 root root 331 Mar 29 08:35 local.cf > > On Apr 1, 2005 9:08 AM, Martin Hepworth wrote: > >>Devon >> >>what version of SA, any RBL's an dany extra rules defined for SA? >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Devon Harding wrote: >> >>>My Spamassassin keeps timing out (SpamAssassin Timeout = 240) and >>>keeps delivering the SPAM message. Is there anyway I can have these >>>messages requeued until SA is available? >>> >>>My Specs are AMD K62/400, 128MB RAM. I have only 1 child process >>>running cause of the limited RAM. >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Fri Apr 1 15:59:24 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:29:13 2006 Subject: SA Timeouts & requeue Message-ID: Hi! > In MailScanner: > Spam List = dslb.org ORDB-RBL SBL+XBL spamhaus.org spamhaus-XBL > spamcop.net NJABL CBL RSL DSBL SORBS-SPAM SURBL > > in /etc/mail/spamassassin/: > -rw-r--r-- 1 root root 3.9K Apr 24 2004 70_sare_bayes_poison_nxm.cf Its much better to move your RBL checks towards SA. Then you can also use SURBL. Bye, Raymond ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Fri Apr 1 16:07:09 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out Message-ID: How did you install SpamAssassin? rpm or tarball? Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Craig White Sent: Friday, April 01, 2005 9:00 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: errors that I can't figure out # rpm -q mailscanner mailscanner-4.40.7-1 RHEL ES 3 # spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint ...snip... debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf config: SpamAssassin failed to parse line, skipping: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 debug: using "/root/.spamassassin" for user state dir debug: bayes: no dbs present, cannot tie DB R/O: /root/.spamassassin/bayes_toks debug: no method found for eval test check_uridnsbl ...snip... Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: (Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line 2312. ) ...snip... lint: 2 issues detected. please rerun with debug enabled for more information. How do I fix this? Craig ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 1 16:10:09 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out Message-ID: have you got the URI-RBL plugin installed in init.pre? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Craig White wrote: > # rpm -q mailscanner > mailscanner-4.40.7-1 > > RHEL ES 3 > > # spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint > > ...snip... > debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf > config: SpamAssassin failed to parse line, skipping: urirhssub > URIBL_JP_SURBL multi.surbl.org. A 64 > debug: using "/root/.spamassassin" for user state dir > debug: bayes: no dbs present, cannot tie DB > R/O: /root/.spamassassin/bayes_toks > debug: no method found for eval test check_uridnsbl > > ...snip... > > Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: > (Can't locate object method "check_uridnsbl" via package > "Mail::SpamAssassin::PerMsgStatus" > at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm > line 2312. > ) > ...snip... > > lint: 2 issues detected. please rerun with debug enabled for more > information. > > How do I fix this? > > Craig > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Fri Apr 1 16:17:55 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out Message-ID: I know in the past, it has been recommended to install SA from the tarball rather than the rpm. You might try removing the rpm and install from the tarball. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Craig White Sent: Friday, April 01, 2005 9:12 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: errors that I can't figure out # rpm -q spamassassin spamassassin-3.0.2-1.1.el3.rf sorry, I should have included it Craig On Fri, 2005-04-01 at 09:07 -0600, Mike Kercher wrote: > How did you install SpamAssassin? rpm or tarball? > > Mike > > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Craig White > Sent: Friday, April 01, 2005 9:00 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: errors that I can't figure out > > # rpm -q mailscanner > mailscanner-4.40.7-1 > > RHEL ES 3 > > # spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint > > ...snip... > debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf > config: SpamAssassin failed to parse line, skipping: urirhssub > URIBL_JP_SURBL multi.surbl.org. A 64 > debug: using "/root/.spamassassin" for user state dir > debug: bayes: no dbs present, cannot tie DB > R/O: /root/.spamassassin/bayes_toks > debug: no method found for eval test check_uridnsbl > > ...snip... > > Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: > (Can't locate object method "check_uridnsbl" via package > "Mail::SpamAssassin::PerMsgStatus" > at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm > line 2312. > ) > ...snip... > > lint: 2 issues detected. please rerun with debug enabled for more > information. > > How do I fix this? > > Craig > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 1 16:30:09 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out Message-ID: Craig the init.pre contains lists of plugins etc hat should loaded. in my case it's in /etc/mail/spamassassin and contains.. # This is the right place to customize your installation of #SpamAssassin. # # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be # tweaked. # # This file will be loaded before *all other* configuration files, #including # the system configuration. As such, it's a good place to set things # that # will affect how those files are parsed, like which plugins are loaded # etc. # ########################################################################### # RelayCountry - add metadata for Bayes learning, marking the countries # a message was relayed through # # loadplugin Mail::SpamAssassin::Plugin::RelayCountry # URIDNSBL - look up URLs found in the message against several DNS # blocklists. # loadplugin Mail::SpamAssassin::Plugin::URIDNSBL # Hashcash - perform hashcash verification. # loadplugin Mail::SpamAssassin::Plugin::Hashcash # SPF - perform SPF verification. # loadplugin Mail::SpamAssassin::Plugin::SPF As for the bayes DB issue, make sure your spam.assassin.prefs.conf has it set to the correct directory with.. bayes_path /usr/local/var/spamassassin/bayes or wherever it should be..if this is a fresh install you'll need to populate the DB with sa-learn and use 200 of spam and 200 of ham to train it. Either that or download examples from www.fsl.com/support -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Craig White wrote: > I don't even know what init.pre is > > I'm less concerned bout the URIBL_JP_SURBL issue than I am about having > a functional bayes system. > > If you can direct me to something that explains init.pre, I will check > it out. > > Craig > > On Fri, 2005-04-01 at 16:10 +0100, Martin Hepworth wrote: > >>have you got the URI-RBL plugin installed in init.pre? >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Craig White wrote: >> >>># rpm -q mailscanner >>>mailscanner-4.40.7-1 >>> >>>RHEL ES 3 >>> >>># spamassassin -D -p /etc/MailScanner/spam.assassin.prefs.conf --lint >>> >>>...snip... >>>debug: config: read file /etc/MailScanner/spam.assassin.prefs.conf >>>config: SpamAssassin failed to parse line, skipping: urirhssub >>>URIBL_JP_SURBL multi.surbl.org. A 64 >>>debug: using "/root/.spamassassin" for user state dir >>>debug: bayes: no dbs present, cannot tie DB >>>R/O: /root/.spamassassin/bayes_toks >>>debug: no method found for eval test check_uridnsbl >>> >>>...snip... >>> >>>Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: >>> (Can't locate object method "check_uridnsbl" via package >>>"Mail::SpamAssassin::PerMsgStatus" >>>at /usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin/PerMsgStatus.pm >>>line 2312. >>>) >>>...snip... >>> >>>lint: 2 issues detected. please rerun with debug enabled for more >>>information. >>> >>>How do I fix this? >>> >>>Craig >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bob.jones at USG.EDU Fri Apr 1 17:08:13 2005 From: bob.jones at USG.EDU (Bob Jones) Date: Thu Jan 12 21:29:13 2006 Subject: Spam Check rule file issues and checking order. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Okay, I'm back with more issues. MailScanner 4.39.6, Solaris 9, Sendmail 8.12.11, SpamAssassin 3.0.2. So, after the previous discussion about what determined when a ruleset would hit to kickoff spam checks, we're still having problem. In the previous thread Julian states: There is a workaround. Currently, when faced with a message with multiple headers, some of which want spam checks and some of which don't, it uses the answer for the first recipient. You can change this so that it uses any of the recipients by editing /usr/lib/MailScanner/MailScanner/ConfigDefs.pl. Look for the line starting "SpamChecks". If you look backwards (towards the start of the file) from there, you will see that it is in the [First,YesNo] section. Move that line into the [All,YesNo] section, then stop and restart MailScanner. We go on to discover that the order depends on the envelope headers, not the To: header. So, with the SpamChecks line in ConfigDefs.pl in the [First,YesNo] section it still doesn't appear to work as described. Here is what is in our rule file for the Spam Check option: From: 168.24.85. no From: 168.24.129. no From: 127.0.0.1 no To: ourdesk@usg.edu no To: abuse@usg.edu no To: /nic-(tech|billing|admin)@usg.edu/ no FromOrTo: default yes So, we telnet to port 25 on the mailserver and manually enter the mail from and rcpt to lines. One time with ourdesk@usg.edu entered first, and one time with glenn.leavell@usg.edu entered first. Here are the resulting q* files sendmail generated: ourdesk then glenn.leavell: V6 T1112370112 K0 N0 P60076 Fs $_66-23-211-254.clients.speedfactory.net [66.23.211.254] $rSMTP $s1pof.org ${daemon_flags} ${if_addr}168.24.195.10 Sglenn@leavell.com rRFC822; ourdesk@usg.edu RPFD:ourdesk@usg.edu rRFC822; glenn.leavell@usg.edu RPFD:glenn.leavell@usg.edu H?P?Return-Path: <<81>g> H??Received: from 1pof.org (66-23-211-254.clients.speedfactory.net [66.23.211.254]) by hermes.bor.usg.edu (8.12.11/8.12.11) with SMTP id j31FZrk4021592; Fri, 1 Apr 2005 10:41:52 -0500 (EST) H?D?Date: Fri, 1 Apr 2005 10:41:52 -0500 (EST) H?F?From: glenn@leavell.com H?M?Message-Id: <200504011541.j31FZrk4021592@hermes.bor.usg.edu> H??Subject: mailscanner down: our then glenn glenn.leavell then ourdesk: V6 T1112369969 K0 N0 P60076 Fs $_66-23-211-254.clients.speedfactory.net [66.23.211.254] $rSMTP $s1pof.org ${daemon_flags} ${if_addr}168.24.195.10 Sglenn@leavell.com rRFC822; glenn.leavell@usg.edu RPFD:glenn.leavell@usg.edu rRFC822; ourdesk@usg.edu RPFD:ourdesk@usg.edu H?P?Return-Path: <<81>g> H??Received: from 1pof.org (66-23-211-254.clients.speedfactory.net [66.23.211.254]) by hermes.bor.usg.edu (8.12.11/8.12.11) with SMTP id j31FZrk2021592; Fri, 1 Apr 2005 10:39:29 -0500 (EST) H?D?Date: Fri, 1 Apr 2005 10:39:29 -0500 (EST) H?F?From: glenn@leavell.com H?M?Message-Id: <200504011539.j31FZrk2021592@hermes.bor.usg.edu> H??Subject: mailscanner down: glenn then our So, if what I undestand Julian to have said to be true, the first message should not be scanned as the first match is with ourdesk which matches a rule to not scan and the second one should be scanned as the first match is with the default rule. However, in both instances the message is not scanned. Now for an even weirder (in my mind at least) issue. So, we move the SpamChecks line in ConfigDefs.pl to the [All,YesNo] section. If we send a message originating from IP address 168.24.85.103 (which is in the rules file to not be scanned) to ourdesk@usg.edu (which is also in the rules file to not be scanned), the message is scanned. If only one of those 2 criteria is used, the message is not scanned (correct result), but with both criteria the message *is* scanned. Any idea what is going on with that? Let me know if you need/want some more details. Thanks, Bob ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 1 17:27:50 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Spam Check rule file issues and checking order. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugh. Have you seen the config option in the "Advanced" section of MailScanner.conf the contains this: # When trying to work out the value of configuration parameters which are # using a ruleset, this controls the behaviour when a rule is checking the # "To:" addresses. # If this option is set to "yes", then the following happens when checking # the ruleset: # a) 1 recipient. Same behaviour as normal. # b) Several recipients, but all in the same domain (domain.com for example). # The rules are checked for one that matches the string "*@domain.com". # c) Several recipients, not all in the same domain. # The rules are checked for one that matches the string "*@*". # # If this option is set to "no", then some rules will use the result they # get from the first matching rule for any of the recipients of a message, # so the exact value cannot be predicted for messages with more than 1 # recipient. # # This value *cannot* be the filename of a ruleset. Use Default Rules With Multiple Recipients = no Bob Jones wrote: > Okay, I'm back with more issues. MailScanner 4.39.6, Solaris 9, > Sendmail 8.12.11, SpamAssassin 3.0.2. So, after the previous discussion > about what determined when a ruleset would hit to kickoff spam checks, > we're still having problem. > > In the previous thread Julian states: > > There is a workaround. Currently, when faced with a message with > multiple headers, some of which want spam checks and some of which > don't, it uses the answer for the first recipient. You can change this > so that it uses any of the recipients by editing > /usr/lib/MailScanner/MailScanner/ConfigDefs.pl. Look for the line > starting "SpamChecks". If you look backwards (towards the start of the > file) from there, you will see that it is in the [First,YesNo] section. > Move that line into the [All,YesNo] section, then stop and restart > MailScanner. > > We go on to discover that the order depends on the envelope headers, not > the To: header. So, with the SpamChecks line in ConfigDefs.pl in the > [First,YesNo] section it still doesn't appear to work as described. > Here is what is in our rule file for the Spam Check option: > > From: 168.24.85. no > From: 168.24.129. no > From: 127.0.0.1 no > To: ourdesk@usg.edu no > To: abuse@usg.edu no > To: /nic-(tech|billing|admin)@usg.edu/ no > FromOrTo: default yes > > So, we telnet to port 25 on the mailserver and manually enter the mail > from and rcpt to lines. One time with ourdesk@usg.edu entered first, > and one time with glenn.leavell@usg.edu entered first. Here are the > resulting q* files sendmail generated: > > ourdesk then glenn.leavell: > > V6 > T1112370112 > K0 > N0 > P60076 > Fs > $_66-23-211-254.clients.speedfactory.net [66.23.211.254] > $rSMTP > $s1pof.org > ${daemon_flags} > ${if_addr}168.24.195.10 > Sglenn@leavell.com > rRFC822; ourdesk@usg.edu > RPFD:ourdesk@usg.edu > rRFC822; glenn.leavell@usg.edu > RPFD:glenn.leavell@usg.edu > H?P?Return-Path: <<81>g> > H??Received: from 1pof.org (66-23-211-254.clients.speedfactory.net > [66.23.211.254]) > by hermes.bor.usg.edu (8.12.11/8.12.11) with SMTP id > j31FZrk4021592; > Fri, 1 Apr 2005 10:41:52 -0500 (EST) > H?D?Date: Fri, 1 Apr 2005 10:41:52 -0500 (EST) > H?F?From: glenn@leavell.com > H?M?Message-Id: <200504011541.j31FZrk4021592@hermes.bor.usg.edu> > H??Subject: mailscanner down: our then glenn > > > glenn.leavell then ourdesk: > > V6 > T1112369969 > K0 > N0 > P60076 > Fs > $_66-23-211-254.clients.speedfactory.net [66.23.211.254] > $rSMTP > $s1pof.org > ${daemon_flags} > ${if_addr}168.24.195.10 > Sglenn@leavell.com > rRFC822; glenn.leavell@usg.edu > RPFD:glenn.leavell@usg.edu > rRFC822; ourdesk@usg.edu > RPFD:ourdesk@usg.edu > H?P?Return-Path: <<81>g> > H??Received: from 1pof.org (66-23-211-254.clients.speedfactory.net > [66.23.211.254]) > by hermes.bor.usg.edu (8.12.11/8.12.11) with SMTP id > j31FZrk2021592; > Fri, 1 Apr 2005 10:39:29 -0500 (EST) > H?D?Date: Fri, 1 Apr 2005 10:39:29 -0500 (EST) > H?F?From: glenn@leavell.com > H?M?Message-Id: <200504011539.j31FZrk2021592@hermes.bor.usg.edu> > H??Subject: mailscanner down: glenn then our > > So, if what I undestand Julian to have said to be true, the first > message should not be scanned as the first match is with ourdesk which > matches a rule to not scan and the second one should be scanned as the > first match is with the default rule. However, in both instances the > message is not scanned. > > Now for an even weirder (in my mind at least) issue. So, we move the > SpamChecks line in ConfigDefs.pl to the [All,YesNo] section. If we send > a message originating from IP address 168.24.85.103 (which is in the > rules file to not be scanned) to ourdesk@usg.edu (which is also in the > rules file to not be scanned), the message is scanned. If only one of > those 2 criteria is used, the message is not scanned (correct result), > but with both criteria the message *is* scanned. Any idea what is going > on with that? > > Let me know if you need/want some more details. > > Thanks, > Bob > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 1 17:31:14 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Spam Check rule file issues and checking order. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Bob Jones wrote: > Now for an even weirder (in my mind at least) issue. So, we move the > SpamChecks line in ConfigDefs.pl to the [All,YesNo] section. If we send > a message originating from IP address 168.24.85.103 (which is in the > rules file to not be scanned) to ourdesk@usg.edu (which is also in the > rules file to not be scanned), the message is scanned. If only one of > those 2 criteria is used, the message is not scanned (correct result), > but with both criteria the message *is* scanned. Any idea what is going > on with that? That's a bug. I just fixed it. In MessageBatch.pm there is a chunk of code like this: sub SpamChecks { my $this = shift; my($id, $message); my $counter = 0; #print STDERR "Starting spam checks\n"; MailScanner::Log::InfoLog("Spam Checks: Starting") if MailScanner::Config::Value('logspam'); while(($id, $message) = each %{$this->{messages}}) { next if $message->{deleted}; next unless MailScanner::Config::Value('spamchecks', $message) =~ /1/; Note the change to the last line. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Fri Apr 1 17:30:50 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:13 2006 Subject: Newlines (\n) in subjects Message-ID: At 06:47 AM 4/1/2005, you wrote: >Stijn Jonker wrote on 31-3-2005 21:18: > >>First of all: I know this has been discussed recently but I can't find >>it in the jiscmail archives. >> >>It seems that MailScanner is inserting a \n in subject lines somewhere >>around char 80, I tried to dig the source on how to disable this, but >>unfortunaly I couldn't find it. > >Are you sure MS is doing this? I know some MTA's (MS comes to mind) are >doing that (incorrectly). I'm running an older version, 4.24 I believe, due to old hardware and OS, on RedHat-based 7.2, but not RedHat OS. Mine gives wicked, evil results the same, but appears to be Euro-spammers, and port scanners as well as Asia, South American and suspected US spammers. Believe me I know I would hear IT if someone thought I was dropping legitimate mail! Apr 1 10:16:20 mx sendmail[29566]: j31FGHH29566: POSSIBLE ATTACK from [203.232.53.145]: newline in string "leo^M " Apr 1 10:26:15 mx sendmail[30728]: j31FQEH30728: POSSIBLE ATTACK from [221.153.126.83]: newline in string "golom^M " Cheers! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 1 17:40:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Dropping Panda support Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Due to all sorts of nasty problems with this scanner, I am considering dropping support for it altogether and removing it from MailScanner. Are any of you actually using this product? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 1 18:45:04 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Craig White wrote: >On Fri, 2005-04-01 at 16:30 +0100, Martin Hepworth wrote: > > >>Craig >> >>the init.pre contains lists of plugins etc hat should loaded. >> >>in my case it's in /etc/mail/spamassassin and contains.. >> >># This is the right place to customize your installation of #SpamAssassin. >># >># See 'perldoc Mail::SpamAssassin::Conf' for details of what can be >># tweaked. >># >># This file will be loaded before *all other* configuration files, >>#including >># the system configuration. As such, it's a good place to set things # that >># will affect how those files are parsed, like which plugins are loaded >># etc. >># >>########################################################################### >> >># RelayCountry - add metadata for Bayes learning, marking the countries >># a message was relayed through >># >># loadplugin Mail::SpamAssassin::Plugin::RelayCountry >> >># URIDNSBL - look up URLs found in the message against several DNS >># blocklists. >># >>loadplugin Mail::SpamAssassin::Plugin::URIDNSBL >> >># Hashcash - perform hashcash verification. >># >>loadplugin Mail::SpamAssassin::Plugin::Hashcash >> >># SPF - perform SPF verification. >># >>loadplugin Mail::SpamAssassin::Plugin::SPF >> >> >> >>As for the bayes DB issue, make sure your spam.assassin.prefs.conf has >>it set to the correct directory with.. >> >>bayes_path /usr/local/var/spamassassin/bayes >> >>or wherever it should be..if this is a fresh install you'll need to >>populate the DB with sa-learn and use 200 of spam and 200 of ham to >>train it. Either that or download examples from www.fsl.com/support >> >> >----- >YEP - but for the archives in case anyone follows my ignorant tracks... > >RHEL 3 - I upgraded to Dag's version of spamassassin... > >apt-get install spamassassin-tools #installs things like > # perl-Statistics-Distributions > # perl-Parse-Syslog > >which fixed the issues with the URINDSBL and spamassassin plugins > >then I created /etc/MailScanner/bayes > >downloaded fsl.com starter file for bayes... > >wget http://www.fsl.com/support/bayes-Linux-SA-3.0-starter-db.tar.gz > >untarred it in /etc/MailScanner/bayes > >restarted MailScanner and I was good to go > >Thanks for the fish and what appears to be a great tool that I don't >really fully comprehend. > >Do I really want to use SPF ? I wasn't much interested in it before. > > In my view, SPF doesn't do any harm. People like us who can't implement it don't cause any harm, but it may help occasionally for sites that can and do implement it. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From doc at MADDOC.NET Fri Apr 1 19:40:40 2005 From: doc at MADDOC.NET (Doc Schneider) Date: Thu Jan 12 21:29:13 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I did a search on the list archives but never did see anything on using the new MySQL features for Bayes with MailScanner. Mine appears to be working. At least it is scoring like it is working. Just wondering if anyone else is using it? -Doc ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Apr 1 21:35:47 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:13 2006 Subject: Postfix 2.2 and hashed mail queues Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just tried this out with hash queue depth of 1 (with Postfix 2.1) > and 0 (with Postfix 2.2) and it appears to work okay. > > But please test it some more! > I aim to release tomorrow or Saturday. OK I have the two new files installed and all seems to be well. I'll keep and eye on things but this would seem to have solved the issue. Thanks, once again you excel yourself. Under 24 hours for something that wasn't going to happen before April's release :-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From TristanRhodes at WEBER.EDU Fri Apr 1 21:51:47 2005 From: TristanRhodes at WEBER.EDU (Tristan RHODES) Date: Thu Jan 12 21:29:13 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: I am trying to install Mailscanner on Ubuntu Linux. Has anyone done this? (Or installed on debian-unstable?) Ubuntu comes with Postfix installed, and that is the MTA I want to use. I used apt-get to install mailscanner, but it looks to be configured for Exim (debian's default MTA). I have read the Postfix install guide: http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml Are there any additional steps I need to do? BTW, I have successfully installed and used Mailscanner + Postfix on Suse using the RPM. Tristan Rhodes ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Apr 1 22:05:21 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:13 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tristan RHODES wrote: >I am trying to install Mailscanner on Ubuntu Linux. Has anyone done >this? (Or installed on debian-unstable?) > >Ubuntu comes with Postfix installed, and that is the MTA I want to >use. > >I used apt-get to install mailscanner, but it looks to be configured >for Exim (debian's default MTA). > >I have read the Postfix install guide: >http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml > >Are there any additional steps I need to do? > >BTW, I have successfully installed and used Mailscanner + Postfix on >Suse using the RPM. > > Put simply, no. Just adjust the MailScanner.conf file for Postfix using the directions you have found (Check to see which version of Postfix you have installed, if it's 2.2.x then you will need some new files to accommodate the slight change in queue structure (Post back and I'll point you in the right direction)). I don't know how old the MailScanner version is in the unstable tree, so it would be worth check that also. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From SJCJonker at SJC.NL Fri Apr 1 22:12:10 2005 From: SJCJonker at SJC.NL (Stijn Jonker) Date: Thu Jan 12 21:29:13 2006 Subject: Newlines (\n) in subjects Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello Peter & Others, Peter Peters said the following on 01-Apr-2005 13:47: > Stijn Jonker wrote on 31-3-2005 21:18: > >> First of all: I know this has been discussed recently but I can't find >> it in the jiscmail archives. Hmm, I must be wrong on this then.. >> It seems that MailScanner is inserting a \n in subject lines somewhere >> around char 80, I tried to dig the source on how to disable this, but >> unfortunaly I couldn't find it. > > Are you sure MS is doing this? I know some MTA's (MS comes to mind) are > doing that (incorrectly). It seems that it's Thunderbird itself, I though I checked and double checked it, I now took out the good old tcpdump and the initial submission is already "newlined" Sorry for the waste of time and bandwidth... ;-) On to bugzilla.mozilla... Stijn -- Met Vriendelijke groet/Yours Sincerely Stijn Jonker ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From TristanRhodes at WEBER.EDU Fri Apr 1 22:16:34 2005 From: TristanRhodes at WEBER.EDU (Tristan RHODES) Date: Thu Jan 12 21:29:13 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: Drew, Thanks for the quick reply. Your email arrived at the same time as my post! Ubuntu 5.04 (Hoary Hedgehog) currently uses Postfix 2.1.5. From what you said, this will not require the new files. I will follow the intructions in the Postfix guide and post my experience to the list. BTW, I am giving a presentation tomorrow (Saturday) to my Linux user group on setting up an email server with Mailscanner. I appreciate any help that can be provided before then. :) Tristan Rhodes >>> drew@THEMARSHALLS.CO.UK 04/01/05 2:05 PM >>> Tristan RHODES wrote: >I am trying to install Mailscanner on Ubuntu Linux. Has anyone done >this? (Or installed on debian-unstable?) > >Ubuntu comes with Postfix installed, and that is the MTA I want to >use. > >I used apt-get to install mailscanner, but it looks to be configured >for Exim (debian's default MTA). > >I have read the Postfix install guide: >http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml > >Are there any additional steps I need to do? > >BTW, I have successfully installed and used Mailscanner + Postfix on >Suse using the RPM. > > Put simply, no. Just adjust the MailScanner.conf file for Postfix using the directions you have found (Check to see which version of Postfix you have installed, if it's 2.2.x then you will need some new files to accommodate the slight change in queue structure (Post back and I'll point you in the right direction)). I don't know how old the MailScanner version is in the unstable tree, so it would be worth check that also. Drew ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Fri Apr 1 23:41:10 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:29:13 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] IS this slower than using berkley DB ? I assume performance is the most important factor of using idffference DBs? Doc Schneider wrote: > I did a search on the list archives but never did see anything on using > the new MySQL features for Bayes with MailScanner. > > Mine appears to be working. At least it is scoring like it is working. > > Just wondering if anyone else is using it? > > -Doc > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Sat Apr 2 01:38:59 2005 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Craig White wrote: > Do I really want to use SPF ? I wasn't much interested in it before. > > > I hope you decide to publish an SPF record for your domain. Then if spammers send junk to me using your address, my mailserver will know it is forged spam and will delete it. Mark Nienberg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From doc at MADDOC.NET Sat Apr 2 03:58:03 2005 From: doc at MADDOC.NET (Doc Schneider) Date: Thu Jan 12 21:29:13 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Pete Russell wrote: > IS this slower than using berkley DB ? Actually with SA 3.0.2 using MySQL has fewer problems, according to the dev list for it. It seems to rock along too. No sure if on a really busy system it would be faster but I'm sure it would be close to as fast if not faster the BDB. YMMV of course. -Doc > I assume performance is the most important factor of using idffference DBs? > > Doc Schneider wrote: > >> I did a search on the list archives but never did see anything on using >> the new MySQL features for Bayes with MailScanner. >> >> Mine appears to be working. At least it is scoring like it is working. >> >> Just wondering if anyone else is using it? >> >> -Doc ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sub at ICCONSULTING.COM.AU Sat Apr 2 06:47:41 2005 From: sub at ICCONSULTING.COM.AU (Scott Farrell) Date: Thu Jan 12 21:29:13 2006 Subject: anyone trap outgoing attachment and convert them, like word/excel to pdf? Message-ID: attention mailscanner guru's (julian et al) I am looking at working on some functionality to make sure staff dont send word/excel docs out of the company, and send them out in a more read only form. (OK I know PDF isnt strictly read-only, but its close). I figured hacking mail scanner might be smart, instead of trying to fix/train every user in the organisation. We have tools to convert word/excel to pdf reasonably reliably, but any idea if anyone has dont this, or anything similar, or where I might make a entry point into the code base? regards Scott Farrell Phone: 02-9411 3622 Mobile: 0412 927 156 http://www.icconsulting.com.au ic Consulting - helping you with innovation. We offer e-business consulting and perform services. We deliver high impact consulting, and fast turn around projects for our clients. Ask us about Web Content Management, Web Self Service, or working closer with your customers or suppliers. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sub at ICCONSULTING.COM.AU Sat Apr 2 07:10:19 2005 From: sub at ICCONSULTING.COM.AU (Scott Farrell) Date: Thu Jan 12 21:29:13 2006 Subject: Just reading man sa-learn - you are not supposed to learn spam/ham from this mail list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is from man sa-learn (see below) I have subscribed to this list (and spamassassin list) using sub@icconsulting.com.au I guess I can spam whitelist with a rule, but that might further re-inforce learning. Can I tell it to bypass learning? or do I have to do something smtp/domain specific, like subscribe an address in a domain that is not scanned at all. EFFECTIVE TRAINING Note that if your mail folders contain things like for¡ warded spam, discussions of spam-catching rules, etc., this will cause trouble. You should avoid scanning those messages if possible. (An easy way to do this is to move them aside, into a folder which is not scanned.) Scott sfarrell@icconsulting.com.au ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 2 11:20:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Postfix 2.2 and hashed mail queues Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > Julian Field wrote: > >> I have just tried this out with hash queue depth of 1 (with Postfix 2.1) >> and 0 (with Postfix 2.2) and it appears to work okay. >> >> But please test it some more! >> I aim to release tomorrow or Saturday. > > > OK I have the two new files installed and all seems to be well. I'll > keep and eye on things but this would seem to have solved the issue. > > Thanks, once again you excel yourself. Under 24 hours for something that > wasn't going to happen before April's release :-) > It turned out to be easier than I suspected, I wrote the initial code better than I thought. Feel free to show your appreciation on my Amazon.co.uk wish list :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 2 11:22:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Craig White wrote: >On Fri, 2005-04-01 at 22:05 +0100, Drew Marshall wrote: > > >>Put simply, no. Just adjust the MailScanner.conf file for Postfix using >>the directions you have found (Check to see which version of Postfix you >>have installed, if it's 2.2.x then you will need some new files to >>accommodate the slight change in queue structure (Post back and I'll >>point you in the right direction)). I don't know how old the MailScanner >>version is in the unstable tree, so it would be worth check that also. >> >> >---- >I'd be interested in pointers for Postfix 2.2.x as that is what I am >doing. > ># rpm -q mailscanner postfix >mailscanner-4.40.7-1 >postfix-2.2.1-1.rhel3 > >I think this is working... > ># tail -n 3 /etc/postfix/main.cf >hash_queue_names = incoming,hold,defer,deferred > >hash_queue_depth = 2 > >If I am missing something, please let me know > > You don't need the main.cf tweak, just install the April 1st release of MailScanner. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 2 11:26:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: anyone trap outgoing attachment and convert them, like word/excel to pdf? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You just need to use a ruleset to decide which of 2 filename.rules.conf and filetype.rules.conf files. Set up 1 file that starts by saying it bans doc and xls. Then use a ruleset to decide between the new file (followed by the old one) and the old one. Search for filename.rules.conf in the list archive, this has been discussed (with step by step guides) several times before. You don't need to "hack" anything, MailScanner already does it all. Scott Farrell wrote: > > attention mailscanner guru's (julian et al) > > I am looking at working on some functionality to make sure staff dont > send word/excel docs out of the company, and send them out in a more > read only form. (OK I know PDF isnt strictly read-only, but its close). > > I figured hacking mail scanner might be smart, instead of trying to > fix/train every user in the organisation. > > We have tools to convert word/excel to pdf reasonably reliably, but > any idea if anyone has dont this, or anything similar, or where I > might make a entry point into the code base? > > regards > Scott Farrell > Phone: 02-9411 3622 Mobile: 0412 927 156 > > http://www.icconsulting.com.au > ic Consulting - helping you with innovation. > We offer e-business consulting and perform services. We deliver high > impact consulting, and fast turn around projects for our clients. > Ask us about Web Content Management, Web Self Service, or working > closer with your customers or suppliers. ------------------------ > MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 2 11:28:49 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Just reading man sa-learn - you are not supposed to learn spam/ham from this mail list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You could use a ruleset for "Is Definitely Not Spam", and put a rule in that ruleset that says "yes" to mail from the list address and to you. Make it say "no" for the default. If you need more help on rulesets, check out the online docs and buy the book. Scott Farrell wrote: > > This is from man sa-learn (see below) > > I have subscribed to this list (and spamassassin list) using > sub@icconsulting.com.au > > I guess I can spam whitelist with a rule, but that might further > re-inforce learning. Can I tell it to bypass learning? > > or do I have to do something smtp/domain specific, like subscribe an > address in a domain that is not scanned at all. > > EFFECTIVE TRAINING > > Note that if your mail folders contain things like for¡ > warded spam, discussions of spam-catching rules, etc., > this will cause trouble. You should avoid scanning those > messages if possible. (An easy way to do this is to move > them aside, into a folder which is not scanned.) > > > > Scott > sfarrell@icconsulting.com.au > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 2 11:45:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: MAILSCANNER Announce: Version 4.40 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released stable version 4.40. The major improvements this month are * More improvements to the phishing net, including rules to avoid false alarms when seeing Microsoft .NET * Support for unpacking RAR version 3 archives * Multiple Subject: headers are removed * Multiple queues for ZMailer supported * Timeout implemented in BitDefender updating script * Loads of other improvements, see the Change Log below Download it as usual from www.mailscanner.info The Change Log is: * New Features and Improvements * - The "clamavmodule" scanner cannot unpack archives of RAR version 3. 2 new configuration settings allow you to unpack the latest RAR archives for testing by the "clamavmodule" scanner. It also enables the contents of the RAR archive to be checked for illegal filenames and filetypes, and also to see if they are password-protected. Unrar Command = /usr/bin/unrar Unrar Timeout = 50 - "Allow Password-protected Archives" can now be a ruleset when using the clamavmodule virus scanner. - Multiple "Subject:" lines are removed. The 1st one is kept. - If the "Unrar Command" is defined and points to an executable program, it will automatically be used by the "clamav" scanner. No -wrapper tweaking is needed to do this any more. - You can now use shell environment variables such as $HOSTNAME or ${HOSTNAME} in MailScanner.conf and its relatives. - More improvements to the phishing net. - More additions to the starter phishing.safe.sites.conf file. - Removed my spam.assassin.prefs.conf file in favour of the one from www.fsl.com, with just enough changes to produce an identical file layout to my previous versions. - Re-enabled ALL_TRUSTED rule after comments from Matt Kettler. Thanks! - Added long comment about ALL_TRUSTED rule, many thanks to Matt Kettler. - Improved screen behaviour of RPM-based init.d script. - Greatly improved RAR archive handler, thanks to Rick Cooper. - Changed IPBlock DSN to 550 and made it easily configurable. Look for "$FailCode" in the CustomConfig.pm code and the IPBlock cron job. - Changed the "Envelope-From" and "Envelope-To" headers to include your organisation's name. - Made date and time stamps consistent across whole system. - Added extra rules to the phishing net to avoid false alarms with some examples of Microsoft's .NET system. - Added Custom Functions to implement multiple input and output queues for ZMailer users. Many thanks to MailScanner-devel@pert.com.ar (Leonardo Helman and Mariano Absatz) for all their hard work implementing this. - Improved RedHat init.d script so reload is handled better for Postfix. - Changed default supplied values for "Allow xxxxx Tags" to disarm all of these tags. - Added 20 minute timeout to bitdefender's autoupdate script. Easy to set the timeout to your own value, just look at the start of the script. - Added support for non-hashed queue directories for Postfix 2.2. * Fixes * - Fixed problem with missing Attachment-Warning when encountering a virus that is both silent and non-forging. - Improved output format of Sender warning, and removed duplicate lines. - In IPBlock facility, changed MTA dsn to 451 to temporarily refuse the connections, rather than the total block it used to do. - Removed erroneous log output from SpamAssassin bayes-rebuilder. - Postfix problem fixes. - Fixed SpamAssassin Bayes database rebuild timeout problem. - Fixed Exim problem with removing multiple "Subject:" headers. - Fixed Postfix problem with removing multiple "Subject:" headers. - Fixed problems in new Unrar code when renaming files in archives. - Fixed problems in earlier betas with occasional missing attachment warnings. - Fixed directory problem in vexira-autoupdate. - Fixed problems with defunct processes when not virus scanning. - Fixed problem with filename checks not happening without virus scanning. - Fixed problem extracting RAR archives with filenames containing special characters. - Fixed problem where 2 matching "No" rules would cause message to be checked for spam, if SpamChecks is moved in ConfigDefs.pl. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Sun Apr 3 00:26:40 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:29:13 2006 Subject: MCP checks for outgoing only Message-ID: Any word on this Julian ? Thanks On Thu, 31 Mar 2005 19:07:32 +0100, Venkata Achanta wrote: >Yes! i do reliase that only the e-mail that contain the MCP material should >be forwarded to user@domain.com but the problem i am having is all the >incoming and outgoing messages are also being fw'ded to user@domain.com >instead of the e-mail that just qualifies for MCP. > >OR is it not built that way ? > >From my first e-mail, > >>Is Definitely MCP = %rules-dir%/mcp.rules > >>I have this in my %rules-dir%/mcp.rules >> >>From: @domain.com yes >>FromOrTo: default no > > >Hope this is clear enough to give you a picture of whats happening or else >pleaselet me know i will try again. > > > >On Thu, 31 Mar 2005 18:55:51 +0100, Julian Field > wrote: > >>You realise that those MCP actions will deliver the mail to the original >>recipient as well as forward it to user@domain.com. >> >>Venkata Achanta wrote: >> >>>Julian, >>> >>>I think you didnt see the MCP config in the e-mail. >>> >>>Yes ! i am aware that spam actions have nothing to do with MCP. >>> >>> >>> >>>>MCP Actions = deliver user@domain.com >>>> >>>> >>>is what i have in the MCP actions and i still the behaviour mentioned >>>earlier. >>> >>> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vanhorn at WHIDBEY.COM Sun Apr 3 03:22:44 2005 From: vanhorn at WHIDBEY.COM (G. Armour Van Horn) Date: Thu Jan 12 21:29:13 2006 Subject: Whitelists being ignored Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Greetings, I'm still having the same problem with this server ignoring my whitelists. The client forwarded five e-mails to me this afternoon, all with the {Spam?} tag in the Subject line. They were from four senders: online@tesco.co.uk sns_team@sweet-n-sour.com PCW@client17.email-bureau.co.uk miscops@misco.co.uk I went to add them to the whitelist, but I found that three of them had long been in spam.whitelist.rules, and had been for a month: From: root@richmondsounddesign.com yes From: FaxToEmail@pacificcoast.net yes From: *@knmartin.co.uk yes From: newswire@news.bc.ndp.ca yes From: online@tesco.co.uk yes From: updatemembers@SUITE101.COM yes From: ANSWER@InternationalANSWER.org yes From: PCW@client17.email-bureau.co.uk yes From: graceaudio@inter-business.com.ar yes From: SnS_team@sweet-n-sour.com yes FromOrTo: default no I'm starting to feel like an idiot here. I've double-checked the paths to my rules, including posting those here last week (normally a sure why to catch a stupid typo). I need some way to track this down, please! Van -- ---------------------------------------------------------- Sign up now for Quotes of the Day, a handful of quotations on a theme delivered every morning. Enlightenment! Daily, for free! mailto:twisted@whidbey.com?subject=Subscribe_QOTD For photography, web design, hosting, and maintenance, visit Van's home page: http://www.domainvanhorn.com/van/ ----------------------------------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Sun Apr 3 10:46:34 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: Hi! >> Do I really want to use SPF ? I wasn't much interested in it before. > In my view, SPF doesn't do any harm. People like us who can't implement > it don't cause any harm, but it may help occasionally for sites that can > and do implement it. Why cant you implement this? Just start doing authenticated SMTP for your end users. So they can also relay when out of office... Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 11:56:24 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: MCP checks for outgoing only Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Try putting in *@domain.com or just domain.com instead of @domain.com. Venkata Achanta wrote: >Any word on this Julian ? Thanks > > > >On Thu, 31 Mar 2005 19:07:32 +0100, Venkata Achanta >wrote: > > > >>Yes! i do reliase that only the e-mail that contain the MCP material should >>be forwarded to user@domain.com but the problem i am having is all the >>incoming and outgoing messages are also being fw'ded to user@domain.com >>instead of the e-mail that just qualifies for MCP. >> >>OR is it not built that way ? >> >> >> >>From my first e-mail, > > >>>Is Definitely MCP = %rules-dir%/mcp.rules >>> >>> >>>I have this in my %rules-dir%/mcp.rules >>> >>>From: @domain.com yes >>>FromOrTo: default no >>> >>> >>Hope this is clear enough to give you a picture of whats happening or else >>pleaselet me know i will try again. >> >> >> >>On Thu, 31 Mar 2005 18:55:51 +0100, Julian Field >> wrote: >> >> >> >>>You realise that those MCP actions will deliver the mail to the original >>>recipient as well as forward it to user@domain.com. >>> >>>Venkata Achanta wrote: >>> >>> >>> >>>>Julian, >>>> >>>>I think you didnt see the MCP config in the e-mail. >>>> >>>>Yes ! i am aware that spam actions have nothing to do with MCP. >>>> >>>> >>>> >>>> >>>> >>>>>MCP Actions = deliver user@domain.com >>>>> >>>>> >>>>> >>>>> >>>>is what i have in the MCP actions and i still the behaviour mentioned >>>>earlier. >>>> >>>> >>>> >>>> >>>-- >>>Julian Field >>>www.MailScanner.info >>>Buy the MailScanner book at www.MailScanner.info/store >>>Professional Support Services at www.MailScanner.biz >>>MailScanner thanks transtec Computers for their support >>> >>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 11:57:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Whitelists being ignored Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Have you checked the X-MailScanner-From: headers to find the real sender addresses? You need to provide the email envelope sender, not the contents of the From: header. G. Armour Van Horn wrote: > Greetings, > > I'm still having the same problem with this server ignoring my > whitelists. The client forwarded five e-mails to me this afternoon, all > with the {Spam?} tag in the Subject line. They were from four senders: > > online@tesco.co.uk > sns_team@sweet-n-sour.com > PCW@client17.email-bureau.co.uk > miscops@misco.co.uk > > I went to add them to the whitelist, but I found that three of them had > long been in spam.whitelist.rules, and had been for a month: > > From: root@richmondsounddesign.com yes > From: FaxToEmail@pacificcoast.net yes > From: *@knmartin.co.uk yes > From: newswire@news.bc.ndp.ca yes > From: online@tesco.co.uk yes > From: updatemembers@SUITE101.COM yes > From: ANSWER@InternationalANSWER.org yes > From: PCW@client17.email-bureau.co.uk yes > From: graceaudio@inter-business.com.ar yes > From: SnS_team@sweet-n-sour.com yes > FromOrTo: default no > > I'm starting to feel like an idiot here. I've double-checked the paths > to my rules, including posting those here last week (normally a sure why > to catch a stupid typo). I need some way to track this down, please! > > Van > > > -- > ---------------------------------------------------------- > Sign up now for Quotes of the Day, a handful of quotations > on a theme delivered every morning. > Enlightenment! Daily, for free! > mailto:twisted@whidbey.com?subject=Subscribe_QOTD > > For photography, web design, hosting, and maintenance, > visit Van's home page: http://www.domainvanhorn.com/van/ > ----------------------------------------------------------- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 11:59:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Raymond Dijkxhoorn wrote: > Hi! > >>> Do I really want to use SPF ? I wasn't much interested in it before. >> > >> In my view, SPF doesn't do any harm. People like us who can't implement >> it don't cause any harm, but it may help occasionally for sites that can >> and do implement it. > > > Why cant you implement this? Just start doing authenticated SMTP for your > end users. So they can also relay when out of office... I need to set up the SSL cert for auth SMTP, as we have rules about sending unencrypted passwords across any network. Then we have a massive user-education problem :-( Currently they use their ISP's SMTP server and getting them to change will be a real struggle. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Sun Apr 3 13:16:41 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: Hi! >> Why cant you implement this? Just start doing authenticated SMTP for your >> end users. So they can also relay when out of office... > I need to set up the SSL cert for auth SMTP, as we have rules about > sending unencrypted passwords across any network. Then we have a massive > user-education problem :-( Currently they use their ISP's SMTP server > and getting them to change will be a real struggle. I know... thats the real pain... What we do one some sites is offer VPN's so they actually are inside the campus network again. Solves a lot of trouble. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Sun Apr 3 14:24:07 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:13 2006 Subject: DCC new version, new licence... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I just noticed that DCC went from version 1.2.74 to 1.3 today. In the changelog: "New licence". This is the licence: http://www.rhyolite.com/anti-spam/dcc/dcc-tree/LICENSE The interresting part: * This agreement is not applicable to any entity which sells anti-spam * solutions to others or provides an anti-spam solution as part of a * security solution sold to other entities, or to a private network * which employes the DCC or uses data provided by operation of the DCC * but does not provide corresponding data to other users. And then it says it's free to use & distribute. So anyone selling services based on DCC would need a commercial licence. My questions: - Is that new? - What means this sentence : (from the home page) The Distributed Checksum Clearinghouse source carries a license that is free to organizations that do not sell filtering devices or services except to their own users and that participate in the global DCC network. (I.e. ISPs that use the DCC to filter mail for their own users are intended to be covered in the free license.) If someone runs a DCC server and sells services based on DCC, is it covered by the free licence? Thanks, Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 15:25:32 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Raymond Dijkxhoorn wrote: > Hi! > >>> Why cant you implement this? Just start doing authenticated SMTP for >>> your >>> end users. So they can also relay when out of office... >> > >> I need to set up the SSL cert for auth SMTP, as we have rules about >> sending unencrypted passwords across any network. Then we have a massive >> user-education problem :-( Currently they use their ISP's SMTP server >> and getting them to change will be a real struggle. > > > I know... thats the real pain... > > What we do one some sites is offer VPN's so they actually are inside the > campus network again. Solves a lot of trouble. We already offer VPNs, but many users, including all the Linux users and probably all the Mac users, don't/can't use the VPN service. Our VPNs are provided by 2 Windows boxes using PPTP VPNs. How do Mac and Linux users connect to them? Our users only other choice is SSH-tunneling which rules out most of them. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From richard.siddall at ELIRION.NET Sun Apr 3 15:43:15 2005 From: richard.siddall at ELIRION.NET (Richard Siddall) Date: Thu Jan 12 21:29:13 2006 Subject: DCC new version, new licence... Message-ID: Ugo Bellavance wrote: > Hi, > > I just noticed that DCC went from version 1.2.74 to 1.3 today. > In the > changelog: "New licence". > > This is the licence: > http://www.rhyolite.com/anti-spam/dcc/dcc-tree/LICENSE > > The interresting part: > > * This agreement is not applicable to any entity which sells anti-spam > * solutions to others or provides an anti-spam solution as part of a > * security solution sold to other entities, or to a private network > * which employes the DCC or uses data provided by operation of the DCC > * but does not provide corresponding data to other users. > > And then it says it's free to use & distribute. > > So anyone selling services based on DCC would need a commercial licence. > Ugo, See the discussion about the new license on the DCC mailing list: http://www.rhyolite.com/pipermail/dcc/2005/002570.html > My questions: > > - Is that new? > > - What means this sentence : (from the home page) The Distributed > Checksum Clearinghouse source carries a license that is free to > organizations that do not sell filtering devices or services except to > their own users and that participate in the global DCC network. (I.e. > ISPs that use the DCC to filter mail for their own users are intended to > be covered in the free license.) > Vernon Schryver was trying to prevent security appliance companies selling boxes that used DCC, but never contributed checksums to the public DCC servers, from using DCC for free. > If someone runs a DCC server and sells services based on DCC, is it > covered by the free licence? > You'd need to check with a lawyer. Regards, Richard. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kyle at MLUG.MISSOURI.EDU Sun Apr 3 15:49:22 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I know this has been brought up in the past, but was wanting to get an update on where it was in the pile. I have a Fedora 3 x86_64 build that I'm wishing to install Mailscanner on. Every time I try and install Mailscanner, it fails on the actuall Mailscanner rpm install. I have a regular non 64bit processer in another machine, which Mailscanner builds correctly on. See this e-mail string from the searchable mailing list : http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0503&L=mailscanner&P=R78667&I=-1 Just wondering if there is work and research going on the Fedora 3 64 bit platform and when something like this could get some attention ? :) Thanks Kyle ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 16:22:27 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've just tried it on RHEL4 and it works fine, so it's some Fedora 3 screwup (wouldn't be the first). What's the output of rpmbuild -bc perl-Archive-Zip.spec Kyle Krieg wrote: > I know this has been brought up in the past, but was wanting to get an > update on where it was in the pile. > > I have a Fedora 3 x86_64 build that I'm wishing to install Mailscanner > on. Every time I try and install Mailscanner, it fails on the actuall > Mailscanner rpm install. I have a regular non 64bit processer in > another machine, which Mailscanner builds correctly on. > > See this e-mail string from the searchable mailing list : > > http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0503&L=mailscanner&P=R78667&I=-1 > > > > > Just wondering if there is work and research going on the Fedora 3 64 > bit platform and when something like this could get some attention ? :) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Sun Apr 3 17:00:34 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: Hi! > We already offer VPNs, but many users, including all the Linux users and > probably all the Mac users, don't/can't use the VPN service. > > Our VPNs are provided by 2 Windows boxes using PPTP VPNs. How do Mac and > Linux users connect to them? > > Our users only other choice is SSH-tunneling which rules out most of them. We might move this thread private ;) Sinec its a luittle offtopic, but :) You could have a look at Cisco 3000 series, we use those, they dont come cheap, but do come with all flavors clients. Solaris also. Bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chris at scorpion.nl Sun Apr 3 17:19:04 2005 From: chris at scorpion.nl (Christiaan den Besten) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] OpenVPN works like a charm and support most known OS'es .... Can work over any udp or tcp port... bye, Chris ----- Original Message ----- From: "Julian Field" To: Sent: Sunday, April 03, 2005 4:25 PM Subject: Re: errors that I can't figure out - SOLVED > Raymond Dijkxhoorn wrote: > >> Hi! >> >>>> Why cant you implement this? Just start doing authenticated >>>> SMTP for >>>> your >>>> end users. So they can also relay when out of office... >>> >> >>> I need to set up the SSL cert for auth SMTP, as we have rules >>> about >>> sending unencrypted passwords across any network. Then we have a >>> massive >>> user-education problem :-( Currently they use their ISP's SMTP >>> server >>> and getting them to change will be a real struggle. >> >> >> I know... thats the real pain... >> >> What we do one some sites is offer VPN's so they actually are >> inside the >> campus network again. Solves a lot of trouble. > > We already offer VPNs, but many users, including all the Linux > users and > probably all the Mac users, don't/can't use the VPN service. > > Our VPNs are provided by 2 Windows boxes using PPTP VPNs. How do > Mac and > Linux users connect to them? > > Our users only other choice is SSH-tunneling which rules out most > of them. > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Sun Apr 3 17:20:33 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:29:13 2006 Subject: errors that I can't figure out - SOLVED Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Julian Field > Sent: Sunday, April 03, 2005 9:26 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: errors that I can't figure out - SOLVED > > > Raymond Dijkxhoorn wrote: > > > Hi! > > > >>> Why cant you implement this? Just start doing authenticated SMTP for > >>> your > >>> end users. So they can also relay when out of office... > >> > > > >> I need to set up the SSL cert for auth SMTP, as we have rules about > >> sending unencrypted passwords across any network. Then we have > a massive > >> user-education problem :-( Currently they use their ISP's SMTP server > >> and getting them to change will be a real struggle. > > > > > > I know... thats the real pain... > > > > What we do one some sites is offer VPN's so they actually are inside the > > campus network again. Solves a lot of trouble. > > We already offer VPNs, but many users, including all the Linux users and > probably all the Mac users, don't/can't use the VPN service. > > Our VPNs are provided by 2 Windows boxes using PPTP VPNs. How do Mac and > Linux users connect to them? > > Our users only other choice is SSH-tunneling which rules out most of them. > > -- Well you could use poptop on Linux boxes for the server (I do for about eight sites) Linux has the pptp client Mac Jaguar+ has a pptp client built in and there is digitunnel (commercial) for OS X 10.1 or PiePants (still free I believe) as well. The linux and Mac clients are compatable with either poptop or the windows software, and the windows clients are compatable with poptop. Rick -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kyle at MLUG.MISSOURI.EDU Sun Apr 3 18:54:26 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. Thanks for looking into this Julian. I've been using Mailscanner for 2 years now on a RH 8.0 machine with no issues. I've also show the following errors when using the install.sh script. Looks like to me, the install scripts it looking for packages in the i386x86_64 directory, which is not there. All the packages are in either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. There are two outputs below, the first from the rpmbuild -bc perl-Archive-Zip.spec and another from when I try and reinstall MailScanner from the install.sh script. I've cut out most of it and only given the errors that I think are important, but have the whole install log, if you would like it see it. Kyle ************************************************ [root@skywalker framadmn]# cd /usr/src/redhat/SPECS/ [root@skywalker SPECS]# rpmbuild -bc perl-Archive-Zip.spec Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.42431 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Archive-Zip-1.14 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Archive-Zip-1.14.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Archive-Zip-1.14 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.42431 + umask 022 + cd /usr/src/redhat/BUILD + cd Archive-Zip-1.14 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Archive-Zip-1.14-1-root/usr Checking if your kit is complete... Looks good Writing Makefile for Archive::Zip + make cp lib/Archive/Zip.pod blib/lib/Archive/Zip.pod cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm cp crc32 blib/script/crc32 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/crc32 Manifying blib/man3/Archive::Zip::Tree.3pm Manifying blib/man3/Archive::Zip.3pm Manifying blib/man3/Archive::Zip::FAQ.3pm Manifying blib/man3/Archive::Zip::MemberRead.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/test..............ok t/testex............ok t/testMemberRead....ok t/testTree..........ok t/testUpdate........ok All tests successful. Files=5, Tests=163, 3 wallclock secs ( 1.81 cusr + 0.48 csys = 2.29 CPU) + exit 0 [root@skywalker SPECS]# ******************************************************** Attempting to build and install MailScanner-perl-MIME-Base64-3.05-5 Installing MailScanner-perl-MIME-Base64-3.05-5.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.28423 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf MIME-Base64-3.05 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/MIME-Base64-3.05.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd MIME-Base64-3.05 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + chmod -R u+w /usr/src/redhat/BUILD/MIME-Base64-3.05 + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.28423 + umask 022 + cd /usr/src/redhat/BUILD + cd MIME-Base64-3.05 + LANG=C + export LANG + unset DISPLAY + grep -rsl '^#!.*perl' . + grep -v '.bak$' + xargs --no-run-if-empty /usr/bin/perl -MExtUtils::MakeMaker -e 'MY->fixin(@ARGV)' + CFLAGS='-O2 -g -pipe -m64' + /usr/bin/perl Makefile.PLPREFIX=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/util Checking if your kit is complete... Looks good Writing Makefile for MIME::Base64 + /usr/bin/make cp QuotedPrint.pm blib/lib/MIME/QuotedPrint.pm cp Base64.pm blib/lib/MIME/Base64.pm /usr/bin/perl /usr/lib/perl5/5.8.5/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.5/ExtUtils/typemap Base64.xs > Base64.xsc && mv Base64.xsc Base64.c gcc -c -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"3.05\" -DXS_VERSION=\"3.05\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" Base64.c Running Mkbootstrap for MIME::Base64 () chmod 644 Base64.bs rm -f blib/arch/auto/MIME/Base64/Base64.so gcc -shared Base64.o -o blib/arch/auto/MIME/Base64/Base64.so chmod 755 blib/arch/auto/MIME/Base64/Base64.so cp Base64.bs blib/arch/auto/MIME/Base64/Base64.bs chmod 644 blib/arch/auto/MIME/Base64/Base64.bs cp decode-qp blib/script/decode-qp /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-qp cp encode-qp blib/script/encode-qp /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-qp cp decode-base64 blib/script/decode-base64 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/decode-base64 cp encode-base64 blib/script/encode-base64 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/encode-base64 Manifying blib/man3/MIME::QuotedPrint.3pm Manifying blib/man3/MIME::Base64.3pm + exit 0 Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.56280 + umask 022 + cd /usr/src/redhat/BUILD + cd MIME-Base64-3.05 + LANG=C + export LANG + unset DISPLAY + '[' /var/tmp/MailScanner-perl-MIME-Base64-3.05-root '!=' / ']' + rm -rf /var/tmp/MailScanner-perl-MIME-Base64-3.05-root + /usr/bin/make prefix=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/ exec_prefix=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/ bindir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//bin sbindir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//sbin sysconfdir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/etc datadir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//share includedir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//include libdir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//lib64 libexecdir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//libexec localstatedir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var sharedstatedir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root//com mandir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/share/man infodir=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/share/info install DESTDIR=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/lib64/perl5/5.8.5/x86_64-linux-thread- ulti/auto/MIME/Base64/Base64.bs Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/lib64/perl5/5.8.5/x86_64-linux-thread- ulti/auto/MIME/Base64/Base64.so Files found in blib/arch: installing files in blib/lib into architecture dependent library tree Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/lib64/perl5/5.8.5/x86_64-linux-thread- ulti/MIME/Base64.pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/lib64/perl5/5.8.5/x86_64-linux-thread- ulti/MIME/QuotedPrint.pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/share/man/man3/MIME::Base64.3pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/share/man/man3/MIME::QuotedPrint.3pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/bin/decode-base64 Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/bin/decode-qp Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/bin/encode-base64 Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/bin/encode-qp Writing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/lib64/perl5/5.8.5/x86_64-linux-thread- ulti/auto/MIME/Base64/.packlist Appending installation info to/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var/tmp/MailScanner-perl-MIME-B se64-3.05-root/usr/lib/MailScanner/utils/lib64/perl5/5.8.5/x86_64-linux-thread- ulti/perllocal.pod + make install_site Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/MIME/Base64/Base64.bs Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/MIME/Base64/Base64.so Files found in blib/arch: installing files in blib/lib into architecture dependent library tree Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/site_perl/5.8.5/x86_64-linux-thread-multi/MIME/Base64.pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/site_perl/5.8.5/x86_64-linux-thread-multi/MIME/QuotedPrint.pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/share man/man3/MIME::Base64.3pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/share man/man3/MIME::QuotedPrint.3pm Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/bin/d code-base64 Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/bin/d code-qp Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/bin/e code-base64 Installing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/bin/e code-qp Writing/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/MIME/Base64/.packlist Appending installation info to/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/5.8.5/x86_64-linux-thread-multi/perllocal.pod + '[' -x /usr/lib/rpm/brp-compress ']' + /usr/lib/rpm/brp-compress + '[' -e /etc/SuSE-release -o -e /etc/UnitedLinux-release ']' + find /var/tmp/MailScanner-perl-MIME-Base64-3.05-root -name perllocal.pod -o -name .packlist -o -name '*.bs' + xargs -i rm -f '{}' + rm -rf /var/tmp/MailScanner-perl-MIME-Base64-3.05-root/var + find /var/tmp/MailScanner-perl-MIME-Base64-3.05-root/ -type d -depth -exec rmdir '{}' ';' + /usr/bin/perl -MFile::Find -le ' find({ wanted => \&wanted, no_chdir => 1}, "/var/tmp/MailScanner-perl-MIME-Base64-3.05-root"); print "%doc Changes README"; for my $x (sort @dirs, @files) { push @ret, $x unless indirs($x); } print join "\n", sort @ret; sub wanted { return if /auto$/; local $_ = $File::Find::name; my $f = $_; s|^\Q/var/tmp/MailScanner-perl-MIME-Base64-3.05-root\E||; return unless length; return $files[@files] = $_ if -f $f; $d = $_; /\Q$d\E/ && return for reverse sort @INC; $d =~ /\Q$_\E/ && return for qw|/etc //man //bin //share|; $dirs[@dirs] = $_; } sub indirs { my $x = shift; $x =~ /^\Q$_\E\// && $x ne $_ && return 1 for @dirs; } ' + '[' -z MailScanner-perl-MIME-Base64-3.05-filelist ']' + /usr/lib/rpm/find-debuginfo.sh /usr/src/redhat/BUILD/MIME-Base64-3.05 extracting debug info from/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/lib64 perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/MIME/Base64/Base64.so 47 blocks + /usr/lib/rpm/redhat/brp-compress + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-static-archive /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump Processing files: MailScanner-perl-MIME-Base64-3.05-5 Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.54956 + umask 022 + cd /usr/src/redhat/BUILD + cd MIME-Base64-3.05 +DOCDIR=/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/util /doc/MailScanner-perl-MIME-Base64-3.05 + export DOCDIR + rm -rf/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/doc/M ilScanner-perl-MIME-Base64-3.05 + /bin/mkdir -p/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/doc/M ilScanner-perl-MIME-Base64-3.05 + cp -pr Changes README/var/tmp/MailScanner-perl-MIME-Base64-3.05-root/usr/lib/MailScanner/utils/doc/M ilScanner-perl-MIME-Base64-3.05 + exit 0 Provides: Base64.so()(64bit) perl(MIME::Base64) = 3.05 perl(MIME::QuotedPrint) = 3.03 Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(VersionedDependencies) <= 3.0.3-1 Requires: /usr/bin/perl libc.so.6()(64bit) libc.so.6(GLIBC_2.2.5)(64bit) perl(DynaLoader) perl(Exporter) perl(MIME::Base64) perl(MIME::QuotedPrint) perl(strict) perl(vars) Processing files: MailScanner-perl-MIME-Base64-debuginfo-3.05-5 Provides: Base64.so.debug()(64bit) Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/MailScanner-perl-MIME-Base64-3.05-root Wrote: /usr/src/redhat/RPMS/x86_64/MailScanner-perl-MIME-Base64-3.05-5.x86_64.rpm Wrote:/usr/src/redhat/RPMS/x86_64/MailScanner-perl-MIME-Base64-debuginfo-3.05-5.x86_6 .rpm Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.54956 + umask 022 + cd /usr/src/redhat/BUILD + cd MIME-Base64-3.05 + '[' /var/tmp/MailScanner-perl-MIME-Base64-3.05-root '!=' / ']' + rm -rf /var/tmp/MailScanner-perl-MIME-Base64-3.05-root + exit 0 Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.54956 + umask 022 + cd /usr/src/redhat/BUILD + rm -rf MIME-Base64-3.05 + exit 0 Missing file/usr/src/redhat/RPMS/i386x86_64/MailScanner-perl-MIME-Base64-3.05-5.i386x86_64. pm. Maybe it did not build correctly? Attempting to build and install perl-HTML-Parser-3.45-1 Installing perl-HTML-Parser-3.45-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.30033 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf HTML-Parser-3.45 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/HTML-Parser-3.45.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd HTML-Parser-3.45 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.30033 + umask 022 + cd /usr/src/redhat/BUILD + cd HTML-Parser-3.45 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-HTML-Parser-root/usr Checking if your kit is complete... Looks good Writing Makefile for HTML::Parser + make cp lib/HTML/PullParser.pm blib/lib/HTML/PullParser.pm cp Parser.pm blib/lib/HTML/Parser.pm cp lib/HTML/Entities.pm blib/lib/HTML/Entities.pm cp lib/HTML/LinkExtor.pm blib/lib/HTML/LinkExtor.pm cp lib/HTML/TokeParser.pm blib/lib/HTML/TokeParser.pm cp lib/HTML/HeadParser.pm blib/lib/HTML/HeadParser.pm cp lib/HTML/Filter.pm blib/lib/HTML/Filter.pm /usr/bin/perl /usr/lib/perl5/5.8.5/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.5/ExtUtils/typemap -typemap typemap Parser.xs > Parser.xsc && mv Parser.xsc Parser.c /usr/bin/perl mkhctype >hctype.h /usr/bin/perl mkpfunc >pfunc.h gcc -c -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"3.45\" -DXS_VERSION=\"3.45\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" -DMARKED_SECTION Parser.c Running Mkbootstrap for HTML::Parser () chmod 644 Parser.bs rm -f blib/arch/auto/HTML/Parser/Parser.so gcc -shared Parser.o -o blib/arch/auto/HTML/Parser/Parser.so chmod 755 blib/arch/auto/HTML/Parser/Parser.so cp Parser.bs blib/arch/auto/HTML/Parser/Parser.bs chmod 644 blib/arch/auto/HTML/Parser/Parser.bs Manifying blib/man3/HTML::PullParser.3pm Manifying blib/man3/HTML::Entities.3pm Manifying blib/man3/HTML::Parser.3pm Manifying blib/man3/HTML::TokeParser.3pm Manifying blib/man3/HTML::LinkExtor.3pm Manifying blib/man3/HTML::Filter.3pm Manifying blib/man3/HTML::HeadParser.3pm + exit 0 Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.50844 + umask 022 + cd /usr/src/redhat/BUILD + cd HTML-Parser-3.45 + LANG=C + export LANG + unset DISPLAY + rm -rf /var/tmp/perl-HTML-Parser-root ++ perl -V:installarchlib + eval 'installarchlib='\''/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi'\'';' ++ installarchlib=/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi + mkdir -p /var/tmp/perl-HTML-Parser-root//usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi + make install Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/auto/HTML/Parser/Parser.bs Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/auto/HTML/Parser/Parser.so Files found in blib/arch: installing files in blib/lib into architecture dependent library tree Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/PullParser.pm Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/LinkExtor.pm Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/TokeParser.pm Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/Parser.pm Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/HeadParser.pm Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/Entities.pm Installing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/HTML/Filter.pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::TokeParser.3pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::Parser.3pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::HeadParser.3pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::Entities.3pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::LinkExtor.3pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::PullParser.3pm Installing /var/tmp/perl-HTML-Parser-root/usr/share/man/man3/HTML::Filter.3pm Writing/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/auto/HTML/Parser/.packlist Appending installation info to/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/ erllocal.pod + '[' -x /usr/lib/rpm/brp-compress ']' + /usr/lib/rpm/brp-compress + find /var/tmp/perl-HTML-Parser-root/usr -type f -print + grep -v perllocal.pod + grep -v '\.packlist' + sed 's@^/var/tmp/perl-HTML-Parser-root@@g' ++ cat HTML-Parser-3.45-filelist + '[' '/usr/share/man/man3/HTML::LinkExtor.3pm.gz /usr/share/man/man3/HTML::Entities.3pm.gz /usr/share/man/man3/HTML::PullParser.3pm.gz /usr/share/man/man3/HTML::TokeParser.3pm.gz /usr/share/man/man3/HTML::Filter.3pm.gz /usr/share/man/man3/HTML::HeadParser.3pm.gz /usr/share/man/man3/HTML::Parser.3pm.gz /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/HTML/Parser/Par er.bs /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/HTML/Parser/Par er.so /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/PullParser.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/Parser.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/HeadParser.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/Filter.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/LinkExtor.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/Entities.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/HTML/TokeParser.pmX' = X ']' + /usr/lib/rpm/find-debuginfo.sh /usr/src/redhat/BUILD/HTML-Parser-3.45 extracting debug info from/var/tmp/perl-HTML-Parser-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thr ad-multi/auto/HTML/Parser/Parser.so 161 blocks + /usr/lib/rpm/redhat/brp-compress + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-static-archive /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump Processing files: perl-HTML-Parser-3.45-1 Provides: Parser.so()(64bit) perl(HTML::Entities) = 1.29 perl(HTML::Filter) = 2.10 perl(HTML::HeadParser) = 2.21 perl(HTML::LinkExtor) = 1.33 perl(HTML::Parser) = 3.45 perl(HTML::PullParser) = 2.7 perl(HTML::TokeParser) = 2.30 Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(VersionedDependencies) <= 3.0.3-1 Requires: libc.so.6()(64bit) libc.so.6(GLIBC_2.2.5)(64bit) perl >= 0:5.004 perl(Carp) perl(DynaLoader) perl(Exporter) perl(HTML::Entities) perl(HTML::Parser) perl(HTML::PullParser) perl(HTML::Tagset) perl(strict) perl(vars) Processing files: perl-HTML-Parser-debuginfo-3.45-1 Provides: Parser.so.debug()(64bit) Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/perl-HTML-Parser-root warning: Installed (but unpackaged) file(s) found: /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/perllocal.pod /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/HTML/Parser/.pa klist Wrote: /usr/src/redhat/RPMS/x86_64/perl-HTML-Parser-3.45-1.x86_64.rpm Wrote: /usr/src/redhat/RPMS/x86_64/perl-HTML-Parser-debuginfo-3.45-1.x86_64.rpm Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.18412 + umask 022 + cd /usr/src/redhat/BUILD + cd HTML-Parser-3.45 + rm -rf /var/tmp/perl-HTML-Parser-root + exit 0 Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.18412 + umask 022 + cd /usr/src/redhat/BUILD + rm -rf HTML-Parser-3.45 + exit 0 Missing file /usr/src/redhat/RPMS/i386x86_64/perl-HTML-Parser-3.45-1.i386x86_64.rpm. Maybe it did not build correctly? Attempting to build and install perl-Archive-Zip-1.14-1 Installing perl-Archive-Zip-1.14-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.60161 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Archive-Zip-1.14 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Archive-Zip-1.14.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Archive-Zip-1.14 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.60161 + umask 022 + cd /usr/src/redhat/BUILD + cd Archive-Zip-1.14 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Archive-Zip-1.14-1-root/usr Checking if your kit is complete... Looks good Writing Makefile for Archive::Zip + make cp lib/Archive/Zip.pod blib/lib/Archive/Zip.pod cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm cp crc32 blib/script/crc32 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/crc32 Manifying blib/man3/Archive::Zip::Tree.3pm Manifying blib/man3/Archive::Zip.3pm Manifying blib/man3/Archive::Zip::FAQ.3pm Manifying blib/man3/Archive::Zip::MemberRead.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/test.............. t/test..............ok1/123 t/test..............ok2/123 t/test..............ok3/123 t/test..............ok4/123 t/test..............ok5/123 t/test..............ok6/123 t/test..............ok7/123 t/test..............ok8/123 t/test..............ok9/123 t/test..............ok10/123 t/test..............ok11/123 t/test..............ok12/123 t/test..............ok13/123 t/test..............ok14/123 t/test..............ok15/123 t/test..............ok16/123 t/test..............ok17/123 t/test..............ok18/123 t/test..............ok19/123 t/test..............ok20/123 t/test..............ok21/123 t/test..............ok22/123 t/test..............ok23/123 t/test..............ok24/123 t/test..............ok25/123 t/test..............ok26/123 t/test..............ok27/123 t/test..............ok28/123 t/test..............ok29/123 t/test..............ok30/123 t/test..............ok31/123 t/test..............ok32/123 t/test..............ok33/123 t/test..............ok34/123 t/test..............ok35/123 t/test..............ok36/123 t/test..............ok37/123 t/test..............ok38/123 t/test..............ok39/123 t/test..............ok40/123 t/test..............ok41/123 t/test..............ok42/123 t/test..............ok43/123 t/test..............ok44/123 t/test..............ok45/123 t/test..............ok46/123 t/test..............ok47/123 t/test..............ok48/123 t/test..............ok49/123 t/test..............ok50/123 t/test..............ok51/123 t/test..............ok52/123 t/test..............ok53/123 t/test..............ok54/123 t/test..............ok55/123 t/test..............ok56/123 t/test..............ok57/123 t/test..............ok58/123 t/test..............ok59/123 t/test..............ok60/123 t/test..............ok61/123 t/test..............ok62/123 t/test..............ok63/123 t/test..............ok64/123 t/test..............ok65/123 t/test..............ok66/123 t/test..............ok67/123 t/test..............ok68/123 t/test..............ok69/123 t/test..............ok70/123 t/test..............ok71/123 t/test..............ok72/123 t/test..............ok73/123 t/test..............ok74/123 t/test..............ok75/123 t/test..............ok76/123 t/test..............ok77/123 t/test..............ok78/123 t/test..............ok79/123 t/test..............ok80/123 t/test..............ok81/123 t/test..............ok82/123 t/test..............ok83/123 t/test..............ok84/123 t/test..............ok85/123 t/test..............ok86/123 t/test..............ok87/123 t/test..............ok88/123 t/test..............ok89/123 t/test..............ok90/123 t/test..............ok91/123 t/test..............ok92/123 t/test..............ok93/123 t/test..............ok94/123 t/test..............ok95/123 t/test..............ok96/123 t/test..............ok97/123 t/test..............ok98/123 t/test..............ok99/123 t/test..............ok100/123 t/test..............ok101/123 t/test..............ok102/123 t/test..............ok103/123 t/test..............ok104/123 t/test..............ok105/123 t/test..............ok106/123 t/test..............ok107/123 t/test..............ok108/123 t/test..............ok109/123 t/test..............ok110/123 t/test..............ok111/123 t/test..............ok112/123 t/test..............ok113/123 t/test..............ok114/123 t/test..............ok115/123 t/test..............ok116/123 t/test..............ok117/123 t/test..............ok118/123 t/test..............ok119/123 t/test..............ok120/123 t/test..............ok121/123 t/test..............ok122/123 t/test..............ok123/123 t/test..............ok t/testex............ t/testex............NOK 1# Test 1 got: "256" (t/testex.t at line 37) # Expected: "0" # t/testex.t line 37 is: ok( runPerlCommand( 'examples/copy.pl', INPUTZIP, OUTPUTZIP ), 0 ); t/testex............NOK 2# Test 2 got: "256" (t/testex.t at line 39) # Expected: "0" # t/testex.t line 39 is: ok( runPerlCommand( 'examples/extract.pl', OUTPUTZIP, ZFILENAME ), 0 ); t/testex............NOK 3# Test 3 got: "256" (t/testex.t at line 41) # Expected: "0" # t/testex.t line 41 is: ok( runPerlCommand( 'examples/mfh.pl', INPUTZIP ), 0 ); t/testex............NOK 4# Test 4 got: "256" (t/testex.t at line 43) # Expected: "0" # t/testex.t line 43 is: ok( runPerlCommand( 'examples/zip.pl', OUTPUTZIP, INPUTZIP, FILENAME ), 0 ); t/testex............NOK 5# Test 5 got: "256" (t/testex.t at line 46) # Expected: "0" # t/testex.t line 46 is: ok( $status, 0 ); t/testex............NOK 6# Test 6 got: "256" (t/testex.t at line 51) # Expected: "0" # t/testex.t line 51 is: ok( $status, 0 ); t/testex............NOK 7# Test 7 got: "256" (t/testex.t at line 56) # Expected: "0" # t/testex.t line 56 is: ok( $status, 0 ); t/testex............NOK 8# Test 8 got: "" (t/testex.t at line 57) # Expected: "testdir/testing.txt:100\n" # t/testex.t line 57 is: ok( $output, ZFILENAME . ":100\n" ); t/testex............NOK 9# Test 9 got: "256" (t/testex.t at line 66) # Expected: "0" # t/testex.t line 66 is: ok( runPerlCommand( 'examples/selfex.pl', OUTPUTZIP, FILENAME ), 0 ); t/testex............NOK 10# Test 10 got: "256" (t/testex.t at line 68) # Expected: "0" # t/testex.t line 68 is: ok( runPerlCommand(OUTPUTZIP), 0 ); t/testex............NOK 11# Test 11 got: (t/testex.t at line 72) # Expected: "1" (extracted/testdir/testing.txt exists) # t/testex.t line 72 is: ok( -f $fn, 1, "$fn exists" ); t/testex............NOK 12# Test 12 got: "256" (t/testex.t at line 81) # Expected: "0" (updateTree.pl create) # t/testex.t line 81 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl create" ); t/testex............NOK 13# Test 13 got: (t/testex.t at line 82) # Expected: "1" (zip created) # t/testex.t line 82 is: ok( -f OUTPUTZIP, 1, "zip created" ); t/testex............NOK 14# Test 14 got: "256" (t/testex.t at line 83) # Expected: "0" (updateTree.pl update) # t/testex.t line 83 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl update" ); t/testex............NOK 15# Test 15 got: (t/testex.t at line 84) # Expected: "1" (zip updated) # t/testex.t line 84 is: ok( -f OUTPUTZIP, 1, "zip updated" ); t/testex............FAILED tests 1-15 Failed 15/15 tests, 0.00% okay t/testMemberRead.... t/testMemberRead....ok1/7 t/testMemberRead....ok2/7 t/testMemberRead....ok3/7 t/testMemberRead....ok4/7 t/testMemberRead....ok5/7 t/testMemberRead....ok6/7 t/testMemberRead....ok7/7 t/testMemberRead....ok t/testTree.......... t/testTree..........ok1/6 t/testTree..........ok2/6 t/testTree..........ok3/6 t/testTree..........ok4/6 t/testTree..........ok5/6 t/testTree..........ok6/6 t/testTree..........ok t/testUpdate........ t/testUpdate........ok1/12 t/testUpdate........ok2/12 t/testUpdate........ok3/12 t/testUpdate........ok4/12 t/testUpdate........ok5/12 t/testUpdate........ok6/12 t/testUpdate........ok7/12 t/testUpdate........ok8/12 t/testUpdate........ok9/12 t/testUpdate........ok10/12 t/testUpdate........ok11/12 t/testUpdate........ok12/12 t/testUpdate........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/testex.t 15 15 100.00% 1-15 Failed 1/5 test scripts, 80.00% okay. 15/163 subtests failed, 90.80% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.60161 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.60161 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.14-1.noarch.rpm. Maybe it did not build correctly? Julian Field wrote: I've just tried it on RHEL4 and it works fine, so it's some Fedora 3 screwup (wouldn't be the first). What's the output of rpmbuild -bc perl-Archive-Zip.spec Kyle Krieg wrote: I know this has been brought up in the past, but was wanting to get an update on where it was in the pile. I have a Fedora 3 x86_64 build that I'm wishing to install Mailscanner on. Every time I try and install Mailscanner, it fails on the actuall Mailscanner rpm install. I have a regular non 64bit processer in another machine, which Mailscanner builds correctly on. See this e-mail string from the searchable mailing list : http://www.jiscmail.ac.uk/cgi-bin/wa.exe?A2=ind0503&L=mailscanner&P=R78667&I=-1 Just wondering if there is work and research going on the Fedora 3 64 bit platform and when something like this could get some attention ? :) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 19:21:57 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I think it actually built stuff okay, but has calculated the architecture wrongly. Please can you send me the output of rpm -qi perl rpm -qa | grep '^perl' rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl which perl perl -v For some reason it is picking up both i386 and x86_64 as the architecture, when it should just be x86_64 (which is what RHEL4 returns). That bunch of commands should give me an idea what is happening. Kyle Krieg wrote: > Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. > Thanks for looking into this Julian. I've been using Mailscanner for > 2 years now on a RH 8.0 machine with no issues. > > I've also show the following errors when using the install.sh script. > Looks like to me, the install scripts it looking for packages in the > i386x86_64 directory, which is not there. All the packages are in > either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or > /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. > > There are two outputs below, the first from the rpmbuild -bc > perl-Archive-Zip.spec and another from when I try and reinstall > MailScanner from the install.sh script. I've cut out most of it and > only given the errors that I think are important, but have the whole > install log, if you would like it see it. > > Kyle > > ************************************************ -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 19:30:32 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In the mean time, replace your install.sh with the attached script. Julian Field wrote: > I think it actually built stuff okay, but has calculated the > architecture wrongly. > Please can you send me the output of > rpm -qi perl > rpm -qa | grep '^perl' > rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl > which perl > perl -v > > For some reason it is picking up both i386 and x86_64 as the > architecture, when it should just be x86_64 (which is what RHEL4 > returns). > > That bunch of commands should give me an idea what is happening. > > Kyle Krieg wrote: > >> Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. >> Thanks for looking into this Julian. I've been using Mailscanner for >> 2 years now on a RH 8.0 machine with no issues. >> >> I've also show the following errors when using the install.sh script. >> Looks like to me, the install scripts it looking for packages in the >> i386x86_64 directory, which is not there. All the packages are in >> either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or >> /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. >> >> There are two outputs below, the first from the rpmbuild -bc >> perl-Archive-Zip.spec and another from when I try and reinstall >> MailScanner from the install.sh script. I've cut out most of it and >> only given the errors that I think are important, but have the whole >> install log, if you would like it see it. >> >> Kyle >> >> ************************************************ > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-GZIP 5.8KB. ] [ Unable to print this part. ] From kyle at MLUG.MISSOURI.EDU Sun Apr 3 19:47:43 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Here is the output from the commands you asked for. My install was Fedora 3 base (full install) and the current yum updates. My yum updates are pointing to livna server. Thanks!! Kyle [root@skywalker framadmn]# rpm -qi perl Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 11:55:57 AM CDT Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: tweety.build.redh at.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 28442178 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 12:01:58 PM CDT Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: dolly.build.redha t.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 34190638 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. [root@skywalker framadmn]# rpm -qa | grep '^perl' perl-LDAP-0.31-5 perl-Compress-Zlib-1.33-6 perl-Net-CIDR-0.10-1 perl-XML-NamespaceSupport-1.08-6 perl-XML-LibXML-1.58-1 perl-RPM-Specfile-1.17-2 perl-Convert-TNEF-0.17-3 perl-5.8.5-9 perl-libwww-perl-5.79-5 perl-Time-HiRes-1.55-3 perl-BSD-Resource-1.23-6 perl-HTML-Tagset-3.03-30 perl-Devel-Symdump-2.03-19 perl-HTML-Parser-3.35-6 perl-Convert-ASN1-0.18-3 perl-XML-LibXML-Common-0.13-7 perl-Convert-BinHex-1.119-2 perl-MailTools-1.66-1 perl-TimeDate-1.1301-3 perl-Bit-Vector-6.3-3 perl-RPM2-0.66-7 perl-5.8.5-9 perl-URI-1.30-4 perl-XML-Dumper-0.71-2 perl-Digest-SHA1-2.07-5 perl-XML-Twig-3.13-6 perl-Filter-Simple-0.79-4 perl-Cyrus-2.2.10-3.fc3 perl-DateManip-5.42a-3 perl-XML-Encoding-1.01-26 perl-XML-Grove-0.46alpha-27 perl-IO-stringy-2.110-1 perl-File-MMagic-1.21-2 perl-TermReadKey-2.20-17 perl-DBD-MySQL-2.9003-5 perl-XML-Parser-2.34-5 perl-Net-DNS-0.48-1 perl-Crypt-SSLeay-0.51-5 perl-NKF-2.04-3 perl-Archive-Tar-1.08-3 perl-Frontier-RPC-0.06-38 perl-Inline-0.44-14 perl-Filter-1.30-6 perl-DBI-1.40-5 perl-libxml-perl-0.07-30 perl-Digest-HMAC-1.01-13 perl-Parse-Yapp-1.05-32 perl-Date-Calc-5.3-9 perl-MIME-tools-5.417-1 perl-Text-Kakasi-1.05-11 perl-DBD-Pg-1.31-6 perl-Parse-RecDescent-1.94-4 perl-PDL-2.4.1-5 perl-libxml-enno-1.02-31 perl-XML-SAX-0.12-7 perl-SGMLSpm-1.03ii-14 perl-suidperl-5.8.5-9.1 [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl perl 5.8.5 i386 perl 5.8.5 x86_64 [root@skywalker framadmn]# which perl /usr/bin/perl [root@skywalker framadmn]# perl -v This is perl, v5.8.5 built for x86_64-linux-thread-multi Copyright 1987-2004, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. [root@skywalker framadmn]# Julian Field wrote: I think it actually built stuff okay, but has calculated the architecture wrongly. Please can you send me the output of rpm -qi perl rpm -qa | grep '^perl' rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl which perl perl -v For some reason it is picking up both i386 and x86_64 as the architecture, when it should just be x86_64 (which is what RHEL4 returns). That bunch of commands should give me an idea what is happening. Kyle Krieg wrote: Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. Thanks for looking into this Julian. I've been using Mailscanner for 2 years now on a RH 8.0 machine with no issues. I've also show the following errors when using the install.sh script. Looks like to me, the install scripts it looking for packages in the i386x86_64 directory, which is not there. All the packages are in either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. There are two outputs below, the first from the rpmbuild -bc perl-Archive-Zip.spec and another from when I try and reinstall MailScanner from the install.sh script. I've cut out most of it and only given the errors that I think are important, but have the whole install log, if you would like it see it. Kyle ************************************************ -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 20:00:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You have 2 packages installed both called "perl-5.8.5-9". Just 2 different architectures. That should break RPM :-( Please do rpm -ql perl | grep bin The install.sh script I just sent you works around this problem. Kyle Krieg wrote: > Here is the output from the commands you asked for. My install was > Fedora 3 base (full install) and the current yum updates. My yum > updates are pointing to livna server. > > Thanks!! > > Kyle > > > [root@skywalker framadmn]# rpm -qi perl > Name : perl Relocations: (not relocatable) > Version : 5.8.5 Vendor: Red Hat, Inc. > Release : 9 Build Date: Tue 12 Oct > 2004 11:55:57 AM CDT > Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: > tweety.build.redh at.com > Group : Development/Languages Source RPM: > perl-5.8.5-9.src.rpm > Size : 28442178 License: Artistic or GPL > Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID > b44269d04f2a6fd2 > Packager : Red Hat, Inc. *MailScanner has detected a possible fraud > attempt from "bugzilla.redhat.com" claiming to be * > > URL : http://www.perl.org/ > Summary : The Perl programming language. > Description : > Perl is a high-level programming language with roots in C, sed, awk > and shell scripting. Perl is good at handling processes and files, > and is especially good at handling text. Perl's hallmarks are > practicality and efficiency. While it is used to do a lot of > different things, Perl's most common applications are system > administration utilities and web programming. A large proportion of > the CGI scripts on the web are written in Perl. You need the perl > package installed on your system so that your system can handle Perl > scripts. > > Install this package if you want to program in Perl or enable your > system to handle Perl scripts. > Name : perl Relocations: (not relocatable) > Version : 5.8.5 Vendor: Red Hat, Inc. > Release : 9 Build Date: Tue 12 Oct > 2004 12:01:58 PM CDT > Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: > dolly.build.redha t.com > Group : Development/Languages Source RPM: > perl-5.8.5-9.src.rpm > Size : 34190638 License: Artistic or GPL > Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID > b44269d04f2a6fd2 > Packager : Red Hat, Inc. *MailScanner has detected a possible fraud > attempt from "bugzilla.redhat.com" claiming to be * > > URL : http://www.perl.org/ > Summary : The Perl programming language. > Description : > Perl is a high-level programming language with roots in C, sed, awk > and shell scripting. Perl is good at handling processes and files, > and is especially good at handling text. Perl's hallmarks are > practicality and efficiency. While it is used to do a lot of > different things, Perl's most common applications are system > administration utilities and web programming. A large proportion of > the CGI scripts on the web are written in Perl. You need the perl > package installed on your system so that your system can handle Perl > scripts. > > Install this package if you want to program in Perl or enable your > system to handle Perl scripts. > [root@skywalker framadmn]# rpm -qa | grep '^perl' > perl-LDAP-0.31-5 > perl-Compress-Zlib-1.33-6 > perl-Net-CIDR-0.10-1 > perl-XML-NamespaceSupport-1.08-6 > perl-XML-LibXML-1.58-1 > perl-RPM-Specfile-1.17-2 > perl-Convert-TNEF-0.17-3 > perl-5.8.5-9 > perl-libwww-perl-5.79-5 > perl-Time-HiRes-1.55-3 > perl-BSD-Resource-1.23-6 > perl-HTML-Tagset-3.03-30 > perl-Devel-Symdump-2.03-19 > perl-HTML-Parser-3.35-6 > perl-Convert-ASN1-0.18-3 > perl-XML-LibXML-Common-0.13-7 > perl-Convert-BinHex-1.119-2 > perl-MailTools-1.66-1 > perl-TimeDate-1.1301-3 > perl-Bit-Vector-6.3-3 > perl-RPM2-0.66-7 > perl-5.8.5-9 > perl-URI-1.30-4 > perl-XML-Dumper-0.71-2 > perl-Digest-SHA1-2.07-5 > perl-XML-Twig-3.13-6 > perl-Filter-Simple-0.79-4 > perl-Cyrus-2.2.10-3.fc3 > perl-DateManip-5.42a-3 > perl-XML-Encoding-1.01-26 > perl-XML-Grove-0.46alpha-27 > perl-IO-stringy-2.110-1 > perl-File-MMagic-1.21-2 > perl-TermReadKey-2.20-17 > perl-DBD-MySQL-2.9003-5 > perl-XML-Parser-2.34-5 > perl-Net-DNS-0.48-1 > perl-Crypt-SSLeay-0.51-5 > perl-NKF-2.04-3 > perl-Archive-Tar-1.08-3 > perl-Frontier-RPC-0.06-38 > perl-Inline-0.44-14 > perl-Filter-1.30-6 > perl-DBI-1.40-5 > perl-libxml-perl-0.07-30 > perl-Digest-HMAC-1.01-13 > perl-Parse-Yapp-1.05-32 > perl-Date-Calc-5.3-9 > perl-MIME-tools-5.417-1 > perl-Text-Kakasi-1.05-11 > perl-DBD-Pg-1.31-6 > perl-Parse-RecDescent-1.94-4 > perl-PDL-2.4.1-5 > perl-libxml-enno-1.02-31 > perl-XML-SAX-0.12-7 > perl-SGMLSpm-1.03ii-14 > perl-suidperl-5.8.5-9.1 > [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} > %{ARCH}\n' perl > perl 5.8.5 i386 > perl 5.8.5 x86_64 > [root@skywalker framadmn]# which perl > /usr/bin/perl > [root@skywalker framadmn]# perl -v > > This is perl, v5.8.5 built for x86_64-linux-thread-multi > > Copyright 1987-2004, Larry Wall > > Perl may be copied only under the terms of either the Artistic License > or the > GNU General Public License, which may be found in the Perl 5 source kit. > > Complete documentation for Perl, including FAQ lists, should be found on > this system using `man perl' or `perldoc perl'. If you have access to the > Internet, point your browser at http://www.perl.com/, the Perl Home Page. > > [root@skywalker framadmn]# > > > > Julian Field wrote: > >> I think it actually built stuff okay, but has calculated the >> architecture wrongly. >> Please can you send me the output of >> rpm -qi perl >> rpm -qa | grep '^perl' >> rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl >> which perl >> perl -v >> >> For some reason it is picking up both i386 and x86_64 as the >> architecture, when it should just be x86_64 (which is what RHEL4 >> returns). >> >> That bunch of commands should give me an idea what is happening. >> >> Kyle Krieg wrote: >> >>> Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. >>> Thanks for looking into this Julian. I've been using Mailscanner for >>> 2 years now on a RH 8.0 machine with no issues. >>> >>> I've also show the following errors when using the install.sh script. >>> Looks like to me, the install scripts it looking for packages in the >>> i386x86_64 directory, which is not there. All the packages are in >>> either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or >>> /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. >>> >>> There are two outputs below, the first from the rpmbuild -bc >>> perl-Archive-Zip.spec and another from when I try and reinstall >>> MailScanner from the install.sh script. I've cut out most of it and >>> only given the errors that I think are important, but have the whole >>> install log, if you would like it see it. >>> >>> Kyle >>> >>> ************************************************ >> >> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kyle at MLUG.MISSOURI.EDU Sun Apr 3 20:12:32 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yeah, I saw that I had 2 perl (same) versions different arch and the light bulb went off on why it could be breaking the install script...why does Fedora do that on x86_64...umm..mysteries... Here is the output from rpm -ql perl | grep bin. [root@skywalker etc]# rpm -ql perl | grep bin /usr/bin/a2p /usr/bin/c2ph /usr/bin/cpan /usr/bin/dprofpp /usr/bin/enc2xs /usr/bin/find2perl /usr/bin/h2ph /usr/bin/h2xs /usr/bin/instmodsh /usr/bin/libnetcfg /usr/bin/perl /usr/bin/perl5.8.5 /usr/bin/perlbug /usr/bin/perlcc /usr/bin/perldoc /usr/bin/perlivp /usr/bin/piconv /usr/bin/pl2pm /usr/bin/pod2html /usr/bin/pod2latex /usr/bin/pod2man /usr/bin/pod2text /usr/bin/pod2usage /usr/bin/podchecker /usr/bin/podselect /usr/bin/prove /usr/bin/psed /usr/bin/pstruct /usr/bin/s2p /usr/bin/splain /usr/bin/xsubpp /usr/lib/perl5/5.8.5/unicore/CombiningClass.pl /usr/lib/perl5/5.8.5/unicore/lib/gc_sc/InCombin.pl /usr/bin/a2p /usr/bin/c2ph /usr/bin/cpan /usr/bin/dprofpp /usr/bin/enc2xs /usr/bin/find2perl /usr/bin/h2ph /usr/bin/h2xs /usr/bin/instmodsh /usr/bin/libnetcfg /usr/bin/perl /usr/bin/perl5.8.5 /usr/bin/perlbug /usr/bin/perlcc /usr/bin/perldoc /usr/bin/perlivp /usr/bin/piconv /usr/bin/pl2pm /usr/bin/pod2html /usr/bin/pod2latex /usr/bin/pod2man /usr/bin/pod2text /usr/bin/pod2usage /usr/bin/podchecker /usr/bin/podselect /usr/bin/prove /usr/bin/psed /usr/bin/pstruct /usr/bin/s2p /usr/bin/splain /usr/bin/xsubpp /usr/lib/perl5/5.8.5/unicore/CombiningClass.pl /usr/lib/perl5/5.8.5/unicore/lib/gc_sc/InCombin.pl [root@skywalker etc]# Julian Field wrote: You have 2 packages installed both called "perl-5.8.5-9". Just 2 different architectures. That should break RPM :-( Please do rpm -ql perl | grep bin The install.sh script I just sent you works around this problem. Kyle Krieg wrote: Here is the output from the commands you asked for. My install was Fedora 3 base (full install) and the current yum updates. My yum updates are pointing to livna server. Thanks!! Kyle [root@skywalker framadmn]# rpm -qi perl Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 11:55:57 AM CDT Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: tweety.build.redh at.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 28442178 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 12:01:58 PM CDT Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: dolly.build.redha t.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 34190638 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. [root@skywalker framadmn]# rpm -qa | grep '^perl' perl-LDAP-0.31-5 perl-Compress-Zlib-1.33-6 perl-Net-CIDR-0.10-1 perl-XML-NamespaceSupport-1.08-6 perl-XML-LibXML-1.58-1 perl-RPM-Specfile-1.17-2 perl-Convert-TNEF-0.17-3 perl-5.8.5-9 perl-libwww-perl-5.79-5 perl-Time-HiRes-1.55-3 perl-BSD-Resource-1.23-6 perl-HTML-Tagset-3.03-30 perl-Devel-Symdump-2.03-19 perl-HTML-Parser-3.35-6 perl-Convert-ASN1-0.18-3 perl-XML-LibXML-Common-0.13-7 perl-Convert-BinHex-1.119-2 perl-MailTools-1.66-1 perl-TimeDate-1.1301-3 perl-Bit-Vector-6.3-3 perl-RPM2-0.66-7 perl-5.8.5-9 perl-URI-1.30-4 perl-XML-Dumper-0.71-2 perl-Digest-SHA1-2.07-5 perl-XML-Twig-3.13-6 perl-Filter-Simple-0.79-4 perl-Cyrus-2.2.10-3.fc3 perl-DateManip-5.42a-3 perl-XML-Encoding-1.01-26 perl-XML-Grove-0.46alpha-27 perl-IO-stringy-2.110-1 perl-File-MMagic-1.21-2 perl-TermReadKey-2.20-17 perl-DBD-MySQL-2.9003-5 perl-XML-Parser-2.34-5 perl-Net-DNS-0.48-1 perl-Crypt-SSLeay-0.51-5 perl-NKF-2.04-3 perl-Archive-Tar-1.08-3 perl-Frontier-RPC-0.06-38 perl-Inline-0.44-14 perl-Filter-1.30-6 perl-DBI-1.40-5 perl-libxml-perl-0.07-30 perl-Digest-HMAC-1.01-13 perl-Parse-Yapp-1.05-32 perl-Date-Calc-5.3-9 perl-MIME-tools-5.417-1 perl-Text-Kakasi-1.05-11 perl-DBD-Pg-1.31-6 perl-Parse-RecDescent-1.94-4 perl-PDL-2.4.1-5 perl-libxml-enno-1.02-31 perl-XML-SAX-0.12-7 perl-SGMLSpm-1.03ii-14 perl-suidperl-5.8.5-9.1 [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl perl 5.8.5 i386 perl 5.8.5 x86_64 [root@skywalker framadmn]# which perl /usr/bin/perl [root@skywalker framadmn]# perl -v This is perl, v5.8.5 built for x86_64-linux-thread-multi Copyright 1987-2004, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. [root@skywalker framadmn]# Julian Field wrote: I think it actually built stuff okay, but has calculated the architecture wrongly. Please can you send me the output of rpm -qi perl rpm -qa | grep '^perl' rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl which perl perl -v For some reason it is picking up both i386 and x86_64 as the architecture, when it should just be x86_64 (which is what RHEL4 returns). That bunch of commands should give me an idea what is happening. Kyle Krieg wrote: Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. Thanks for looking into this Julian. I've been using Mailscanner for 2 years now on a RH 8.0 machine with no issues. I've also show the following errors when using the install.sh script. Looks like to me, the install scripts it looking for packages in the i386x86_64 directory, which is not there. All the packages are in either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. There are two outputs below, the first from the rpmbuild -bc perl-Archive-Zip.spec and another from when I try and reinstall MailScanner from the install.sh script. I've cut out most of it and only given the errors that I think are important, but have the whole install log, if you would like it see it. Kyle ************************************************ -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kyle at MLUG.MISSOURI.EDU Sun Apr 3 20:21:29 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:13 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I used your new install.sh script, and looks like it had a small problem with perl-Archive-Zip. Here is the output from the install...it's only failing on this one package.... Attempting to build and install perl-Archive-Zip-1.14-1 Installing perl-Archive-Zip-1.14-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.38076 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Archive-Zip-1.14 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Archive-Zip-1.14.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Archive-Zip-1.14 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.38076 + umask 022 + cd /usr/src/redhat/BUILD + cd Archive-Zip-1.14 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Archive-Zip-1.14-1-root/usr Checking if your kit is complete... Looks good Writing Makefile for Archive::Zip + make cp lib/Archive/Zip.pod blib/lib/Archive/Zip.pod cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm cp crc32 blib/script/crc32 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/crc32 Manifying blib/man3/Archive::Zip::Tree.3pm Manifying blib/man3/Archive::Zip.3pm Manifying blib/man3/Archive::Zip::FAQ.3pm Manifying blib/man3/Archive::Zip::MemberRead.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t ok 2/123 t/test..............ok 7/1 t .........ok 14/123 t/test....... 21/123 t/test..............ok 26 .............ok 33/123 t/test... .ok 40/123 t/test..............o est..............ok 52/123 t/tes .....ok 59/123 t/test........... 23 t/test..............ok 71/123 t .........ok 78/123 t/test....... 85/123 t/test..............ok 90 .............ok 97/123 t/test. ......ok 104/123 t/test...... .ok 111/123 t/test........... 18/123 t/test..............ok t/test..............ok t/testex............NOK 1# Test 1 got: "256" (t/testex.t at line 37) # Expected: "0" # t/testex.t line 37 is: ok( runPerlCommand( 'examples/copy.pl', INPUTZIP, OUTPUTZIP ), 0 ); t/testex............NOK 2# Test 2 got: "256" (t/testex.t at line 39) # Expected: "0" # t/testex.t line 39 is: ok( runPerlCommand( 'examples/extract.pl', OUTPUTZIP, ZFILENAME ), 0 ); t/testex............NOK 3# Test 3 got: "256" (t/testex.t at line 41) # Expected: "0" # t/testex.t line 41 is: ok( runPerlCommand( 'examples/mfh.pl', INPUTZIP ), 0 ); t/testex............NOK 4# Test 4 got: "256" (t/testex.t at line 43) # Expected: "0" # t/testex.t line 43 is: ok( runPerlCommand( 'examples/zip.pl', OUTPUTZIP, INPUTZIP, FILENAME ), 0 ); t/testex............NOK 5# Test 5 got: "256" (t/testex.t at line 46) # Expected: "0" # t/testex.t line 46 is: ok( $status, 0 ); t/testex............NOK 6# Test 6 got: "256" (t/testex.t at line 51) # Expected: "0" # t/testex.t line 51 is: ok( $status, 0 ); t/testex............NOK 7# Test 7 got: "256" (t/testex.t at line 56) # Expected: "0" # t/testex.t line 56 is: ok( $status, 0 ); t/testex............NOK 8# Test 8 got: "" (t/testex.t at line 57) # Expected: "testdir/testing.txt:100\n" # t/testex.t line 57 is: ok( $output, ZFILENAME . ":100\n" ); t/testex............NOK 9# Test 9 got: "256" (t/testex.t at line 66) # Expected: "0" # t/testex.t line 66 is: ok( runPerlCommand( 'examples/selfex.pl', OUTPUTZIP, FILENAME ), 0 ); t/testex............NOK 10# Test 10 got: "256" (t/testex.t at line 68) # Expected: "0" # t/testex.t line 68 is: ok( runPerlCommand(OUTPUTZIP), 0 ); t/testex............NOK 11# Test 11 got: (t/testex.t at line 72) # Expected: "1" (extracted/testdir/testing.txt exists) # t/testex.t line 72 is: ok( -f $fn, 1, "$fn exists" ); t/testex............NOK 12# Test 12 got: "256" (t/testex.t at line 81) # Expected: "0" (updateTree.pl create) # t/testex.t line 81 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl create" ); t/testex............NOK 13# Test 13 got: (t/testex.t at line 82) # Expected: "1" (zip created) # t/testex.t line 82 is: ok( -f OUTPUTZIP, 1, "zip created" ); t/testex............NOK 14# Test 14 got: "256" (t/testex.t at line 83) # Expected: "0" (updateTree.pl update) # t/testex.t line 83 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl update" ); t/testex............NOK 15# Test 15 got: (t/testex.t at line 84) # Expected: "1" (zip updated) # t/testex.t line 84 is: ok( -f OUTPUTZIP, 1, "zip updated" ); t/testex............FAILED tests 1-15 Failed 15/15 tests, 0.00% okay /7 rRead....ok 7/7 t/testMemberRead....ok /6 t/testTree..........ok 2/12 stUpdate........ok 7/12 t/testUpdate t/testUpdate........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/testex.t 15 15 100.00% 1-15 Failed 1/5 test scripts, 80.00% okay. 15/163 subtests failed, 90.80% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.38076 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.38076 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.14-1.noarch.rpm. Maybe it did not build correctly? Julian Field wrote: You have 2 packages installed both called "perl-5.8.5-9". Just 2 different architectures. That should break RPM :-( Please do rpm -ql perl | grep bin The install.sh script I just sent you works around this problem. Kyle Krieg wrote: Here is the output from the commands you asked for. My install was Fedora 3 base (full install) and the current yum updates. My yum updates are pointing to livna server. Thanks!! Kyle [root@skywalker framadmn]# rpm -qi perl Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 11:55:57 AM CDT Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: tweety.build.redh at.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 28442178 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 12:01:58 PM CDT Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: dolly.build.redha t.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 34190638 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. [root@skywalker framadmn]# rpm -qa | grep '^perl' perl-LDAP-0.31-5 perl-Compress-Zlib-1.33-6 perl-Net-CIDR-0.10-1 perl-XML-NamespaceSupport-1.08-6 perl-XML-LibXML-1.58-1 perl-RPM-Specfile-1.17-2 perl-Convert-TNEF-0.17-3 perl-5.8.5-9 perl-libwww-perl-5.79-5 perl-Time-HiRes-1.55-3 perl-BSD-Resource-1.23-6 perl-HTML-Tagset-3.03-30 perl-Devel-Symdump-2.03-19 perl-HTML-Parser-3.35-6 perl-Convert-ASN1-0.18-3 perl-XML-LibXML-Common-0.13-7 perl-Convert-BinHex-1.119-2 perl-MailTools-1.66-1 perl-TimeDate-1.1301-3 perl-Bit-Vector-6.3-3 perl-RPM2-0.66-7 perl-5.8.5-9 perl-URI-1.30-4 perl-XML-Dumper-0.71-2 perl-Digest-SHA1-2.07-5 perl-XML-Twig-3.13-6 perl-Filter-Simple-0.79-4 perl-Cyrus-2.2.10-3.fc3 perl-DateManip-5.42a-3 perl-XML-Encoding-1.01-26 perl-XML-Grove-0.46alpha-27 perl-IO-stringy-2.110-1 perl-File-MMagic-1.21-2 perl-TermReadKey-2.20-17 perl-DBD-MySQL-2.9003-5 perl-XML-Parser-2.34-5 perl-Net-DNS-0.48-1 perl-Crypt-SSLeay-0.51-5 perl-NKF-2.04-3 perl-Archive-Tar-1.08-3 perl-Frontier-RPC-0.06-38 perl-Inline-0.44-14 perl-Filter-1.30-6 perl-DBI-1.40-5 perl-libxml-perl-0.07-30 perl-Digest-HMAC-1.01-13 perl-Parse-Yapp-1.05-32 perl-Date-Calc-5.3-9 perl-MIME-tools-5.417-1 perl-Text-Kakasi-1.05-11 perl-DBD-Pg-1.31-6 perl-Parse-RecDescent-1.94-4 perl-PDL-2.4.1-5 perl-libxml-enno-1.02-31 perl-XML-SAX-0.12-7 perl-SGMLSpm-1.03ii-14 perl-suidperl-5.8.5-9.1 [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl perl 5.8.5 i386 perl 5.8.5 x86_64 [root@skywalker framadmn]# which perl /usr/bin/perl [root@skywalker framadmn]# perl -v This is perl, v5.8.5 built for x86_64-linux-thread-multi Copyright 1987-2004, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. [root@skywalker framadmn]# Julian Field wrote: I think it actually built stuff okay, but has calculated the architecture wrongly. Please can you send me the output of rpm -qi perl rpm -qa | grep '^perl' rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl which perl perl -v For some reason it is picking up both i386 and x86_64 as the architecture, when it should just be x86_64 (which is what RHEL4 returns). That bunch of commands should give me an idea what is happening. Kyle Krieg wrote: Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. Thanks for looking into this Julian. I've been using Mailscanner for 2 years now on a RH 8.0 machine with no issues. I've also show the following errors when using the install.sh script. Looks like to me, the install scripts it looking for packages in the i386x86_64 directory, which is not there. All the packages are in either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. There are two outputs below, the first from the rpmbuild -bc perl-Archive-Zip.spec and another from when I try and reinstall MailScanner from the install.sh script. I've cut out most of it and only given the errors that I think are important, but have the whole install log, if you would like it see it. Kyle ************************************************ -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 20:35:19 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It is probably having trouble with Compress-Zlib. Try uninstalling perl-Compress-Zlib (rpm -e perl-Compress-Zlib) and then running install.sh again. perl-Archive-Zip itself doesn't do anything platform-dependent I think, it's Compress-Zlib that does the hard work. Kyle Krieg wrote: > I used your new install.sh script, and looks like it had a small > problem with perl-Archive-Zip. Here is the output from the > install...it's only failing on this one package.... > > > Julian Field wrote: > >> You have 2 packages installed both called "perl-5.8.5-9". Just 2 >> different architectures. >> That should break RPM :-( >> >> Please do >> >> rpm -ql perl | grep bin >> >> The install.sh script I just sent you works around this problem. >> >> >> Kyle Krieg wrote: >> >>> Here is the output from the commands you asked for. My install was >>> Fedora 3 base (full install) and the current yum updates. My yum >>> updates are pointing to livna server. >>> >>> Thanks!! >>> >>> Kyle >>> >>> >>> [root@skywalker framadmn]# rpm -qi perl >>> Name : perl Relocations: (not >>> relocatable) >>> Version : 5.8.5 Vendor: Red Hat, Inc. >>> Release : 9 Build Date: Tue 12 Oct >>> 2004 11:55:57 AM CDT >>> Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: >>> tweety.build.redh at.com >>> Group : Development/Languages Source RPM: >>> perl-5.8.5-9.src.rpm >>> Size : 28442178 License: Artistic or GPL >>> Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID >>> b44269d04f2a6fd2 >>> Packager : Red Hat, Inc. *MailScanner has detected a possible fraud >>> attempt from "bugzilla.redhat.com" claiming to be * >>> *MailScanner has detected a possible fraud attempt from >>> "bugzilla.redhat.com" claiming to be * >>> >>> URL : http://www.perl.org/ >>> Summary : The Perl programming language. >>> Description : >>> Perl is a high-level programming language with roots in C, sed, awk >>> and shell scripting. Perl is good at handling processes and files, >>> and is especially good at handling text. Perl's hallmarks are >>> practicality and efficiency. While it is used to do a lot of >>> different things, Perl's most common applications are system >>> administration utilities and web programming. A large proportion of >>> the CGI scripts on the web are written in Perl. You need the perl >>> package installed on your system so that your system can handle Perl >>> scripts. >>> >>> Install this package if you want to program in Perl or enable your >>> system to handle Perl scripts. >>> Name : perl Relocations: (not >>> relocatable) >>> Version : 5.8.5 Vendor: Red Hat, Inc. >>> Release : 9 Build Date: Tue 12 Oct >>> 2004 12:01:58 PM CDT >>> Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: >>> dolly.build.redha t.com >>> Group : Development/Languages Source RPM: >>> perl-5.8.5-9.src.rpm >>> Size : 34190638 License: Artistic or GPL >>> Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID >>> b44269d04f2a6fd2 >>> Packager : Red Hat, Inc. *MailScanner has detected a possible fraud >>> attempt from "bugzilla.redhat.com" claiming to be * >>> *MailScanner has detected a possible fraud attempt from >>> "bugzilla.redhat.com" claiming to be * >>> >>> URL : http://www.perl.org/ >>> Summary : The Perl programming language. >>> Description : >>> Perl is a high-level programming language with roots in C, sed, awk >>> and shell scripting. Perl is good at handling processes and files, >>> and is especially good at handling text. Perl's hallmarks are >>> practicality and efficiency. While it is used to do a lot of >>> different things, Perl's most common applications are system >>> administration utilities and web programming. A large proportion of >>> the CGI scripts on the web are written in Perl. You need the perl >>> package installed on your system so that your system can handle Perl >>> scripts. >>> >>> Install this package if you want to program in Perl or enable your >>> system to handle Perl scripts. >>> [root@skywalker framadmn]# rpm -qa | grep '^perl' >>> perl-LDAP-0.31-5 >>> perl-Compress-Zlib-1.33-6 >>> perl-Net-CIDR-0.10-1 >>> perl-XML-NamespaceSupport-1.08-6 >>> perl-XML-LibXML-1.58-1 >>> perl-RPM-Specfile-1.17-2 >>> perl-Convert-TNEF-0.17-3 >>> perl-5.8.5-9 >>> perl-libwww-perl-5.79-5 >>> perl-Time-HiRes-1.55-3 >>> perl-BSD-Resource-1.23-6 >>> perl-HTML-Tagset-3.03-30 >>> perl-Devel-Symdump-2.03-19 >>> perl-HTML-Parser-3.35-6 >>> perl-Convert-ASN1-0.18-3 >>> perl-XML-LibXML-Common-0.13-7 >>> perl-Convert-BinHex-1.119-2 >>> perl-MailTools-1.66-1 >>> perl-TimeDate-1.1301-3 >>> perl-Bit-Vector-6.3-3 >>> perl-RPM2-0.66-7 >>> perl-5.8.5-9 >>> perl-URI-1.30-4 >>> perl-XML-Dumper-0.71-2 >>> perl-Digest-SHA1-2.07-5 >>> perl-XML-Twig-3.13-6 >>> perl-Filter-Simple-0.79-4 >>> perl-Cyrus-2.2.10-3.fc3 >>> perl-DateManip-5.42a-3 >>> perl-XML-Encoding-1.01-26 >>> perl-XML-Grove-0.46alpha-27 >>> perl-IO-stringy-2.110-1 >>> perl-File-MMagic-1.21-2 >>> perl-TermReadKey-2.20-17 >>> perl-DBD-MySQL-2.9003-5 >>> perl-XML-Parser-2.34-5 >>> perl-Net-DNS-0.48-1 >>> perl-Crypt-SSLeay-0.51-5 >>> perl-NKF-2.04-3 >>> perl-Archive-Tar-1.08-3 >>> perl-Frontier-RPC-0.06-38 >>> perl-Inline-0.44-14 >>> perl-Filter-1.30-6 >>> perl-DBI-1.40-5 >>> perl-libxml-perl-0.07-30 >>> perl-Digest-HMAC-1.01-13 >>> perl-Parse-Yapp-1.05-32 >>> perl-Date-Calc-5.3-9 >>> perl-MIME-tools-5.417-1 >>> perl-Text-Kakasi-1.05-11 >>> perl-DBD-Pg-1.31-6 >>> perl-Parse-RecDescent-1.94-4 >>> perl-PDL-2.4.1-5 >>> perl-libxml-enno-1.02-31 >>> perl-XML-SAX-0.12-7 >>> perl-SGMLSpm-1.03ii-14 >>> perl-suidperl-5.8.5-9.1 >>> [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} >>> %{ARCH}\n' perl >>> perl 5.8.5 i386 >>> perl 5.8.5 x86_64 >>> [root@skywalker framadmn]# which perl >>> /usr/bin/perl >>> [root@skywalker framadmn]# perl -v >>> >>> This is perl, v5.8.5 built for x86_64-linux-thread-multi >>> >>> Copyright 1987-2004, Larry Wall >>> >>> Perl may be copied only under the terms of either the Artistic License >>> or the >>> GNU General Public License, which may be found in the Perl 5 source >>> kit. >>> >>> Complete documentation for Perl, including FAQ lists, should be >>> found on >>> this system using `man perl' or `perldoc perl'. If you have access >>> to the >>> Internet, point your browser at http://www.perl.com/, the Perl Home >>> Page. >>> >>> [root@skywalker framadmn]# >>> >>> >>> >>> Julian Field wrote: >>> >>>> I think it actually built stuff okay, but has calculated the >>>> architecture wrongly. >>>> Please can you send me the output of >>>> rpm -qi perl >>>> rpm -qa | grep '^perl' >>>> rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl >>>> which perl >>>> perl -v >>>> >>>> For some reason it is picking up both i386 and x86_64 as the >>>> architecture, when it should just be x86_64 (which is what RHEL4 >>>> returns). >>>> >>>> That bunch of commands should give me an idea what is happening. >>>> >>>> Kyle Krieg wrote: >>>> >>>>> Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. >>>>> Thanks for looking into this Julian. I've been using Mailscanner for >>>>> 2 years now on a RH 8.0 machine with no issues. >>>>> >>>>> I've also show the following errors when using the install.sh script. >>>>> Looks like to me, the install scripts it looking for packages in the >>>>> i386x86_64 directory, which is not there. All the packages are in >>>>> either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or >>>>> /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. >>>>> >>>>> There are two outputs below, the first from the rpmbuild -bc >>>>> perl-Archive-Zip.spec and another from when I try and reinstall >>>>> MailScanner from the install.sh script. I've cut out most of it and >>>>> only given the errors that I think are important, but have the whole >>>>> install log, if you would like it see it. >>>>> >>>>> Kyle >>>>> >>>>> ************************************************ >>>> >>>> >>>> >>>> >>>> -- >>>> Julian Field >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> Professional Support Services at www.MailScanner.biz >>>> MailScanner thanks transtec Computers for their support >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> *Support MailScanner development - buy the book off the website!* >> >> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lists at JANSZ.COM Sun Apr 3 21:13:59 2005 From: lists at JANSZ.COM (Menno Jansz) Date: Thu Jan 12 21:29:14 2006 Subject: Mail loss after upgrading to 4.40.11-1 due to missing .rules suffix Message-ID: Just upgraded an old version of SpamAssassin to the latest stable 4.40.11-1 The config file between this version and the old version I was installing from had changed the ""Spam Actions", "High Scoring Spam Actions", and associated items to now enforce a .rule or .rules suffix. Not having the suffix causes the mail to be "lost", no error and causes output in the log file of the action as being the filename converted to lower case (thus very confusing). Only after some code debugging did I spot the change, if only I had spotted the comment in the config file :) May be worth highlighting this in the upgrade_MailScanner_conf script so others dont make the same mistake. Cheers, Menno ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 3 21:38:50 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Mail loss after upgrading to 4.40.11-1 due to missing .rules suffix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks for highlighting that. I try to encourage people to always use a .rule or .rules filename suffix, but it's definitely one for the FAQ. It is probably adding a header called that, or trying to forward to that as an email address. The upgrade_MailScanner_conf script knows nothing about the contents of the options or the versions it is upgrading from or to, so adding any checks in there is pretty much impossible. Menno Jansz wrote: >Just upgraded an old version of SpamAssassin to the latest stable 4.40.11-1 > >The config file between this version and the old version I was installing >from had changed the ""Spam Actions", "High Scoring Spam Actions", and >associated items to now enforce a .rule or .rules suffix. Not having the >suffix causes the mail to be "lost", no error and causes output in the log >file of the action as being the filename converted to lower case (thus very >confusing). Only after some code debugging did I spot the change, if only I >had spotted the comment in the config file :) > >May be worth highlighting this in the upgrade_MailScanner_conf script so >others dont make the same mistake. > >Cheers, >Menno > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Sun Apr 3 22:58:39 2005 From: pete at ENITECH.COM.AU (Peter Russell) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Raymon Dijkxhoorn have provided alternate zlib that work fine on FC3 and RHEL4 (i pasted some of his post in below) - these were required to compile clamav (which i guess we were all doing before installing MS and therefore didnt have this problem) Is there any reason you would use FC3 over CentOS 4 for a mailscanner machine? http://mailscanner.prolocation.net/ Or the direct links: http://mailscanner.prolocation.net/zlib/zlib-1.2.2.2-1.i386.rpm http://mailscanner.prolocation.net/zlib/zlib-devel-1.2.2.2-1.i386.rpm Julian Field wrote: > It is probably having trouble with Compress-Zlib. Try uninstalling > perl-Compress-Zlib (rpm -e perl-Compress-Zlib) and then running > install.sh again. > > perl-Archive-Zip itself doesn't do anything platform-dependent I think, > it's Compress-Zlib that does the hard work. > > Kyle Krieg wrote: > >> I used your new install.sh script, and looks like it had a small >> problem with perl-Archive-Zip. Here is the output from the >> install...it's only failing on this one package.... >> >> >> Julian Field wrote: >> >>> You have 2 packages installed both called "perl-5.8.5-9". Just 2 >>> different architectures. >>> That should break RPM :-( >>> >>> Please do >>> >>> rpm -ql perl | grep bin >>> >>> The install.sh script I just sent you works around this problem. >>> >>> >>> Kyle Krieg wrote: >>> >>>> Here is the output from the commands you asked for. My install was >>>> Fedora 3 base (full install) and the current yum updates. My yum >>>> updates are pointing to livna server. >>>> >>>> Thanks!! >>>> >>>> Kyle >>>> >>>> >>>> [root@skywalker framadmn]# rpm -qi perl >>>> Name : perl Relocations: (not >>>> relocatable) >>>> Version : 5.8.5 Vendor: Red Hat, Inc. >>>> Release : 9 Build Date: Tue 12 Oct >>>> 2004 11:55:57 AM CDT >>>> Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: >>>> tweety.build.redh at.com >>>> Group : Development/Languages Source RPM: >>>> perl-5.8.5-9.src.rpm >>>> Size : 28442178 License: Artistic or GPL >>>> Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID >>>> b44269d04f2a6fd2 >>>> Packager : Red Hat, Inc. *MailScanner has detected a possible fraud >>>> attempt from "bugzilla.redhat.com" claiming to be * >>>> *MailScanner has detected a possible fraud attempt from >>>> "bugzilla.redhat.com" claiming to be * >>>> >>>> URL : http://www.perl.org/ >>>> Summary : The Perl programming language. >>>> Description : >>>> Perl is a high-level programming language with roots in C, sed, awk >>>> and shell scripting. Perl is good at handling processes and files, >>>> and is especially good at handling text. Perl's hallmarks are >>>> practicality and efficiency. While it is used to do a lot of >>>> different things, Perl's most common applications are system >>>> administration utilities and web programming. A large proportion of >>>> the CGI scripts on the web are written in Perl. You need the perl >>>> package installed on your system so that your system can handle Perl >>>> scripts. >>>> >>>> Install this package if you want to program in Perl or enable your >>>> system to handle Perl scripts. >>>> Name : perl Relocations: (not >>>> relocatable) >>>> Version : 5.8.5 Vendor: Red Hat, Inc. >>>> Release : 9 Build Date: Tue 12 Oct >>>> 2004 12:01:58 PM CDT >>>> Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: >>>> dolly.build.redha t.com >>>> Group : Development/Languages Source RPM: >>>> perl-5.8.5-9.src.rpm >>>> Size : 34190638 License: Artistic or GPL >>>> Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID >>>> b44269d04f2a6fd2 >>>> Packager : Red Hat, Inc. *MailScanner has detected a possible fraud >>>> attempt from "bugzilla.redhat.com" claiming to be * >>>> *MailScanner has detected a possible fraud attempt from >>>> "bugzilla.redhat.com" claiming to be * >>>> >>>> URL : http://www.perl.org/ >>>> Summary : The Perl programming language. >>>> Description : >>>> Perl is a high-level programming language with roots in C, sed, awk >>>> and shell scripting. Perl is good at handling processes and files, >>>> and is especially good at handling text. Perl's hallmarks are >>>> practicality and efficiency. While it is used to do a lot of >>>> different things, Perl's most common applications are system >>>> administration utilities and web programming. A large proportion of >>>> the CGI scripts on the web are written in Perl. You need the perl >>>> package installed on your system so that your system can handle Perl >>>> scripts. >>>> >>>> Install this package if you want to program in Perl or enable your >>>> system to handle Perl scripts. >>>> [root@skywalker framadmn]# rpm -qa | grep '^perl' >>>> perl-LDAP-0.31-5 >>>> perl-Compress-Zlib-1.33-6 >>>> perl-Net-CIDR-0.10-1 >>>> perl-XML-NamespaceSupport-1.08-6 >>>> perl-XML-LibXML-1.58-1 >>>> perl-RPM-Specfile-1.17-2 >>>> perl-Convert-TNEF-0.17-3 >>>> perl-5.8.5-9 >>>> perl-libwww-perl-5.79-5 >>>> perl-Time-HiRes-1.55-3 >>>> perl-BSD-Resource-1.23-6 >>>> perl-HTML-Tagset-3.03-30 >>>> perl-Devel-Symdump-2.03-19 >>>> perl-HTML-Parser-3.35-6 >>>> perl-Convert-ASN1-0.18-3 >>>> perl-XML-LibXML-Common-0.13-7 >>>> perl-Convert-BinHex-1.119-2 >>>> perl-MailTools-1.66-1 >>>> perl-TimeDate-1.1301-3 >>>> perl-Bit-Vector-6.3-3 >>>> perl-RPM2-0.66-7 >>>> perl-5.8.5-9 >>>> perl-URI-1.30-4 >>>> perl-XML-Dumper-0.71-2 >>>> perl-Digest-SHA1-2.07-5 >>>> perl-XML-Twig-3.13-6 >>>> perl-Filter-Simple-0.79-4 >>>> perl-Cyrus-2.2.10-3.fc3 >>>> perl-DateManip-5.42a-3 >>>> perl-XML-Encoding-1.01-26 >>>> perl-XML-Grove-0.46alpha-27 >>>> perl-IO-stringy-2.110-1 >>>> perl-File-MMagic-1.21-2 >>>> perl-TermReadKey-2.20-17 >>>> perl-DBD-MySQL-2.9003-5 >>>> perl-XML-Parser-2.34-5 >>>> perl-Net-DNS-0.48-1 >>>> perl-Crypt-SSLeay-0.51-5 >>>> perl-NKF-2.04-3 >>>> perl-Archive-Tar-1.08-3 >>>> perl-Frontier-RPC-0.06-38 >>>> perl-Inline-0.44-14 >>>> perl-Filter-1.30-6 >>>> perl-DBI-1.40-5 >>>> perl-libxml-perl-0.07-30 >>>> perl-Digest-HMAC-1.01-13 >>>> perl-Parse-Yapp-1.05-32 >>>> perl-Date-Calc-5.3-9 >>>> perl-MIME-tools-5.417-1 >>>> perl-Text-Kakasi-1.05-11 >>>> perl-DBD-Pg-1.31-6 >>>> perl-Parse-RecDescent-1.94-4 >>>> perl-PDL-2.4.1-5 >>>> perl-libxml-enno-1.02-31 >>>> perl-XML-SAX-0.12-7 >>>> perl-SGMLSpm-1.03ii-14 >>>> perl-suidperl-5.8.5-9.1 >>>> [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} >>>> %{ARCH}\n' perl >>>> perl 5.8.5 i386 >>>> perl 5.8.5 x86_64 >>>> [root@skywalker framadmn]# which perl >>>> /usr/bin/perl >>>> [root@skywalker framadmn]# perl -v >>>> >>>> This is perl, v5.8.5 built for x86_64-linux-thread-multi >>>> >>>> Copyright 1987-2004, Larry Wall >>>> >>>> Perl may be copied only under the terms of either the Artistic License >>>> or the >>>> GNU General Public License, which may be found in the Perl 5 source >>>> kit. >>>> >>>> Complete documentation for Perl, including FAQ lists, should be >>>> found on >>>> this system using `man perl' or `perldoc perl'. If you have access >>>> to the >>>> Internet, point your browser at http://www.perl.com/, the Perl Home >>>> Page. >>>> >>>> [root@skywalker framadmn]# >>>> >>>> >>>> >>>> Julian Field wrote: >>>> >>>>> I think it actually built stuff okay, but has calculated the >>>>> architecture wrongly. >>>>> Please can you send me the output of >>>>> rpm -qi perl >>>>> rpm -qa | grep '^perl' >>>>> rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl >>>>> which perl >>>>> perl -v >>>>> >>>>> For some reason it is picking up both i386 and x86_64 as the >>>>> architecture, when it should just be x86_64 (which is what RHEL4 >>>>> returns). >>>>> >>>>> That bunch of commands should give me an idea what is happening. >>>>> >>>>> Kyle Krieg wrote: >>>>> >>>>>> Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. >>>>>> Thanks for looking into this Julian. I've been using Mailscanner for >>>>>> 2 years now on a RH 8.0 machine with no issues. >>>>>> >>>>>> I've also show the following errors when using the install.sh script. >>>>>> Looks like to me, the install scripts it looking for packages in the >>>>>> i386x86_64 directory, which is not there. All the packages are in >>>>>> either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or >>>>>> /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. >>>>>> >>>>>> There are two outputs below, the first from the rpmbuild -bc >>>>>> perl-Archive-Zip.spec and another from when I try and reinstall >>>>>> MailScanner from the install.sh script. I've cut out most of it and >>>>>> only given the errors that I think are important, but have the whole >>>>>> install log, if you would like it see it. >>>>>> >>>>>> Kyle >>>>>> >>>>>> ************************************************ >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> Julian Field >>>>> www.MailScanner.info >>>>> Buy the MailScanner book at www.MailScanner.info/store >>>>> Professional Support Services at www.MailScanner.biz >>>>> MailScanner thanks transtec Computers for their support >>>>> >>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>>> >>>>> ------------------------ MailScanner list ------------------------ >>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>> 'leave mailscanner' in the body of the email. >>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >>>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> *Support MailScanner development - buy the book off the website!* >>> >>> >>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> Professional Support Services at www.MailScanner.biz >>> MailScanner thanks transtec Computers for their support >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Mon Apr 4 00:28:35 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: Hi All, Is is possible to store archived mail (Archive Mail = /var/spool/MailScanner/archive) in RFC822 format instead of MTA queue files?? Cheers, Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at ALPHA.RBRANA.CO.ID Mon Apr 4 02:43:51 2005 From: ius at ALPHA.RBRANA.CO.ID (ius) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, good morning i was surfing in my maillog this morning, i found this spamassassin timed out. As i remembered i didn't do anything to my machine lately. Can anybody tell me what's wrong w/ my spamassassin ? tail -f /var/log/maillog |grep MailScanner Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: Scanning 1 messages, 14123 bytes Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 messages waiting Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Scanning 1 messages, 5843 bytes Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content Scanning: Starting Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin timed out and was killed, failure 10 of 20 Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content Scanning: Starting Thanks a lot ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 4 08:59:21 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve, What are you doing here? You are a rare sight on this list! :-) Good to see you. Create an empty file for it to fill, then provide the full path of that file in Archive Mail (not just the directory it is in). Steve Freegard wrote: >Hi All, > >Is is possible to store archived mail (Archive Mail >= /var/spool/MailScanner/archive) in RFC822 format instead of MTA queue >files?? > >Cheers, >Steve > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Apr 4 09:08:16 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: Steve and of course you'll have to manage the file yourself, ie weekly/daily/.. stop MS, archive/compress the file, touch the file to create a new file, and restart MS. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Julian Field wrote: > Steve, > > What are you doing here? You are a rare sight on this list! > :-) > Good to see you. > > Create an empty file for it to fill, then provide the full path of that > file in Archive Mail (not just the directory it is in). > > Steve Freegard wrote: > >> Hi All, >> >> Is is possible to store archived mail (Archive Mail >> = /var/spool/MailScanner/archive) in RFC822 format instead of MTA queue >> files?? >> >> Cheers, >> Steve >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Apr 4 09:09:50 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: Ius What version of SA and MS? also any RBL's in the SA config and any extra rules in /etc/mail/spamassassin? what does "spamassassin -p /spam.assassin.prefs.conf -D --lint" give you? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ius wrote: > Hello, good morning > > i was surfing in my maillog this morning, i found this spamassassin > timed out. As i remembered i didn't do anything to my machine lately. > Can anybody tell me what's wrong w/ my spamassassin ? > > tail -f /var/log/maillog |grep MailScanner > Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: Scanning 1 messages, > 14123 bytes > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 messages > waiting > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Scanning 1 messages, > 5843 bytes > Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content Scanning: > Starting > Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin timed out and was > killed, failure 10 of 20 > Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content Scanning: > Starting > > Thanks a lot > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 4 09:16:39 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] But you can insert _DATE_ in it. To quote from MailScanner.conf: # Any of the items above can contain the magic string _DATE_ in them # which will be replaced with the current date in yyyymmdd format. # This will make archive-rolling and maintenance much easier, as you can # guarantee that yesterday's mail archive will not be in active use today. Martin Hepworth wrote: > Steve > > and of course you'll have to manage the file yourself, ie > weekly/daily/.. stop MS, archive/compress the file, touch the file to > create a new file, and restart MS. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Julian Field wrote: > >> Steve, >> >> What are you doing here? You are a rare sight on this list! >> :-) >> Good to see you. >> >> Create an empty file for it to fill, then provide the full path of that >> file in Archive Mail (not just the directory it is in). >> >> Steve Freegard wrote: >> >>> Hi All, >>> >>> Is is possible to store archived mail (Archive Mail >>> = /var/spool/MailScanner/archive) in RFC822 format instead of MTA queue >>> files?? >>> >>> Cheers, >>> Steve >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> MailScanner thanks transtec Computers for their support >> Buy the MailScanner book at www.MailScanner.info/store >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Apr 4 09:26:07 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: aha I knew Julian would have thought of this along the way - I'll get mi coat ;-) Goes off to try 4.40-11 -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Julian Field wrote: > But you can insert _DATE_ in it. To quote from MailScanner.conf: > > # Any of the items above can contain the magic string _DATE_ in them > # which will be replaced with the current date in yyyymmdd format. > # This will make archive-rolling and maintenance much easier, as you can > # guarantee that yesterday's mail archive will not be in active use today. > > > Martin Hepworth wrote: > >> Steve >> >> and of course you'll have to manage the file yourself, ie >> weekly/daily/.. stop MS, archive/compress the file, touch the file to >> create a new file, and restart MS. >> >> -- >> Martin Hepworth >> Snr Systems Administrator >> Solid State Logic >> Tel: +44 (0)1865 842300 >> >> >> Julian Field wrote: >> >>> Steve, >>> >>> What are you doing here? You are a rare sight on this list! >>> :-) >>> Good to see you. >>> >>> Create an empty file for it to fill, then provide the full path of that >>> file in Archive Mail (not just the directory it is in). >>> >>> Steve Freegard wrote: >>> >>>> Hi All, >>>> >>>> Is is possible to store archived mail (Archive Mail >>>> = /var/spool/MailScanner/archive) in RFC822 format instead of MTA queue >>>> files?? >>>> >>>> Cheers, >>>> Steve >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> MailScanner thanks transtec Computers for their support >>> Buy the MailScanner book at www.MailScanner.info/store >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> ********************************************************************** >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they >> are addressed. If you have received this email in error please notify >> the system manager. >> >> This footnote confirms that this email message has been swept >> for the presence of computer viruses and is believed to be clean. >> >> ********************************************************************** >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shb at WIDEAREA.CO.UK Mon Apr 4 09:29:15 2005 From: shb at WIDEAREA.CO.UK (Simon Brock) Date: Thu Jan 12 21:29:14 2006 Subject: SA 3.0.2 and MySQL Message-ID: >Actually with SA 3.0.2 using MySQL has fewer problems, according to the >dev list for it. It seems to rock along too. I have been meaning to look into this myself but I was wondering if MySQL could be used to store a shared Bayes DB? We have a number of MailScanner installations here set up for different reasons and different clients. I was wondering if we used MySQL for the Bayes DB we could share learnt results between machines. Anyone tried that -- with or without MySQL? Regards, Simon. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Apr 4 10:03:53 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: SA 3.0.2 and MySQL Message-ID: Simon I've heard of people doing this on the SA-users list, but I can't remember if anyone has proclaimed to be doing mysql bayes on this list. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Simon Brock wrote: >> Actually with SA 3.0.2 using MySQL has fewer problems, according to the >> dev list for it. It seems to rock along too. > > > I have been meaning to look into this myself but I was wondering if > MySQL could be used to store a shared Bayes DB? > > We have a number of MailScanner installations here set up for > different reasons and different clients. I was wondering if we used > MySQL for the Bayes DB we could share learnt results between > machines. Anyone tried that -- with or without MySQL? > > Regards, > Simon. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Mon Apr 4 10:39:36 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:14 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Simon, I'm running MS 4.39.6 and SA 3.02 on a single server with the bayes and awl stored in MySql 4.1.10a. This works fine and I believe one of the design goals was to enable bayes+awl sharing between multiple servers. I haven't tried using multiple servers myself, but I think it should be no problem. Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 04 April, 2005 11:04 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: SA 3.0.2 and MySQL > > > Simon > > I've heard of people doing this on the SA-users list, but I can't > remember if anyone has proclaimed to be doing mysql bayes on > this list. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Simon Brock wrote: > >> Actually with SA 3.0.2 using MySQL has fewer problems, > according to the > >> dev list for it. It seems to rock along too. > > > > > > I have been meaning to look into this myself but I was wondering if > > MySQL could be used to store a shared Bayes DB? > > > > We have a number of MailScanner installations here set up for > > different reasons and different clients. I was wondering if we used > > MySQL for the Bayes DB we could share learnt results between > > machines. Anyone tried that -- with or without MySQL? > > > > Regards, > > Simon. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Mon Apr 4 12:50:06 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:14 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Simon Brock wrote: >> Actually with SA 3.0.2 using MySQL has fewer problems, according to the >> dev list for it. It seems to rock along too. > > > I have been meaning to look into this myself but I was wondering if > MySQL could be used to store a shared Bayes DB? > > We have a number of MailScanner installations here set up for > different reasons and different clients. I was wondering if we used > MySQL for the Bayes DB we could share learnt results between > machines. Anyone tried that -- with or without MySQL? > > Regards, > Simon. > We've been using it servicewide (for multiple servers, domains and customers) and it is working as expected.. we use blacklist / whitelists to override any specific requests from customers (rather than having different DBs) The migration to MySQL was simple enough, and speed has never been as issue. Also now I have a dedicated server doing just that (and mailwatch) for 3 (and growing) front-end MS servers. Only once in the last 4-5 months has the database stopped responding (the reason is yet unknown). The db size as of now is ~450MB (including data and indexes) and continues to grow, daily volume being in excess of 80K mails. Check the sa-users and sa-dev lists for more information. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Mon Apr 4 14:24:19 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:29:14 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > Simon Brock wrote: > >>> Actually with SA 3.0.2 using MySQL has fewer problems, according to the >>> dev list for it. It seems to rock along too. >> >> >> >> I have been meaning to look into this myself but I was wondering if >> MySQL could be used to store a shared Bayes DB? >> >> We have a number of MailScanner installations here set up for >> different reasons and different clients. I was wondering if we used >> MySQL for the Bayes DB we could share learnt results between >> machines. Anyone tried that -- with or without MySQL? >> >> Regards, >> Simon. >> > > We've been using it servicewide (for multiple servers, domains and > customers) and it is working as expected.. we use blacklist / whitelists > to override any specific requests from customers (rather than having > different DBs) > > The migration to MySQL was simple enough, and speed has never been as > issue. Also now I have a dedicated server doing just that (and > mailwatch) for 3 (and growing) front-end MS servers. Only once in the > last 4-5 months has the database stopped responding (the reason is yet > unknown). The db size as of now is ~450MB (including data and indexes) > and continues to grow, daily volume being in excess of 80K mails. > > Check the sa-users and sa-dev lists for more information. > > - dhawal Mmm that sounds like a treat. Would make a great addition to the new wiki documentation project. Care to write a guide and post it up? > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Mon Apr 4 15:16:56 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Welcome to tha club buddy. What are your machine specs? On Apr 4, 2005 4:09 AM, Martin Hepworth wrote: Ius What version of SA and MS? also any RBL's in the SA config and any extra rules in /etc/mail/spamassassin? what does "spamassassin -p /spam.assassin.prefs.conf -D --lint" give you? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ius wrote: > Hello, good morning > > i was surfing in my maillog this morning, i found this spamassassin > timed out. As i remembered i didn't do anything to my machine lately. > Can anybody tell me what's wrong w/ my spamassassin ? > > tail -f /var/log/maillog |grep MailScanner > Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: Scanning 1 messages, > 14123 bytes > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 messages > waiting > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Scanning 1 messages, > 5843 bytes > Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content Scanning: > Starting > Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin timed out and was > killed, failure 10 of 20 > Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content Scanning: > Starting > > Thanks a lot > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joakim at CEFALK.COM Mon Apr 4 15:26:56 2005 From: joakim at CEFALK.COM (Joakim Cefalk) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have the same problem earlier, try this, It works for me. # If you are using the Bayesian statistics engine on a busy server, # you may well need to force a Bayesian database rebuild and expiry # at regular intervals. This is measures in seconds. # 1 day = 86400 seconds. # To disable this feature set this to 0. Rebuild Bayes Every = 0 # The Bayesian database rebuild and expiry may take a 2 or 3 minutes # to complete. During this time you can either wait, or simply # disable SpamAssassin checks until it has completed. Wait During Bayes Rebuild = no Devon Harding wrote: > Welcome to tha club buddy. What are your machine specs? > > On Apr 4, 2005 4:09 AM, *Martin Hepworth* > > > wrote: > > Ius > > What version of SA and MS? > > also any RBL's in the SA config and any extra rules in > /etc/mail/spamassassin? > > what does "spamassassin -p /spam.assassin.prefs.conf -D > --lint" > give you? > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > ius wrote: > > Hello, good morning > > > > i was surfing in my maillog this morning, i found this spamassassin > > timed out. As i remembered i didn't do anything to my machine > lately. > > Can anybody tell me what's wrong w/ my spamassassin ? > > > > tail -f /var/log/maillog |grep MailScanner > > Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: Scanning 1 > messages, > > 14123 bytes > > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 messages > > waiting > > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Scanning 1 > messages, > > 5843 bytes > > Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content Scanning: > > Starting > > Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin timed out > and was > > killed, failure 10 of 20 > > Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content Scanning: > > Starting > > > > Thanks a lot > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From JHuber at MICROSOURCE.COM Mon Apr 4 16:34:28 2005 From: JHuber at MICROSOURCE.COM (Jeremy Huber) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: How do I get mailscanner to stop scanning attachments, period? Or better yet, how do I get it to stop scoring up a message? I'm getting swamped with complaints about 1) attachments artificially bumping up the score of a message to the point it gets deleted and 2) all the contents of an attachment - usually a word doc - being removed, so that they get a completely empty word doc. Help? Thanks! -- Jeremy Huber SCSA, LCP, CCNA Datacenter Engineer CH2M-Hill Microsource jhuber@microsource.com 303.706.0990 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From anders.andersson at LTKALMAR.SE Mon Apr 4 16:43:32 2005 From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: What about reading mailscanner.conf to begin with :) Look under attachment filename checking > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jeremy Huber > Sent: Monday, April 04, 2005 5:34 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Mailscanner stops scanning attachments?? > > How do I get mailscanner to stop scanning attachments, > period? Or better yet, how do I get it to stop scoring up a > message? I'm getting swamped with complaints about 1) > attachments artificially bumping up the score of a message to > the point it gets deleted and 2) all the contents of an > attachment - usually a word doc - being removed, so that they > get a completely empty word doc. > > Help? > > Thanks! > > -- > Jeremy Huber > SCSA, LCP, CCNA > Datacenter Engineer > CH2M-Hill Microsource > jhuber@microsource.com > 303.706.0990 > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Apr 4 16:56:10 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeremy Huber wrote: >How do I get mailscanner to stop scanning attachments, period? Or >better yet, how do I get it to stop scoring up a message? I'm getting >swamped with complaints about 1) attachments artificially bumping up the >score of a message to the point it gets deleted and 2) all the contents >of an attachment - usually a word doc - being removed, so that they get >a completely empty word doc. > > > Jeremy, Within MS, no attachment bumps the score up or down. Attachments are either left alone or deleted (depending on your setup) but they are not being modified at all unless they were encoded in QP when they should have been in Base64. Are you sure you don't have something else playing tricks on you? Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From billy at PLANETGEEK.BIZ Mon Apr 4 17:42:25 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: I searched the mailscanner archives at http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S = But I could not locate updates information. I also tried to find the recently topic of "Complete Build". I know that there is a ton of information in there but I just could not find it. I know that a lot is talked about what to run it on, however if I may inquire on my setup as Linux is not my environment of expertise. I will try to make my questions short. My main and pretty much only question is what versions should I use? What I have now: 550mhz 384 RAM IDE hard drive (desktop) I will be moving to: Server Dual 600PIII 1024 RAM 3x9.1GB RAID 5 Hard drives What I have now: Redhat 9 (Shrike) MailScanner 4.25 Spamassassin 2.61 MailStats for statistics Running RulesDuJour Running other rules too Sendmail version ?? Sophos virus scanning In question to move to: Should I still use Redhat 9? Seems to work fine MailScanner 4.40.11 Sendmails latest version 8.13.4 Spamassassin latest version 3.0.2 Different rule sets from the web sites ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From vachanta at GMAIL.COM Mon Apr 4 17:54:54 2005 From: vachanta at GMAIL.COM (Venkata Achanta) Date: Thu Jan 12 21:29:14 2006 Subject: MCP checks for outgoing only Message-ID: Julian, Thanks for your responses.Tried by ip,*@domain.com,@domain.com with no luck. Anything else. Is anyone implementing MCP in their enviroment with a similar set up ? Please share your experience. Thanks much, Venkata Achanta On Sun, 3 Apr 2005 11:56:24 +0100, Julian Field wrote: >Try putting in *@domain.com or just domain.com instead of @domain.com. > >Venkata Achanta wrote: > >>Any word on this Julian ? Thanks >> >> >> >>On Thu, 31 Mar 2005 19:07:32 +0100, Venkata Achanta >>wrote: >> >> >> >>>Yes! i do reliase that only the e-mail that contain the MCP material should >>>be forwarded to user@domain.com but the problem i am having is all the >>>incoming and outgoing messages are also being fw'ded to user@domain.com >>>instead of the e-mail that just qualifies for MCP. >>> >>>OR is it not built that way ? >>> >>> >>> >>>From my first e-mail, >> >> >>>>Is Definitely MCP = %rules-dir%/mcp.rules >>>> >>>> >>>>I have this in my %rules-dir%/mcp.rules >>>> >>>>From: @domain.com yes >>>>FromOrTo: default no >>>> >>>> >>>Hope this is clear enough to give you a picture of whats happening or else >>>pleaselet me know i will try again. >>> >>> >>> >>>On Thu, 31 Mar 2005 18:55:51 +0100, Julian Field >>> wrote: >>> >>> >>> >>>>You realise that those MCP actions will deliver the mail to the original >>>>recipient as well as forward it to user@domain.com. >>>> >>>>Venkata Achanta wrote: >>>> >>>> >>>> >>>>>Julian, >>>>> >>>>>I think you didnt see the MCP config in the e-mail. >>>>> >>>>>Yes ! i am aware that spam actions have nothing to do with MCP. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>MCP Actions = deliver user@domain.com >>>>>> >>>>>> >>>>>> >>>>>> >>>>>is what i have in the MCP actions and i still the behaviour mentioned >>>>>earlier. >>>>> >>>>> >>>>> >>>>> >>>>-- >>>>Julian Field >>>>www.MailScanner.info >>>>Buy the MailScanner book at www.MailScanner.info/store >>>>Professional Support Services at www.MailScanner.biz >>>>MailScanner thanks transtec Computers for their support >>>> >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Apr 4 17:55:07 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: Billy I'd buy more RAM, drop a disk and use RAID1 - RAID 5 with only 3 disk will slow the I/O down quite alot. There's lots of nice stuff in SA3.02 so I'd drip feed you existing rules into it, and make sure you have the URI-RBL's turned on too... Also watch out for the ALL_TRUSTED rules in SA 3.02 (see the comment in latest spam.assassin.prefs.conf). -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Billy Pumphrey wrote: > I searched the mailscanner archives at > http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > = > > But I could not locate updates information. I also tried to find the > recently topic of "Complete Build". I know that there is a ton of > information in there but I just could not find it. I know that a lot is > talked about what to run it on, however if I may inquire on my setup as > Linux is not my environment of expertise. I will try to make my questions > short. My main and pretty much only question is what versions should I use? > > What I have now: > 550mhz > 384 RAM > IDE hard drive (desktop) > > I will be moving to: > Server > Dual 600PIII > 1024 RAM > 3x9.1GB RAID 5 Hard drives > > What I have now: > Redhat 9 (Shrike) > MailScanner 4.25 > Spamassassin 2.61 > MailStats for statistics > Running RulesDuJour > Running other rules too > Sendmail version ?? > Sophos virus scanning > > In question to move to: > Should I still use Redhat 9? Seems to work fine > MailScanner 4.40.11 > Sendmails latest version 8.13.4 > Spamassassin latest version 3.0.2 > Different rule sets from the web sites > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at ELKNET.NET Mon Apr 4 18:28:05 2005 From: mailscanner at ELKNET.NET (Alan) Date: Thu Jan 12 21:29:14 2006 Subject: Dangerous Content Scanning inconsistancies Message-ID: Julian, 1) In the MailScanner.conf comments for Dangerous Content Scanning, you mention that setting it to 'no' will disable all content checks except for "Virus Scanning, Allow Partial Messages and Allow External Message Bodies". Unless you do not consider the 'Phishing' test to be one of the 'Dangerous Content' checks, I think it should be added to the list of what is not disabled. I use a ruleset for both Virus scanning and Dangerous Content Scanning so that my customers can request to be removed from filtering. Today I had one of these customers report that they were still getting the Phishing edits done to their messages, even though they were set to a 'no' in the Dangerous Content Scanning ruleset. It was easily fixed by pointing the test for Phishing to the same ruleset, but it would have been nice to have known earlier via the comments that it was one of the tests that was not disabled in the Dangerous Content Scanning setting. 2) Along these lines, I have a feature request for the two settings: "Allow Partial Messages =" and "Allow External Message Bodies =" These two settings use the reverse logic of the other settings, such as "Dangerous Content Scanning", "Find Phishing Fraud", "Virus Scanning". Each of these settings referrs to testing for something bad, and if you want to allow one of these bad things by not looking for it, you set the config to a 'no', typically by using a ruleset. However, "Allow Partial Messages =" and "Allow External Message Bodies =" refer to 'allowing' something bad rather than 'testing', so if you want to allow one of these bad things to happen, you have to set it to a 'yes'. My point is that I can't use a single ruleset, I have to use two, each being the opposite of the other. If I have a customer, say 'jdoe@acme.com' who does not wish to be filtered, I have to put his address in one ruleset with his address set to 'no' for virus, content, and phishing checks, and then also put him in a second ruleset with his address set to 'yes' for 'Partial messages' and 'external message bodies. I then have to maintain two ruleset files. If "Allow Partial Messages =" and "Allow External Message Bodies =" were changed to perhaps "Partial Message Scanning" and "External Message Body Scanning", we could then use the same logic and rulesets as we do for the other settings; the 'yes' would become a 'no'. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Mon Apr 4 18:34:20 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: At 12:55 PM 4/4/2005, you wrote: >Billy > >I'd buy more RAM, drop a disk and use RAID1 - RAID 5 with only 3 disk >will slow the I/O down quite alot. > >There's lots of nice stuff in SA3.02 so I'd drip feed you existing rules >into it, and make sure you have the URI-RBL's turned on too... > >Also watch out for the ALL_TRUSTED rules in SA 3.02 (see the comment in >latest spam.assassin.prefs.conf). >-- >Martin Hepworth > >Billy Pumphrey wrote: >>I searched the mailscanner archives at >>http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S >>= >> >>But I could not locate updates information. I also tried to find the >>recently topic of "Complete Build". I know that there is a ton of >>information in there but I just could not find it. I know that a lot is >>talked about what to run it on, however if I may inquire on my setup as >>Linux is not my environment of expertise. I will try to make my questions >>short. My main and pretty much only question is what versions should I use? >> >>What I have now: >>550mhz >>384 RAM >>IDE hard drive (desktop) >> >>I will be moving to: >>Server >>Dual 600PIII >>1024 RAM >>3x9.1GB RAID 5 Hard drives >> >>What I have now: >>Redhat 9 (Shrike) >>MailScanner 4.25 >>Spamassassin 2.61 >>MailStats for statistics >>Running RulesDuJour >>Running other rules too >>Sendmail version ?? >>Sophos virus scanning >> >>In question to move to: >>Should I still use Redhat 9? Seems to work fine >>MailScanner 4.40.11 >>Sendmails latest version 8.13.4 >>Spamassassin latest version 3.0.2 >>Different rule sets from the web sites Hey Billy, Move to CentOS 3.4 http://www.centos.org. RedHat 9 support has already run out on you, hasn't it? -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Mon Apr 4 18:44:02 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: Hi Jules, On Mon, 2005-04-04 at 08:59 +0100, Julian Field wrote: > Steve, > > What are you doing here? You are a rare sight on this list! > :-) > Good to see you. > I'm always lurking ;-)) Plus, I always get a warm welcome! > Create an empty file for it to fill, then provide the full path of that > file in Archive Mail (not just the directory it is in). If I wanted to create one file per message (by message id) in dated sub- folders (like the quarantine) - is there any reason I couldn't set this as a custom function that creates the file/folder in the archive directory and returns the path/filename?? Ta muchly, Steve. > > Steve Freegard wrote: > > >Hi All, > > > >Is is possible to store archived mail (Archive Mail > >= /var/spool/MailScanner/archive) in RFC822 format instead of MTA queue > >files?? > > > >Cheers, > >Steve > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 4 18:46:49 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Dangerous Content Scanning inconsistancies Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] All good points. Thanks for the comments. Alan wrote: >Julian, > >1) In the MailScanner.conf comments for Dangerous Content Scanning, you >mention that setting it to 'no' will disable all content checks except for >"Virus Scanning, Allow Partial Messages and Allow External Message Bodies". >Unless you do not consider the 'Phishing' test to be one of the 'Dangerous >Content' checks, I think it should be added to the list of what is not >disabled. I use a ruleset for both Virus scanning and Dangerous Content >Scanning so that my customers can request to be removed from filtering. >Today I had one of these customers report that they were still getting the >Phishing edits done to their messages, even though they were set to a 'no' >in the Dangerous Content Scanning ruleset. It was easily fixed by pointing >the test for Phishing to the same ruleset, but it would have been nice to >have known earlier via the comments that it was one of the tests that was >not disabled in the Dangerous Content Scanning setting. > >2) Along these lines, I have a feature request for the two settings: > "Allow Partial Messages =" and "Allow External Message Bodies =" > >These two settings use the reverse logic of the other settings, such as >"Dangerous Content Scanning", "Find Phishing Fraud", "Virus Scanning". Each >of these settings referrs to testing for something bad, and if you want to >allow one of these bad things by not looking for it, you set the config to a >'no', typically by using a ruleset. > >However, "Allow Partial Messages =" and "Allow External Message Bodies =" >refer to 'allowing' something bad rather than 'testing', so if you want to >allow one of these bad things to happen, you have to set it to a 'yes'. > >My point is that I can't use a single ruleset, I have to use two, each being >the opposite of the other. If I have a customer, say 'jdoe@acme.com' who >does not wish to be filtered, I have to put his address in one ruleset with >his address set to 'no' for virus, content, and phishing checks, and then >also put him in a second ruleset with his address set to 'yes' for 'Partial >messages' and 'external message bodies. > >I then have to maintain two ruleset files. > >If "Allow Partial Messages =" and "Allow External Message Bodies =" were >changed to perhaps "Partial Message Scanning" and "External Message Body >Scanning", we could then use the same logic and rulesets as we do for the >other settings; the 'yes' would become a 'no'. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 4 18:48:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Archive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Freegard wrote: >Hi Jules, > >On Mon, 2005-04-04 at 08:59 +0100, Julian Field wrote: > > >>Steve, >> >>What are you doing here? You are a rare sight on this list! >>:-) >>Good to see you. >> >> >> > >I'm always lurking ;-)) Plus, I always get a warm welcome! > > > >>Create an empty file for it to fill, then provide the full path of that >>file in Archive Mail (not just the directory it is in). >> >> > >If I wanted to create one file per message (by message id) in dated sub- >folders (like the quarantine) - is there any reason I couldn't set this >as a custom function that creates the file/folder in the archive >directory and returns the path/filename?? > > No reason at all, should work just fine. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kodak at FRONTIERHOMEMORTGAGE.COM Mon Apr 4 19:09:38 2005 From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki) Date: Thu Jan 12 21:29:14 2006 Subject: [ot] qmail setup temporarily stopping mail forwarded by MailScanner box Message-ID: I've just set up a system where MailScanner running on a RH8 machine will send (via the mailertable) scanned mail to another machine that's running qmail. I know nothing about qmail at this point, but it looks like there's some sort of throttle built into qmail that keeps the MailScanner box from being able to send messages on occasion. When there's a lot of mail coming through the qmail box just stops responding for a while. It will eventually start up again, but by that point there's a lot of stuff in the MailScanner outbound queue and the cycle will repeat for a while until the mail is all out of the queue. I started tracing the qmail setup and didn't get very far before I got confused. I remember when I thought sendmail was confusing and complex and beyond my grasp. How quaintly naive. :) Does anyone know where I should look to find this throttle and turn it off? (The qmail box will only receive mail from the MS box so there's no reason to have it any more.) As always, any help at all is appreciated. --J(K) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Mon Apr 4 19:26:51 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: I had no support contracts or anything. > -----Original Message----- > From: DNSAdmin [mailto:dnsadmin@1BIGTHINK.COM] > Sent: Monday, April 04, 2005 12:34 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Starting from scratch > > At 12:55 PM 4/4/2005, you wrote: > >Billy > > > >I'd buy more RAM, drop a disk and use RAID1 - RAID 5 with only 3 disk > >will slow the I/O down quite alot. > > > >There's lots of nice stuff in SA3.02 so I'd drip feed you existing rules > >into it, and make sure you have the URI-RBL's turned on too... > > > >Also watch out for the ALL_TRUSTED rules in SA 3.02 (see the comment in > >latest spam.assassin.prefs.conf). > >-- > >Martin Hepworth > > > >Billy Pumphrey wrote: > >>I searched the mailscanner archives at > >>http://www.jiscmail.ac.uk/cgi- > bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > >>= > >> > >>But I could not locate updates information. I also tried to find the > >>recently topic of "Complete Build". I know that there is a ton of > >>information in there but I just could not find it. I know that a lot is > >>talked about what to run it on, however if I may inquire on my setup as > >>Linux is not my environment of expertise. I will try to make my > questions > >>short. My main and pretty much only question is what versions should I > use? > >> > >>What I have now: > >>550mhz > >>384 RAM > >>IDE hard drive (desktop) > >> > >>I will be moving to: > >>Server > >>Dual 600PIII > >>1024 RAM > >>3x9.1GB RAID 5 Hard drives > >> > >>What I have now: > >>Redhat 9 (Shrike) > >>MailScanner 4.25 > >>Spamassassin 2.61 > >>MailStats for statistics > >>Running RulesDuJour > >>Running other rules too > >>Sendmail version ?? > >>Sophos virus scanning > >> > >>In question to move to: > >>Should I still use Redhat 9? Seems to work fine > >>MailScanner 4.40.11 > >>Sendmails latest version 8.13.4 > >>Spamassassin latest version 3.0.2 > >>Different rule sets from the web sites > > Hey Billy, > > Move to CentOS 3.4 http://www.centos.org. RedHat 9 support has already run > out on you, hasn't it? > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > http://www.sng.ecs.soton.ac.uk/mailscanner/ > Configuration by Glenn Parsons dnsadmin-at-1bigthink.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Mon Apr 4 19:28:14 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: Thank you for the reply. 1024 is the max on it. I only process about 2400 messages daily so 1024 should be good hey? I will go RAID1 then. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: Monday, April 04, 2005 11:55 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Starting from scratch > > Billy > > I'd buy more RAM, drop a disk and use RAID1 - RAID 5 with only 3 disk > will slow the I/O down quite alot. > > There's lots of nice stuff in SA3.02 so I'd drip feed you existing rules > into it, and make sure you have the URI-RBL's turned on too... > > Also watch out for the ALL_TRUSTED rules in SA 3.02 (see the comment in > latest spam.assassin.prefs.conf). > > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Billy Pumphrey wrote: > > I searched the mailscanner archives at > > http://www.jiscmail.ac.uk/cgi- > bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > > = > > > > But I could not locate updates information. I also tried to find the > > recently topic of "Complete Build". I know that there is a ton of > > information in there but I just could not find it. I know that a lot is > > talked about what to run it on, however if I may inquire on my setup as > > Linux is not my environment of expertise. I will try to make my > questions > > short. My main and pretty much only question is what versions should I > use? > > > > What I have now: > > 550mhz > > 384 RAM > > IDE hard drive (desktop) > > > > I will be moving to: > > Server > > Dual 600PIII > > 1024 RAM > > 3x9.1GB RAID 5 Hard drives > > > > What I have now: > > Redhat 9 (Shrike) > > MailScanner 4.25 > > Spamassassin 2.61 > > MailStats for statistics > > Running RulesDuJour > > Running other rules too > > Sendmail version ?? > > Sophos virus scanning > > > > In question to move to: > > Should I still use Redhat 9? Seems to work fine > > MailScanner 4.40.11 > > Sendmails latest version 8.13.4 > > Spamassassin latest version 3.0.2 > > Different rule sets from the web sites > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Mon Apr 4 19:49:47 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:14 2006 Subject: qmail setup temporarily stopping mail forwarded by MailScanner box Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jason Balicki writes: > I've just set up a system where MailScanner > running on a RH8 machine will send (via the > mailertable) scanned mail to another machine > that's running qmail. > > I know nothing about qmail at this point, but > it looks like there's some sort of throttle > built into qmail that keeps the MailScanner > box from being able to send messages on occasion. > > When there's a lot of mail coming through > the qmail box just stops responding for a > while. It will eventually start up again, > but by that point there's a lot of stuff in > the MailScanner outbound queue and the cycle > will repeat for a while until the mail is > all out of the queue. > > I started tracing the qmail setup and didn't > get very far before I got confused. I > remember when I thought sendmail was confusing > and complex and beyond my grasp. How quaintly > naive. :) > > Does anyone know where I should look to find > this throttle and turn it off? (The qmail > box will only receive mail from the MS box > so there's no reason to have it any more.) > > As always, any help at all is appreciated. > > --J(K) do you tarpitting enabled in qmail (some files like tarpit* in /var/qmail/control)? if yes, you could control it via the tcp.smtp file for specific ip addressess Use the following env variables in tcp.smtp: TARPITCOUNT=0 TARPITDELAY=0 let us know if it works. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 4 20:28:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] 1024MB of RAM should be fine. I recommend 512MB per CPU. With only 2400 messages per day it should happily tick along pretty quietly. Billy Pumphrey wrote: >Thank you for the reply. 1024 is the max on it. I only process about 2400 >messages daily so 1024 should be good hey? I will go RAID1 then. > > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: Monday, April 04, 2005 11:55 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Starting from scratch >> >>Billy >> >>I'd buy more RAM, drop a disk and use RAID1 - RAID 5 with only 3 disk >>will slow the I/O down quite alot. >> >>There's lots of nice stuff in SA3.02 so I'd drip feed you existing rules >>into it, and make sure you have the URI-RBL's turned on too... >> >>Also watch out for the ALL_TRUSTED rules in SA 3.02 (see the comment in >>latest spam.assassin.prefs.conf). >> >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Billy Pumphrey wrote: >> >> >>>I searched the mailscanner archives at >>>http://www.jiscmail.ac.uk/cgi- >>> >>> >>bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S >> >> >>>= >>> >>>But I could not locate updates information. I also tried to find the >>>recently topic of "Complete Build". I know that there is a ton of >>>information in there but I just could not find it. I know that a lot is >>>talked about what to run it on, however if I may inquire on my setup as >>>Linux is not my environment of expertise. I will try to make my >>> >>> >>questions >> >> >>>short. My main and pretty much only question is what versions should I >>> >>> >>use? >> >> >>>What I have now: >>>550mhz >>>384 RAM >>>IDE hard drive (desktop) >>> >>>I will be moving to: >>>Server >>>Dual 600PIII >>>1024 RAM >>>3x9.1GB RAID 5 Hard drives >>> >>>What I have now: >>>Redhat 9 (Shrike) >>>MailScanner 4.25 >>>Spamassassin 2.61 >>>MailStats for statistics >>>Running RulesDuJour >>>Running other rules too >>>Sendmail version ?? >>>Sophos virus scanning >>> >>>In question to move to: >>>Should I still use Redhat 9? Seems to work fine >>>MailScanner 4.40.11 >>>Sendmails latest version 8.13.4 >>>Spamassassin latest version 3.0.2 >>>Different rule sets from the web sites >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jhuber at MICROSOURCE.COM Mon Apr 4 22:16:22 2005 From: jhuber at MICROSOURCE.COM (Jeremy Huber) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: On Mon, 4 Apr 2005 11:56:10 -0400, Denis Beauchemin wrote: >Within MS, no attachment bumps the score up or down. Attachments are >either left alone or deleted (depending on your setup) but they are not >being modified at all unless they were encoded in QP when they should >have been in Base64. > >Are you sure you don't have something else playing tricks on you? No, I'm not certain at all (hence the begging nature of the email :) ). However, I do know that attachments ARE causing the score to be modified. An example from today.. This email was an HTML email, that happened to have a TIFF attached, and it triggered all these rules: Score Matching Rule Description 0.00 HTML_MESSAGE HTML included in message 1.00 MANGLED_COST mangled cost 1.00 MANGLED_DEALS mangled deal(s) 1.00 MANGLED_DIET mangled diet 1.00 MANGLED_GOOD mangled good 1.00 MANGLED_LIPS mangled lips 1.00 MANGLED_LOW mangled low 1.00 MANGLED_MEDS mangled med(s) 1.00 MANGLED_PILL mangled pill(s) 1.00 MANGLED_SAVELE mangled save sale 1.00 MANGLED_SEX mangled sex(ual)(ity) 1.50 MIME_ASCII0 Message body contains ASCII-0 character 0.50 MIME_BAD_LINEBREAK Message body with fishy line breaks 0.80 MIME_MISSING_BOUNDARY MIME section missing boundary 0.26 UPPERCASE_25_50 message body is 25-50% uppercase I had the user resend without the attachment, and it only triggered the HTML_MESSAGE rule. The other issue with data being pulled out of word docs I can't verify.. it's only heresay from a customer, but when he sends me the end result, it appears as a 64B .doc file and a winmail.dat file, so I suspect that MS (or something else) is messing up the attachment. I've turned off TNEF to see if that resolves that one. I'm not discounting at all the fact that I've probably misconfigured something, but I'm at a loss right now. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 4 22:34:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jeremy Huber wrote: >On Mon, 4 Apr 2005 11:56:10 -0400, Denis Beauchemin > wrote: > > > >>Within MS, no attachment bumps the score up or down. Attachments are >>either left alone or deleted (depending on your setup) but they are not >>being modified at all unless they were encoded in QP when they should >>have been in Base64. >> >>Are you sure you don't have something else playing tricks on you? >> >> > >No, I'm not certain at all (hence the begging nature of the email :) ). >However, I do know that attachments ARE causing the score to be modified. >An example from today.. This email was an HTML email, that happened to have >a TIFF attached, and it triggered all these rules: > >Score Matching Rule Description >0.00 HTML_MESSAGE HTML included in message >1.00 MANGLED_COST mangled cost >1.00 MANGLED_DEALS mangled deal(s) >1.00 MANGLED_DIET mangled diet >1.00 MANGLED_GOOD mangled good >1.00 MANGLED_LIPS mangled lips >1.00 MANGLED_LOW mangled low >1.00 MANGLED_MEDS mangled med(s) >1.00 MANGLED_PILL mangled pill(s) >1.00 MANGLED_SAVELE mangled save sale >1.00 MANGLED_SEX mangled sex(ual)(ity) >1.50 MIME_ASCII0 Message body contains ASCII-0 character >0.50 MIME_BAD_LINEBREAK Message body with fishy line breaks >0.80 MIME_MISSING_BOUNDARY MIME section missing boundary >0.26 UPPERCASE_25_50 message body is 25-50% uppercase > >I had the user resend without the attachment, and it only triggered the >HTML_MESSAGE rule. > > What have you set to generate that report? Exactly how? The answer may tell us important things about your setup. >The other issue with data being pulled out of word docs I can't verify.. >it's only heresay from a customer, but when he sends me the end result, it >appears as a 64B .doc file and a winmail.dat file, so I suspect that MS (or >something else) is messing up the attachment. I've turned off TNEF to see >if that resolves that one. > > MailScanner does not replace winmail.dat files with the files they contain. It unpacks them to virus scan and do filename/type checks, but you won't ever get a winmail.dat file as well as a doc file attached to the same message. What do you think is adding the doc? -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Mon Apr 4 22:49:47 2005 From: pete at ENITECH.COM.AU (Peter Russell) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I reckon centos 4.0 (which is just rhel without the license and groovy installer) is the go, or buy a red hat license and use Red Hat Proffessional 4.0 Red Hat 9 is too old now... Billy Pumphrey wrote: > I searched the mailscanner archives at > http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > = > > But I could not locate updates information. I also tried to find the > recently topic of "Complete Build". I know that there is a ton of > information in there but I just could not find it. I know that a lot is > talked about what to run it on, however if I may inquire on my setup as > Linux is not my environment of expertise. I will try to make my questions > short. My main and pretty much only question is what versions should I use? > > What I have now: > 550mhz > 384 RAM > IDE hard drive (desktop) > > I will be moving to: > Server > Dual 600PIII > 1024 RAM > 3x9.1GB RAID 5 Hard drives > > What I have now: > Redhat 9 (Shrike) > MailScanner 4.25 > Spamassassin 2.61 > MailStats for statistics > Running RulesDuJour > Running other rules too > Sendmail version ?? > Sophos virus scanning > > In question to move to: > Should I still use Redhat 9? Seems to work fine > MailScanner 4.40.11 > Sendmails latest version 8.13.4 > Spamassassin latest version 3.0.2 > Different rule sets from the web sites > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jhuber at MICROSOURCE.COM Mon Apr 4 22:56:47 2005 From: jhuber at MICROSOURCE.COM (Jeremy Huber) Date: Thu Jan 12 21:29:14 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: On Mon, 4 Apr 2005 22:34:37 +0100, Julian Field wrote: >What have you set to generate that report? Exactly how? The answer may >tell us important things about your setup. I'm using MS 4.38.9 (via RPM), with Mailwatch 0.51 and clamav and bitdefender for AV scanners. Mailwatch is what gave me that list of triggered rules. >MailScanner does not replace winmail.dat files with the files they >contain. It unpacks them to virus scan and do filename/type checks, but >you won't ever get a winmail.dat file as well as a doc file attached to >the same message. > >What do you think is adding the doc? I've got an email off to the person seeing it to find out more. All I know is that they're resume's being emailed out, and "everyone else gets the document correctly." I know that doesn't mean much. I know the last time I had a problem with winmail.dat, it turned out to be a problem with the mailer client that was doing it, not MS. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Tue Apr 5 00:09:20 2005 From: pete at ENITECH.COM.AU (Peter Russell) Date: Thu Jan 12 21:29:14 2006 Subject: OT: mailscanner & oom killer on fc2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Any further info on this? I am still getting this problem on RHEL4. :( This event didnt give me the oom error, but the machine ran out of memory and used all swap and almost froze. Restarting the MS service doesnt fix it, a restart does :( Vlad Mazek wrote: > I doubt it, they don't use Ensim (or any other control panel for that > matter). What could possibly cause the MailScanner process to ping the > processor at 99% for over 6 minutes? > > I have found a number of issues with sendmail and oom killer, one with > MailScanner/FC3 specifically. However, none of those were ever answered > which is why I decided to post here. > > -Vlad > > Martin Hepworth wrote: > >> Hmm I wonder if this related to the Ensim issue as well. Quite different >> versions of MS, but both on FC.. > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kodak at FRONTIERHOMEMORTGAGE.COM Tue Apr 5 00:19:14 2005 From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki) Date: Thu Jan 12 21:29:14 2006 Subject: qmail setup temporarily stopping mail forwarded by MailScanner box Message-ID: Dhawal Doshy <> wrote: > do you tarpitting enabled in qmail (some files like tarpit* in > /var/qmail/control)? if yes, you could control it via the tcp.smtp > file for specific ip addressess I couldn't find any tarpit* files in /var/qmail/control. (Nor anywhere on the system if the slocate db is to be trusted.) I did go ahead and add the variables below into tcp.smtp, but the traffic is too low right now to test (of course.) I'll keep an eye on it, but right now there's nothing to report. Thanks for the tip and I hope that's the answer. > Use the following env variables in tcp.smtp: > TARPITCOUNT=0 > TARPITDELAY=0 --J(K) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at ALPHA.RBRANA.CO.ID Tue Apr 5 02:30:02 2005 From: ius at ALPHA.RBRANA.CO.ID (ius) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joakim Cefalk wrote: > I have the same problem earlier, try this, It works for me. > > # If you are using the Bayesian statistics engine on a busy server, > # you may well need to force a Bayesian database rebuild and expiry > # at regular intervals. This is measures in seconds. > # 1 day = 86400 seconds. > # To disable this feature set this to 0. > Rebuild Bayes Every = 0 > > # The Bayesian database rebuild and expiry may take a 2 or 3 minutes > # to complete. During this time you can either wait, or simply > # disable SpamAssassin checks until it has completed. > Wait During Bayes Rebuild = no > > Devon Harding wrote: > >> Welcome to tha club buddy. What are your machine specs? >> >> On Apr 4, 2005 4:09 AM, *Martin Hepworth* >> > >> wrote: >> >> Ius >> >> What version of SA and MS? >> >> also any RBL's in the SA config and any extra rules in >> /etc/mail/spamassassin? >> >> what does "spamassassin -p /spam.assassin.prefs.conf -D >> --lint" >> give you? >> >> -- >> Martin Hepworth >> Snr Systems Administrator >> Solid State Logic >> Tel: +44 (0)1865 842300 >> >> >> ius wrote: >> > Hello, good morning >> > >> > i was surfing in my maillog this morning, i found this >> spamassassin >> > timed out. As i remembered i didn't do anything to my machine >> lately. >> > Can anybody tell me what's wrong w/ my spamassassin ? >> > >> > tail -f /var/log/maillog |grep MailScanner >> > Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: Scanning 1 >> messages, >> > 14123 bytes >> > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 >> messages >> > waiting >> > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Scanning 1 >> messages, >> > 5843 bytes >> > Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content >> Scanning: >> > Starting >> > Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin timed out >> and was >> > killed, failure 10 of 20 >> > Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content >> Scanning: >> > Starting >> > >> > Thanks a lot >> > >> > ------------------------ MailScanner list ------------------------ >> > To unsubscribe, email jiscmail@jiscmail.ac.uk >> with the words: >> > 'leave mailscanner' in the body of the email. >> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> > >> > Support MailScanner development - buy the book off the website! >> >> >> ********************************************************************** >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they >> are addressed. If you have received this email in error please >> notify >> the system manager. >> >> This footnote confirms that this email message has been swept >> for the presence of computer viruses and is believed to be clean. >> >> >> ********************************************************************** >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk >> with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! I've already set those setting same as yours. But won't help either. And then i go to /root/.spamassassin/ and set all the files to 0 (zero) size. And go to /etc/MailScanner/bayes/ and do the same way to the files size. and do the MailScanner reload. It works!., no more spamassassin timed out. I've put my eyes on screen log for 1 hour now, no more timed out. i'm using spamassassin 3.02, MS 4.40.11 and mailwatch Thanks ius ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Tue Apr 5 03:43:59 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] When you say you set the files to zero, do you mean you remove them, then touch them (touch bayes_toks)? -Devon On Apr 4, 2005 9:30 PM, ius wrote: Joakim Cefalk wrote: > I have the same problem earlier, try this, It works for me. > > # If you are using the Bayesian statistics engine on a busy server, > # you may well need to force a Bayesian database rebuild and expiry > # at regular intervals. This is measures in seconds. > # 1 day = 86400 seconds. > # To disable this feature set this to 0. > Rebuild Bayes Every = 0 > > # The Bayesian database rebuild and expiry may take a 2 or 3 minutes > # to complete. During this time you can either wait, or simply > # disable SpamAssassin checks until it has completed. > Wait During Bayes Rebuild = no > > Devon Harding wrote: > >> Welcome to tha club buddy. What are your machine specs? >> >> On Apr 4, 2005 4:09 AM, *Martin Hepworth* >> > >> wrote: >> >> Ius >> >> What version of SA and MS? >> >> also any RBL's in the SA config and any extra rules in >> /etc/mail/spamassassin? >> >> what does "spamassassin -p /spam.assassin.prefs.conf -D >> --lint" >> give you? >> >> -- >> Martin Hepworth >> Snr Systems Administrator >> Solid State Logic >> Tel: +44 (0)1865 842300 >> >> >> ius wrote: >> > Hello, good morning >> > >> > i was surfing in my maillog this morning, i found this >> spamassassin >> > timed out. As i remembered i didn't do anything to my machine >> lately. >> > Can anybody tell me what's wrong w/ my spamassassin ? >> > >> > tail -f /var/log/maillog |grep MailScanner >> > Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: Scanning 1 >> messages, >> > 14123 bytes >> > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 >> messages >> > waiting >> > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Scanning 1 >> messages, >> > 5843 bytes >> > Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content >> Scanning: >> > Starting >> > Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin timed out >> and was >> > killed, failure 10 of 20 >> > Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content >> Scanning: >> > Starting >> > >> > Thanks a lot >> > >> > ------------------------ MailScanner list ------------------------ >> > To unsubscribe, email jiscmail@jiscmail.ac.uk >> with the words: >> > 'leave mailscanner' in the body of the email. >> > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> > >> > Support MailScanner development - buy the book off the website! >> >> >> ********************************************************************** >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they >> are addressed. If you have received this email in error please >> notify >> the system manager. >> >> This footnote confirms that this email message has been swept >> for the presence of computer viruses and is believed to be clean. >> >> >> ********************************************************************** >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk >> with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! I've already set those setting same as yours. But won't help either. And then i go to /root/.spamassassin/ and set all the files to 0 (zero) size. And go to /etc/MailScanner/bayes/ and do the same way to the files size. and do the MailScanner reload. It works!., no more spamassassin timed out. I've put my eyes on screen log for 1 hour now, no more timed out. i'm using spamassassin 3.02, MS 4.40.11 and mailwatch Thanks ius ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at ALPHA.RBRANA.CO.ID Tue Apr 5 07:44:44 2005 From: ius at ALPHA.RBRANA.CO.ID (ius) Date: Thu Jan 12 21:29:14 2006 Subject: SpamAssassin timed out Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Devon Harding wrote: > When you say you set the files to zero, do you mean you remove them, > then touch them (touch bayes_toks)? > > -Devon > > On Apr 4, 2005 9:30 PM, *ius* > wrote: > > Joakim Cefalk wrote: > > > I have the same problem earlier, try this, It works for me. > > > > # If you are using the Bayesian statistics engine on a busy server, > > # you may well need to force a Bayesian database rebuild and expiry > > # at regular intervals. This is measures in seconds. > > # 1 day = 86400 seconds. > > # To disable this feature set this to 0. > > Rebuild Bayes Every = 0 > > > > # The Bayesian database rebuild and expiry may take a 2 or 3 minutes > > # to complete. During this time you can either wait, or simply > > # disable SpamAssassin checks until it has completed. > > Wait During Bayes Rebuild = no > > > > Devon Harding wrote: > > > >> Welcome to tha club buddy. What are your machine specs? > >> > >> On Apr 4, 2005 4:09 AM, *Martin Hepworth* > >> > >> > >> wrote: > >> > >> Ius > >> > >> What version of SA and MS? > >> > >> also any RBL's in the SA config and any extra rules in > >> /etc/mail/spamassassin? > >> > >> what does "spamassassin -p > /spam.assassin.prefs.conf -D > >> --lint" > >> give you? > >> > >> -- > >> Martin Hepworth > >> Snr Systems Administrator > >> Solid State Logic > >> Tel: +44 (0)1865 842300 > >> > >> > >> ius wrote: > >> > Hello, good morning > >> > > >> > i was surfing in my maillog this morning, i found this > >> spamassassin > >> > timed out. As i remembered i didn't do anything to my machine > >> lately. > >> > Can anybody tell me what's wrong w/ my spamassassin ? > >> > > >> > tail -f /var/log/maillog |grep MailScanner > >> > Apr 4 08:18:18 sigma MailScanner[1878]: New Batch: > Scanning 1 > >> messages, > >> > 14123 bytes > >> > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: Found 2 > >> messages > >> > waiting > >> > Apr 4 08:18:31 sigma MailScanner[1913]: New Batch: > Scanning 1 > >> messages, > >> > 5843 bytes > >> > Apr 4 08:18:59 sigma MailScanner[1913]: Virus and Content > >> Scanning: > >> > Starting > >> > Apr 4 08:18:59 sigma MailScanner[1878]: SpamAssassin > timed out > >> and was > >> > killed, failure 10 of 20 > >> > Apr 4 08:19:05 sigma MailScanner[1878]: Virus and Content > >> Scanning: > >> > Starting > >> > > >> > Thanks a lot > >> > > >> > ------------------------ MailScanner list > ------------------------ > >> > To unsubscribe, email jiscmail@jiscmail.ac.uk > > >> > with the words: > >> > 'leave mailscanner' in the body of the email. > >> > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and > >> > the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > > >> > Support MailScanner development - buy the book off the > website! > >> > >> > >> > ********************************************************************** > >> > >> This email and any files transmitted with it are > confidential and > >> intended solely for the use of the individual or entity to > whom they > >> are addressed. If you have received this email in error please > >> notify > >> the system manager. > >> > >> This footnote confirms that this email message has been swept > >> for the presence of computer viruses and is believed to be > clean. > >> > >> > >> > ********************************************************************** > >> > >> ------------------------ MailScanner list > ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk > > >> > with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and > >> the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > >> and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> *Support MailScanner development - buy the book off the website!* > > > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > I've already set those setting same as yours. But won't help > either. And > then i go to /root/.spamassassin/ and set all the files to 0 (zero) > size. And go to /etc/MailScanner/bayes/ and do the same way to the > files > size. and do the MailScanner reload. It works!., no more spamassassin > timed out. I've put my eyes on screen log for 1 hour now, no more > timed out. > > i'm using spamassassin 3.02, MS 4.40.11 and mailwatch > > Thanks > ius > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* yes .. i just do cat > file, then ^C. Then the file gone empty. I'm not sure this gets rid the timed out problem, but works for me. -ius- ps : sorry, my english so bad :-( ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Apr 5 09:16:11 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:14 2006 Subject: qmail setup temporarily stopping mail forwarded by MailScanner box Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jason Balicki wrote: > Dhawal Doshy <> wrote: > >>do you tarpitting enabled in qmail (some files like tarpit* in >>/var/qmail/control)? if yes, you could control it via the tcp.smtp >>file for specific ip addressess > > > I couldn't find any tarpit* files in /var/qmail/control. > (Nor anywhere on the system if the slocate db is to > be trusted.) > > I did go ahead and add the variables below into > tcp.smtp, but the traffic is too low right now > to test (of course.) > > I'll keep an eye on it, but right now there's > nothing to report. > > Thanks for the tip and I hope that's the answer. > > >>Use the following env variables in tcp.smtp: >>TARPITCOUNT=0 >>TARPITDELAY=0 > > > --J(K) > One more way to check if tarpit has been compiled into qmail is this: # grep tarpit /var/qmail/bin/qmail-smtpd Binary file /var/qmail/bin/qmail-smtpd matches Here's a way to stop using it: # cat /etc/tcp.smtp MailScanner_IP:allow,RELAYCLIENT="",TARPITCOUNT=0,TARPITDELAY=0 :deny And finally make sure, your /var/qmail/supervise/qmail-smtpd/run is using '-x /etc/tcp.smtp.cdb' via tcpserver. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From res at AUSICS.NET Tue Apr 5 09:58:01 2005 From: res at AUSICS.NET (Res) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: On Tue, 5 Apr 2005, Peter Russell wrote: > I reckon centos 4.0 (which is just rhel without the license and groovy > installer) is the go, or buy a red hat license and use Red Hat > Proffessional 4.0 > > Red Hat 9 is too old now... Its tried and proven, we have RH9 boxes with manual kernel upgrades when security dictates, they are unbreakable, centos has had to be rebooted a few times, I have no intention of changing my mail servers off RH9 because i couldnt break the damn thing if i tried its so stable. > > Billy Pumphrey wrote: >> I searched the mailscanner archives at >> http://www.jiscmail.ac.uk/cgi-bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S >> = >> >> But I could not locate updates information. I also tried to find the >> recently topic of "Complete Build". I know that there is a ton of >> information in there but I just could not find it. I know that a lot is >> talked about what to run it on, however if I may inquire on my setup as >> Linux is not my environment of expertise. I will try to make my questions >> short. My main and pretty much only question is what versions should I >> use? >> >> What I have now: >> 550mhz >> 384 RAM >> IDE hard drive (desktop) >> >> I will be moving to: >> Server >> Dual 600PIII >> 1024 RAM >> 3x9.1GB RAID 5 Hard drives >> >> What I have now: >> Redhat 9 (Shrike) >> MailScanner 4.25 >> Spamassassin 2.61 >> MailStats for statistics >> Running RulesDuJour >> Running other rules too >> Sendmail version ?? >> Sophos virus scanning >> >> In question to move to: >> Should I still use Redhat 9? Seems to work fine >> MailScanner 4.40.11 >> Sendmails latest version 8.13.4 >> Spamassassin latest version 3.0.2 >> Different rule sets from the web sites >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Cheers Res ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 5 09:56:08 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: In that case should work very well... my 2.8Ghx Piv(HT) with 1.5GB DDR RAM does around 3000 messages per day and rarely goes above 0.2 load av..(plus it's a SMB file server for my AV update files) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Billy Pumphrey wrote: > Thank you for the reply. 1024 is the max on it. I only process about 2400 > messages daily so 1024 should be good hey? I will go RAID1 then. > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: Monday, April 04, 2005 11:55 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Starting from scratch >> >>Billy >> >>I'd buy more RAM, drop a disk and use RAID1 - RAID 5 with only 3 disk >>will slow the I/O down quite alot. >> >>There's lots of nice stuff in SA3.02 so I'd drip feed you existing rules >>into it, and make sure you have the URI-RBL's turned on too... >> >>Also watch out for the ALL_TRUSTED rules in SA 3.02 (see the comment in >>latest spam.assassin.prefs.conf). >> >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Billy Pumphrey wrote: >> >>>I searched the mailscanner archives at >>>http://www.jiscmail.ac.uk/cgi- >> >>bin/wa.exe?S1=mailscanner&D=0&T=0&H=0&O=T&F=&S >> >>>= >>> >>>But I could not locate updates information. I also tried to find the >>>recently topic of "Complete Build". I know that there is a ton of >>>information in there but I just could not find it. I know that a lot is >>>talked about what to run it on, however if I may inquire on my setup as >>>Linux is not my environment of expertise. I will try to make my >> >>questions >> >>>short. My main and pretty much only question is what versions should I >> >>use? >> >>>What I have now: >>>550mhz >>>384 RAM >>>IDE hard drive (desktop) >>> >>>I will be moving to: >>>Server >>>Dual 600PIII >>>1024 RAM >>>3x9.1GB RAID 5 Hard drives >>> >>>What I have now: >>>Redhat 9 (Shrike) >>>MailScanner 4.25 >>>Spamassassin 2.61 >>>MailStats for statistics >>>Running RulesDuJour >>>Running other rules too >>>Sendmail version ?? >>>Sophos virus scanning >>> >>>In question to move to: >>>Should I still use Redhat 9? Seems to work fine >>>MailScanner 4.40.11 >>>Sendmails latest version 8.13.4 >>>Spamassassin latest version 3.0.2 >>>Different rule sets from the web sites >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From garry at GLENDOWN.DE Tue Apr 5 12:07:19 2005 From: garry at GLENDOWN.DE (Garry Glendown) Date: Thu Jan 12 21:29:14 2006 Subject: Lots of Spam gets through ... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lately, I've noticed a lot of spam mails getting through (though being flagged by Thunderbird) that only score around 3.x and 4.x points - most of these spams contain pipe signs (|) instead of lowercase "L" ... some 50% of the "l" seem to be replaced ... Anybody have some rules against this? Tnx, -gg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 5 12:06:33 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: Lots of Spam gets through ... Message-ID: Gary what version of SA and what extra rules from SARE etc in /etc/mail/spamassassin ?? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Garry Glendown wrote: > Lately, I've noticed a lot of spam mails getting through (though being > flagged by Thunderbird) that only score around 3.x and 4.x points - most > of these spams contain pipe signs (|) instead of lowercase "L" ... some > 50% of the "l" seem to be replaced ... > > Anybody have some rules against this? > > Tnx, -gg > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From garry at GLENDOWN.DE Tue Apr 5 12:40:54 2005 From: garry at GLENDOWN.DE (Garry Glendown) Date: Thu Jan 12 21:29:14 2006 Subject: Lots of Spam gets through ... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Gary > > what version of SA and what extra rules from SARE etc in > /etc/mail/spamassassin ?? I'm running 3.02, 70_sare_bayes_poison_nxm.cf 70_sare_evilnum0.cf 70_sare_random.cf -gg ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 5 13:10:02 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:14 2006 Subject: Lots of Spam gets through ... Message-ID: Glen try the mangled.cf from the 'other rules' section I've got just all the rules mentioned in www.rulesemporium.com installed, apart from the high risk ones. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Garry Glendown wrote: > Martin Hepworth wrote: > >> Gary >> >> what version of SA and what extra rules from SARE etc in >> /etc/mail/spamassassin ?? > > > I'm running 3.02, > > 70_sare_bayes_poison_nxm.cf 70_sare_evilnum0.cf 70_sare_random.cf > > -gg > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ivessm at softecusa.com Tue Apr 5 13:41:10 2005 From: ivessm at softecusa.com (Stewart M. Ives) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ref OS question: I've been using FC2 without any problems what so ever. up2date works and keeps the box updated. I also run MailWatch on it. Great program to get an overall look at what is coming into the box and to keep records. If you ever needed something to justify your job MailWatch will do it for you. It will show what is happening and make you shine in that it is all being taken care of. I'll probably move up to FC4 a while after it is released. stew ---------- Original Message ----------- From: Res To: MAILSCANNER@JISCMAIL.AC.UK Sent: Tue, 5 Apr 2005 18:58:01 +1000 Subject: Re: Starting from scratch > On Tue, 5 Apr 2005, Peter Russell wrote: > > > I reckon centos 4.0 (which is just rhel without the license and groovy > > installer) is the go, or buy a red hat license and use Red Hat > > Proffessional 4.0 > > > > Red Hat 9 is too old now... > > Its tried and proven, we have RH9 boxes with manual kernel upgrades when > security dictates, they are unbreakable, centos has had to be > rebooted a few times, I have no intention of changing my mail > servers off RH9 because i couldnt break the damn thing if i tried > its so stable. > > > > > Billy Pumphrey wrote: > >> I searched the mailscanner archives at > >> http://www.jiscmail.ac.uk/cgi-bin/wa.exe? S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > >> = > >> > >> But I could not locate updates information. I also tried to find the > >> recently topic of "Complete Build". I know that there is a ton of > >> information in there but I just could not find it. I know that a lot is > >> talked about what to run it on, however if I may inquire on my setup as > >> Linux is not my environment of expertise. I will try to make my questions > >> short. My main and pretty much only question is what versions should I > >> use? > >> > >> What I have now: > >> 550mhz > >> 384 RAM > >> IDE hard drive (desktop) > >> > >> I will be moving to: > >> Server > >> Dual 600PIII > >> 1024 RAM > >> 3x9.1GB RAID 5 Hard drives > >> > >> What I have now: > >> Redhat 9 (Shrike) > >> MailScanner 4.25 > >> Spamassassin 2.61 > >> MailStats for statistics > >> Running RulesDuJour > >> Running other rules too > >> Sendmail version ?? > >> Sophos virus scanning > >> > >> In question to move to: > >> Should I still use Redhat 9? Seems to work fine > >> MailScanner 4.40.11 > >> Sendmails latest version 8.13.4 > >> Spamassassin latest version 3.0.2 > >> Different rule sets from the web sites > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > >> > >> > >> > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > Cheers > Res > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------- End of Original Message ------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Tue Apr 5 15:40:51 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: Hhmm... thank you for all of the replies. I was just about to install red hat 9 just because I have the media already and it seemed to me it would be stable. Majority people are talking Centos. I will go centos if everyone thinks it is good. Is the mailwatch you are speaking of this: http://www.mailwatch.com/ ?? I have not used centos before at all, is it a simple setup such as red hat? Also I will have to look into up2date as I have not heard of it either. > -----Original Message----- > From: Stewart M. Ives [mailto:ivessm@SOFTECUSA.COM] > Sent: Tuesday, April 05, 2005 7:41 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Starting from scratch > > Ref OS question: > > I've been using FC2 without any problems what so ever. up2date works and > keeps the box updated. > > I also run MailWatch on it. Great program to get an overall look at what > is > coming into the box and to keep records. If you ever needed something to > justify your job MailWatch will do it for you. It will show what is > happening and make you shine in that it is all being taken care of. > > I'll probably move up to FC4 a while after it is released. > > stew > > > ---------- Original Message ----------- > From: Res > To: MAILSCANNER@JISCMAIL.AC.UK > Sent: Tue, 5 Apr 2005 18:58:01 +1000 > Subject: Re: Starting from scratch > > > On Tue, 5 Apr 2005, Peter Russell wrote: > > > > > I reckon centos 4.0 (which is just rhel without the license and groovy > > > installer) is the go, or buy a red hat license and use Red Hat > > > Proffessional 4.0 > > > > > > Red Hat 9 is too old now... > > > > Its tried and proven, we have RH9 boxes with manual kernel upgrades when > > security dictates, they are unbreakable, centos has had to be > > rebooted a few times, I have no intention of changing my mail > > servers off RH9 because i couldnt break the damn thing if i tried > > its so stable. > > > > > > > > Billy Pumphrey wrote: > > >> I searched the mailscanner archives at > > >> http://www.jiscmail.ac.uk/cgi-bin/wa.exe? > S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > > >> = > > >> > > >> But I could not locate updates information. I also tried to find the > > >> recently topic of "Complete Build". I know that there is a ton of > > >> information in there but I just could not find it. I know that a lot > is > > >> talked about what to run it on, however if I may inquire on my setup > as > > >> Linux is not my environment of expertise. I will try to make my > questions > > >> short. My main and pretty much only question is what versions should > I > > >> use? > > >> > > >> What I have now: > > >> 550mhz > > >> 384 RAM > > >> IDE hard drive (desktop) > > >> > > >> I will be moving to: > > >> Server > > >> Dual 600PIII > > >> 1024 RAM > > >> 3x9.1GB RAID 5 Hard drives > > >> > > >> What I have now: > > >> Redhat 9 (Shrike) > > >> MailScanner 4.25 > > >> Spamassassin 2.61 > > >> MailStats for statistics > > >> Running RulesDuJour > > >> Running other rules too > > >> Sendmail version ?? > > >> Sophos virus scanning > > >> > > >> In question to move to: > > >> Should I still use Redhat 9? Seems to work fine > > >> MailScanner 4.40.11 > > >> Sendmails latest version 8.13.4 > > >> Spamassassin latest version 3.0.2 > > >> Different rule sets from the web sites > > >> > > >> ------------------------ MailScanner list ------------------------ > > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >> 'leave mailscanner' in the body of the email. > > >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > >> > > >> Support MailScanner development - buy the book off the website! > > >> > > >> > > >> > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > -- > > Cheers > > Res > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > ------- End of Original Message ------- > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Tue Apr 5 15:50:28 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Billy Pumphrey > Sent: den 5 april 2005 16:41 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Starting from scratch > > > Hhmm... thank you for all of the replies. I was just about > to install red > hat 9 just because I have the media already and it seemed to > me it would be > stable. Majority people are talking Centos. > > I will go centos if everyone thinks it is good. > Is the mailwatch you are speaking of this: > http://www.mailwatch.com/ ?? Probably not:-). Look at http://mailwatch.sourceforge.net/ instead. > I have not used centos before at all, is it a simple setup > such as red hat? It isessentially that yes. > Also I will have to look into up2date as I have not heard of > it either. Um, how did you keep your RH9s updated with the latest errata (before it going End Of Life about a year ago) then? Now you'll probably be using yum and fedoralegacy, but... Or haven't you been keeping up on the tools/apps side? Wouldn't be a good idea precisely... -- Glenn > > > -----Original Message----- > > From: Stewart M. Ives [mailto:ivessm@SOFTECUSA.COM] > > Sent: Tuesday, April 05, 2005 7:41 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Starting from scratch > > > > Ref OS question: > > > > I've been using FC2 without any problems what so ever. > up2date works and > > keeps the box updated. > > > > I also run MailWatch on it. Great program to get an > overall look at what > > is > > coming into the box and to keep records. If you ever > needed something to > > justify your job MailWatch will do it for you. It will show what is > > happening and make you shine in that it is all being taken care of. > > > > I'll probably move up to FC4 a while after it is released. > > > > stew > > > > > > ---------- Original Message ----------- > > From: Res > > To: MAILSCANNER@JISCMAIL.AC.UK > > Sent: Tue, 5 Apr 2005 18:58:01 +1000 > > Subject: Re: Starting from scratch > > > > > On Tue, 5 Apr 2005, Peter Russell wrote: > > > > > > > I reckon centos 4.0 (which is just rhel without the > license and groovy > > > > installer) is the go, or buy a red hat license and use Red Hat > > > > Proffessional 4.0 > > > > > > > > Red Hat 9 is too old now... > > > > > > Its tried and proven, we have RH9 boxes with manual > kernel upgrades when > > > security dictates, they are unbreakable, centos has had to be > > > rebooted a few times, I have no intention of changing my mail > > > servers off RH9 because i couldnt break the damn thing if i tried > > > its so stable. > > > > > > > > > > > Billy Pumphrey wrote: > > > >> I searched the mailscanner archives at > > > >> http://www.jiscmail.ac.uk/cgi-bin/wa.exe? > > S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > > > >> = > > > >> > > > >> But I could not locate updates information. I also > tried to find the > > > >> recently topic of "Complete Build". I know that there > is a ton of > > > >> information in there but I just could not find it. I > know that a lot > > is > > > >> talked about what to run it on, however if I may > inquire on my setup > > as > > > >> Linux is not my environment of expertise. I will try > to make my > > questions > > > >> short. My main and pretty much only question is what > versions should > > I > > > >> use? > > > >> > > > >> What I have now: > > > >> 550mhz > > > >> 384 RAM > > > >> IDE hard drive (desktop) > > > >> > > > >> I will be moving to: > > > >> Server > > > >> Dual 600PIII > > > >> 1024 RAM > > > >> 3x9.1GB RAID 5 Hard drives > > > >> > > > >> What I have now: > > > >> Redhat 9 (Shrike) > > > >> MailScanner 4.25 > > > >> Spamassassin 2.61 > > > >> MailStats for statistics > > > >> Running RulesDuJour > > > >> Running other rules too > > > >> Sendmail version ?? > > > >> Sophos virus scanning > > > >> > > > >> In question to move to: > > > >> Should I still use Redhat 9? Seems to work fine > > > >> MailScanner 4.40.11 > > > >> Sendmails latest version 8.13.4 > > > >> Spamassassin latest version 3.0.2 > > > >> Different rule sets from the web sites > > > >> > > > >> ------------------------ MailScanner list > ------------------------ > > > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > >> 'leave mailscanner' in the body of the email. > > > >> Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and > > > >> the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >> > > > >> Support MailScanner development - buy the book off the website! > > > >> > > > >> > > > >> > > > > > > > > ------------------------ MailScanner list > ------------------------ > > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > > 'leave mailscanner' in the body of the email. > > > > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and > > > > the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > -- > > > Cheers > > > Res > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > ------- End of Original Message ------- > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Tue Apr 5 16:02:05 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:14 2006 Subject: [ot] qmail setup temporarily stopping mail forwarded by MailScanner box Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Jason Balicki > Sent: 04 April 2005 19:10 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: [ot] qmail setup temporarily stopping mail forwarded > by MailScanner box > > I started tracing the qmail setup and didn't get very far > before I got confused. I remember when I thought sendmail > was confusing and complex and beyond my grasp. How quaintly > naive. :) sendmail.cf files scare me, hence I started on qmail, which totally makes sense and is easy to use. No... really. Once you understand that DJB wants you to do it all his way, and that anybody elses way is wrong, it starts to come together. Since starting on qmail, I've gained some degree of sense and so I use postfix... but on my personal server I retain qmail out of a sense of perversity and to ensure that if I should get run over by a bus, the machine goes to the grave with me. But I digress... > Does anyone know where I should look to find this throttle > and turn it off? (The qmail box will only receive mail from > the MS box so there's no reason to have it any more.) Where did you get your qmail from? I am unaware of anything in qmail which does this. I have seen a thing called spamthrottle for qmail: http://spamthrottle.qmail.ca/man/qmail-spamthrottle.5.html But this isn't part of a bare 1.03 install. Perhaps you have that installed, in which case the above manpage might help. Cheers Stef ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ian at MINTRA.COM Tue Apr 5 16:16:56 2005 From: ian at MINTRA.COM (Ian McCloy) Date: Thu Jan 12 21:29:14 2006 Subject: Queues Not Being Processed ? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, we have 2 nearly identical systems running MailScanner/SpamAssassin/SendMail/MailWatch both were running smoothly until a few weeks ago, when one stopped processing the queues. Mind you, they are small queues under 100. The queue files just build and build, so we stopped mailscanner and reverted to just using the MTA (sendmail), but of course we really would prefer to run MailScanner on this server. The .conf file is the same on both servers and the permissions look the same to me. the conf file is pointing to the correct locations for the queues, because the tables are populated in MailWatch. When I click on the far left, in mail watch to view a message waiting in the Queue, I get an error back that says. Message ID 'XYZ2131231231' Not Found . but If I do the same to a processed message, in the recent messages page it works fine. Any Ideas? help is highly appreciated, Ian McCloy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Tue Apr 5 16:37:39 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:14 2006 Subject: Starting from scratch Message-ID: > > I have not used centos before at all, is it a simple setup > > such as red hat? > It isessentially that yes. > > > Also I will have to look into up2date as I have not heard of > > it either. > Um, how did you keep your RH9s updated with the latest errata > (before it going End Of Life about a year ago) then? Now you'll > probably be using yum and fedoralegacy, but... Or haven't you > been keeping up on the tools/apps side? Wouldn't be a good idea > precisely... > I didn't ever update it. Yes I know, bad idea. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Apr 5 16:37:56 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:14 2006 Subject: Queues Not Being Processed ? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ian McCloy wrote: > Hello, > > we have 2 nearly identical systems running > MailScanner/SpamAssassin/SendMail/MailWatch > > both were running smoothly until a few weeks ago, when one stopped > processing the queues. > > Mind you, they are small queues under 100. > > The queue files just build and build, so we stopped mailscanner and > reverted to just using the MTA (sendmail), but of course we really would > prefer to run MailScanner on this server. > > The .conf file is the same on both servers and the permissions look the > same to me. > > the conf file is pointing to the correct locations for the queues, > because the tables are populated in MailWatch. > > When I click on the far left, in mail watch to view a message waiting in > the Queue, I get an error back that says. Message ID 'XYZ2131231231' > Not Found > . > but If I do the same to a processed message, in the recent messages page > it works fine. > > Any Ideas? > > help is highly appreciated, > Ian McCloy > You can try and move a few of the "oldest" files in that queue and restart MailScanner and see if it moves. Then you can move them back one at a time and see if it is a corrupt queue file. You should try to keep the matching qf and df files together. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ian at MINTRA.COM Tue Apr 5 17:09:54 2005 From: ian at MINTRA.COM (Ian McCloy) Date: Thu Jan 12 21:29:15 2006 Subject: Queues Not Being Processed ? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello Scott, thank you for the quick reply! I went ahead and moved all the messages to a temp folder to see if it was indeed a corrupt file, but unfortunatlly, the email is still not processed. I can see new messages from the last few minutes. They are showing up in the mailwatch interface. And when I click the link to view the message I get the same, message not found, warning. If I look in my queue.in folder, I can see the new messages including both qf and df variations. I think for some reason it doesn't know where to look for the message queue, but strangely the mailwatch interface can populate it's SQL tables with the mail queue. any other ideas? thanks, Ian McCloy Scott Silva wrote: >Ian McCloy wrote: > > >>Hello, >> >>we have 2 nearly identical systems running >>MailScanner/SpamAssassin/SendMail/MailWatch >> >>both were running smoothly until a few weeks ago, when one stopped >>processing the queues. >> >>Mind you, they are small queues under 100. >> >>The queue files just build and build, so we stopped mailscanner and >>reverted to just using the MTA (sendmail), but of course we really would >>prefer to run MailScanner on this server. >> >>The .conf file is the same on both servers and the permissions look the >>same to me. >> >>the conf file is pointing to the correct locations for the queues, >>because the tables are populated in MailWatch. >> >>When I click on the far left, in mail watch to view a message waiting in >>the Queue, I get an error back that says. Message ID 'XYZ2131231231' >>Not Found >>. >>but If I do the same to a processed message, in the recent messages page >>it works fine. >> >>Any Ideas? >> >>help is highly appreciated, >> Ian McCloy >> >> >> >You can try and move a few of the "oldest" files in that queue and >restart MailScanner and see if it moves. >Then you can move them back one at a time and see if it is a corrupt >queue file. You should try to keep the matching qf and df files together. > >-- >"If you have ever eaten crow, >It don't taste like chicken!!" > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shb at WIDEAREA.CO.UK Tue Apr 5 16:59:51 2005 From: shb at WIDEAREA.CO.UK (Simon Brock) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: Thanks for the positive responses about sharing SA BayeDB via MySQL. I need to spend upgrading my MS installations so I will write up what happens and let the list know what happens. Regards, Simon. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Tue Apr 5 17:26:56 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: At 10:40 AM 4/5/2005, you wrote: >Hhmm... thank you for all of the replies. I was just about to install red >hat 9 just because I have the media already and it seemed to me it would be >stable. Majority people are talking Centos. > >I will go centos if everyone thinks it is good. >Is the mailwatch you are speaking of this: http://www.mailwatch.com/ ?? >I have not used centos before at all, is it a simple setup such as red hat? >Also I will have to look into up2date as I have not heard of it either. Hey Billy, I had suggested earlier that you take a look at CentOS 3.4 as opposed to the 4.0 route. The reason is you will be a a lot more familiar with it and will have less headaches with implementation. The 4.0 version is much more secure, but you have to disable those security capabilities to get the OS to behave with MailScanner and a whole other mess of services. Cheers! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Apr 5 17:41:21 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Pete Russell wrote: Mmm that sounds like a treat. Would make a great addition to the new wiki documentation project. Care to write a guide and post it up? okay, here goes, apologies for the HTML: You'll need the perl-DBI and perl-DBD-MySQL modules installed before you try this. Assumptions and Variables: SpamAssassin Bayes Database Name: sa_bayes SpamAssassin Bayes Database UserName: sa_user SpamAssassin Bayes Database Password: sa_password Your database server's real name: local_fqdn Every other server that'll connect to and use this database, this name should be resolvable by the DNS or /etc/hosts: remote_fqdn First of all, create a database where you intend on storing the bayesian information # mysql -u root -p #(some distros like redhat and clones have no password set by default.) mysql> create database sa_bayes; mysql> GRANT ALL ON sa_bayes.* TO sa_user@localhost IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@local_fqdn IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@remote_fqdn IDENTIFIED BY 'sa_password'; Locate the bayes_mysql.sql file For RedHat(like) systems: /usr/share/doc/spamassassin-%version%/sql/bayes_mysql.sql # mysql -u sa_user -p sa_bayes < /path/to/bayes_mysql.sql Now backup your current bayes database: sa-learn -p /path/to/spam.assassin.prefs.conf --backup > sa_bayes_backup.txt sa-learn -p /path/to/spam.assassin.prefs.conf --clear #(optional, incase you want to rollback) Make some changes to your spam.assassin.prefs.conf, on remote (MS Front-end) servers replace 'localhost' with the value of 'local-fqdn' bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:sa_bayes:localhost bayes_sql_username sa_user bayes_sql_password sa_password and comment out the following lines bayes_path /etc/MailScanner/bayes/bayes bayes_file_mode 0660 Now for recovering the bayes_dbm to bayes_sql # sa-learn -p /path/to/spam.assassin.prefs.conf --restore sa_bayes_backup.txt And finally the acid test # spamassassin -x -D -p /path/to/spam.assassin.prefs.conf --lint Check for lines like debug: bayes: Database connection established debug: bayes: found bayes db version 3 debug: bayes: Using userid: 2 and some more like debug: bayes: tok_get_all: Token Count: 20 debug: bayes token 'somewhat' => 0.978 debug: bayes: score = 0.845189622547555 Make sure you stop and start MailScanner.. Futther reading / discussion can be taken up here: /usr/share/doc/spamassassin-%version%/sql/README.bayes OR on the sa-users / sa-dev lists cheers, - dhawal PS: Any mistakes are entirely mine (any yours if you follow this blindly), please test thoroughly before you go production. Also i couldn't find any way to post this to the new wiki, can someone guide me? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Apr 5 17:40:52 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] DNSAdmin wrote: > At 10:40 AM 4/5/2005, you wrote: > >> Hhmm... thank you for all of the replies. I was just about to install >> red >> hat 9 just because I have the media already and it seemed to me it >> would be >> stable. Majority people are talking Centos. >> >> I will go centos if everyone thinks it is good. >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ ?? >> I have not used centos before at all, is it a simple setup such as red >> hat? >> Also I will have to look into up2date as I have not heard of it either. > > > Hey Billy, > > I had suggested earlier that you take a look at CentOS 3.4 as opposed to > the 4.0 route. The reason is you will be a a lot more familiar with it and > will have less headaches with implementation. > > The 4.0 version is much more secure, but you have to disable those security > capabilities to get the OS to behave with MailScanner and a whole other > mess of services. > > Cheers! And 3.4 is based on RedHat Enterprise 3 which shared code base with RedHat 9. So technically you are still using 9, but have a good update path for at least 2 and a half more years. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Apr 5 17:57:54 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] DNSAdmin wrote: > At 10:40 AM 4/5/2005, you wrote: > >> Hhmm... thank you for all of the replies. I was just about to install >> red >> hat 9 just because I have the media already and it seemed to me it >> would be >> stable. Majority people are talking Centos. >> >> I will go centos if everyone thinks it is good. >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ ?? >> I have not used centos before at all, is it a simple setup such as red >> hat? >> Also I will have to look into up2date as I have not heard of it either. > > > Hey Billy, > > I had suggested earlier that you take a look at CentOS 3.4 as opposed to > the 4.0 route. The reason is you will be a a lot more familiar with it and > will have less headaches with implementation. > > The 4.0 version is much more secure, but you have to disable those security > capabilities to get the OS to behave with MailScanner and a whole other > mess of services. > selinux can be set to disabled / warn during installation. Also centos comes with mysql4 (for mailwatch if required) and SA 3.0.1 so that is nice. It is quite simple to install (as easy as rh9 or centos 3.x). Plus yum is faster.. If you use postfix, (though i think not) you get v2.1 opposed to v2.0 in centos4 and finally it comes with kernel 2.6 (as compared to 2.4 in centos v3.x) If you have some time at your disposal, it'll be best if you try out both options before finalising. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kodak at FRONTIERHOMEMORTGAGE.COM Tue Apr 5 18:05:14 2005 From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki) Date: Thu Jan 12 21:29:15 2006 Subject: qmail setup temporarily stopping mail forwarded by MailScanner box Message-ID: Dhawal Doshy <> wrote: > One more way to check if tarpit has been compiled into qmail is this: > # grep tarpit /var/qmail/bin/qmail-smtpd > Binary file /var/qmail/bin/qmail-smtpd matches This test came up negative, so I'm guessing it's something else. Regardless, the problem has yet to rear it's head today, and could have just been me screwing around with it. Stef Morrell <> wrote: > Where did you get your qmail from? I am unaware of anything in > qmail which does this. I have seen a thing called spamthrottle > for qmail: Very long story shortened: I'm taking over for a site I used to administer but was administered by another party for the last two years. They installed a bunch of stuff and I'm becomming familiar with the changes. They pulled OUT the MailScanner+ClamAV+Sophos+SpamAssassin install that I had and replaced it with just qmail. No spam or virus protection or anything. They installed pegasus mail on every desktop because that "makes them immune to viruses." They also let their corporate Sophos license expire. As far as I can tell, the only reason they did the qmail thing is because they wanted catch-all addressing (which the users there now regret. Well, one in particular. :) The "they" in "they" is a largish IT consulting firm who had one "linux guy" on the payroll when they started the contract and then lost him about three months in. Thanks again, guys, for your suggestions. If it pops up again I'll post again (or if I find a fix I'll post.) --J(K) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jwilliams at courtesymortgage.com Tue Apr 5 18:25:01 2005 From: jwilliams at courtesymortgage.com (Jason) Date: Thu Jan 12 21:29:15 2006 Subject: recommended SA rules to stop SPAM Message-ID: Specifically, the ones that have recently come out about buying certain pieces of stock. Currently running SA 2.63. Was skimming the SARE this morning, trying to see if there are any additional rules that are good ones to add. I am also using surbl_uri.cf and chickenpox.cf. (made a few of my own, but need better ones) Anybody recommend a few other rules to stop this type of spam and to have overall better blockage of spam? Thanks, Jason ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jhuber at MICROSOURCE.COM Tue Apr 5 18:49:39 2005 From: jhuber at MICROSOURCE.COM (Jeremy Huber) Date: Thu Jan 12 21:29:15 2006 Subject: Mailscanner stops scanning attachments?? Message-ID: On Mon, 4 Apr 2005 22:56:47 +0100, Jeremy Huber wrote: >>What have you set to generate that report? Exactly how? The answer may >>tell us important things about your setup. > >I'm using MS 4.38.9 (via RPM), with Mailwatch 0.51 and clamav and >bitdefender for AV scanners. Mailwatch is what gave me that list of >triggered rules. I just realized I forgot the important parts: Sendmail for the MTA, Fedora Core 2 for the OS, and SA 2.63 >>MailScanner does not replace winmail.dat files with the files they >>contain. It unpacks them to virus scan and do filename/type checks, but >>you won't ever get a winmail.dat file as well as a doc file attached to >>the same message. >> >>What do you think is adding the doc? > >I've got an email off to the person seeing it to find out more. All I know >is that they're resume's being emailed out, and "everyone else gets the >document correctly." I know that doesn't mean much. I know the last time >I had a problem with winmail.dat, it turned out to be a problem with the >mailer client that was doing it, not MS. I've gotten more info about this as well. Supposedly, he just attaches the document normally from within Outlook. Jeremy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Tue Apr 5 18:58:26 2005 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Excellent! What a great way to teach others. Although I may not implement this, it certainly educates me about SA and more. Thank you for your time and efforts. Steve Campbell campbell@cnpapers.com Charleston Newspapers ----- Original Message ----- From: Dhawal Doshy To: MAILSCANNER@JISCMAIL.AC.UK Sent: Tuesday, April 05, 2005 12:41 PM Subject: Re: SA 3.0.2 and MySQL Pete Russell wrote: Mmm that sounds like a treat. Would make a great addition to the new wiki documentation project. Care to write a guide and post it up? okay, here goes, apologies for the HTML: You'll need the perl-DBI and perl-DBD-MySQL modules installed before you try this. Assumptions and Variables: SpamAssassin Bayes Database Name: sa_bayes SpamAssassin Bayes Database UserName: sa_user SpamAssassin Bayes Database Password: sa_password Your database server's real name: local_fqdn Every other server that'll connect to and use this database, this name should be resolvable by the DNS or /etc/hosts: remote_fqdn First of all, create a database where you intend on storing the bayesian information # mysql -u root -p #(some distros like redhat and clones have no password set by default.) mysql> create database sa_bayes; mysql> GRANT ALL ON sa_bayes.* TO sa_user@localhost IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@local_fqdn IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@remote_fqdn IDENTIFIED BY 'sa_password'; Locate the bayes_mysql.sql file For RedHat(like) systems: /usr/share/doc/spamassassin-%version%/sql/bayes_mysql.sql # mysql -u sa_user -p sa_bayes < /path/to/bayes_mysql.sql Now backup your current bayes database: sa-learn -p /path/to/spam.assassin.prefs.conf --backup > sa_bayes_backup.txt sa-learn -p /path/to/spam.assassin.prefs.conf --clear #(optional, incase you want to rollback) Make some changes to your spam.assassin.prefs.conf, on remote (MS Front-end) servers replace 'localhost' with the value of 'local-fqdn' bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:sa_bayes:localhost bayes_sql_username sa_user bayes_sql_password sa_password and comment out the following lines bayes_path /etc/MailScanner/bayes/bayes bayes_file_mode 0660 Now for recovering the bayes_dbm to bayes_sql # sa-learn -p /path/to/spam.assassin.prefs.conf --restore sa_bayes_backup.txt And finally the acid test # spamassassin -x -D -p /path/to/spam.assassin.prefs.conf --lint Check for lines like debug: bayes: Database connection established debug: bayes: found bayes db version 3 debug: bayes: Using userid: 2 and some more like debug: bayes: tok_get_all: Token Count: 20 debug: bayes token 'somewhat' => 0.978 debug: bayes: score = 0.845189622547555 Make sure you stop and start MailScanner.. Futther reading / discussion can be taken up here: /usr/share/doc/spamassassin-%version%/sql/README.bayes OR on the sa-users / sa-dev lists cheers, - dhawal PS: Any mistakes are entirely mine (any yours if you follow this blindly), please test thoroughly before you go production. Also i couldn't find any way to post this to the new wiki, can someone guide me? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 5 20:00:20 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:15 2006 Subject: recommended SA rules to stop SPAM Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jason wrote: >Specifically, the ones that have recently come out about buying certain pieces >of stock. > >Currently running SA 2.63. > > upgrade to 2.64 or higher ASAP.. 2.63 is vulnerable to a DoS attack by sending it a message with malformed mime sections. This is a remote exploit. Anyone can exploit it by sending you a carefully crafted email. Admittedly it's just a DoS, but still not something you want on any kind of production server. http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0796 This is not exactly new news. It's from August of last year. >Was skimming the SARE this morning, trying to see if there are any additional >rules that are good ones to add. > >I am also using surbl_uri.cf and chickenpox.cf. (made a few of my own, but >need better ones) > surbl is a VERY good one to be using, provided of course you added the Mail::SpamAssassin::SpamCopURI plugin. Also note, when you upgrade to 2.64 you'll need to re-install spamcopURI. SpamCopURI installs as a source-code patch to SA's evaltests.pm, and upgrading SA will clobber it. Not to toot my own horn, but another ruleset I'd recommend is antidrug. It was incorporated into SA 3.0 and works fairly well on pill-spam. A few of the latest ones evade it, but it catches a LOT of common obfuscations of drug names. http://mywebpages.comcast.net/mkettler/sa/antidrug.cf Note: if you upgrade to SA 3.x instead of 2.64, you won't need to mess with SpamCopURI or antidrug, both are built-in with 3.0. However, 3.x does have a minimum perl version of 5.6.1. If you're on an older version of perl, you'll have to stick to 2.64. I also like SARE's fraud, random and specific rulesets. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Tue Apr 5 20:17:26 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: Thanks for more information on this all. To see if I understand you correctly DNSAdmin, I understood that you when you say centos, you mean centos 4? You reference centos otherwise as centos 3.x. I do not understand your line of: " selinux can be set to disabled / warn during installation." Please explain :) > -----Original Message----- > From: Dhawal Doshy [mailto:dhawal@NETMAGICSOLUTIONS.COM] > Sent: Tuesday, April 05, 2005 11:58 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Starting from scratch > > DNSAdmin wrote: > > At 10:40 AM 4/5/2005, you wrote: > > > >> Hhmm... thank you for all of the replies. I was just about to install > >> red > >> hat 9 just because I have the media already and it seemed to me it > >> would be > >> stable. Majority people are talking Centos. > >> > >> I will go centos if everyone thinks it is good. > >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ > ?? > >> I have not used centos before at all, is it a simple setup such as red > >> hat? > >> Also I will have to look into up2date as I have not heard of it either. > > > > > > Hey Billy, > > > > I had suggested earlier that you take a look at CentOS 3.4 as opposed to > > the 4.0 route. The reason is you will be a a lot more familiar with it > and > > will have less headaches with implementation. > > > > The 4.0 version is much more secure, but you have to disable those > security > > capabilities to get the OS to behave with MailScanner and a whole other > > mess of services. > > > > selinux can be set to disabled / warn during installation. > > Also centos comes with mysql4 (for mailwatch if required) and SA 3.0.1 > so that is nice. It is quite simple to install (as easy as rh9 or centos > 3.x). Plus yum is faster.. > > If you use postfix, (though i think not) you get v2.1 opposed to v2.0 in > centos4 and finally it comes with kernel 2.6 (as compared to 2.4 in > centos v3.x) > > If you have some time at your disposal, it'll be best if you try out > both options before finalising. > > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Tue Apr 5 20:40:23 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: At 03:17 PM 4/5/2005, you wrote: Please see inline comments >Thanks for more information on this all. >To see if I understand you correctly DNSAdmin, I understood that you when >you say centos, you mean centos 4? You reference centos otherwise as centos >3.x. No, CentOS has had versions 3.0 - 3.4 iso distros with applied updates throughout the life of RedHat ES 3.0 while RedHat only had version ES 3.0 with constant updates (that you have to pay to get support for). >I do not understand your line of: >" selinux can be set to disabled / warn during installation." >Please explain :) > The selinux part is what I was warning about, though Dhawal, referring to this fact knows more about it than I do.. that's why my description was so vague about CentOS 4.0/RedHat ES 4.0 and Dhawal was more precise. You'll be a lot more familiar with the CentOS 3.4. You'll have a whole new kernel and selinux to deal with in 4.0. You chose! Cheers! > > -----Original Message----- > > From: Dhawal Doshy [mailto:dhawal@NETMAGICSOLUTIONS.COM] > > Sent: Tuesday, April 05, 2005 11:58 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Starting from scratch > > > > DNSAdmin wrote: > > > At 10:40 AM 4/5/2005, you wrote: > > > > > >> Hhmm... thank you for all of the replies. I was just about to install > > >> red > > >> hat 9 just because I have the media already and it seemed to me it > > >> would be > > >> stable. Majority people are talking Centos. > > >> > > >> I will go centos if everyone thinks it is good. > > >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ > > ?? > > >> I have not used centos before at all, is it a simple setup such as red > > >> hat? > > >> Also I will have to look into up2date as I have not heard of it either. > > > > > > > > > Hey Billy, > > > > > > I had suggested earlier that you take a look at CentOS 3.4 as opposed to > > > the 4.0 route. The reason is you will be a a lot more familiar with it > > and > > > will have less headaches with implementation. > > > > > > The 4.0 version is much more secure, but you have to disable those > > security > > > capabilities to get the OS to behave with MailScanner and a whole other > > > mess of services. > > > > > > > selinux can be set to disabled / warn during installation. > > > > Also centos comes with mysql4 (for mailwatch if required) and SA 3.0.1 > > so that is nice. It is quite simple to install (as easy as rh9 or centos > > 3.x). Plus yum is faster.. > > > > If you use postfix, (though i think not) you get v2.1 opposed to v2.0 in > > centos4 and finally it comes with kernel 2.6 (as compared to 2.4 in > > centos v3.x) > > > > If you have some time at your disposal, it'll be best if you try out > > both options before finalising. > > > > - dhawal -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Apr 5 21:36:52 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "utf-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] sorry for creating the confusion: repeating (top posting) what i wrote earlier a bit more clearly CentOS 4x (based on rhel4) uses selinux (Security Enhanced Linux), which during installation can be set to the following 3 options. a. Enable (to enable selinux) b. Warn (to enable but only warn and not interfere otherwise) c. Disable (to completely disable selinux) While selinux is great in file / print environments, i currently see not much use for it in a relay only mail server (i may be wrong though). Apart from that CentOS 4x comes with the following packages: a. SpamAssassin 3.0.1 compared to 2.64 in centos 3.x b. MySQL 4.x (which i prefer for mailwatch) compared to 3.23 in centos 3.x c. Postfix 2.1.x rather than 2.0.x with centos 3.x d. Kernel 2.6 as opposed to 2.4 in centos 3.x Apart from that, yum (a utility for package management and to keep your server updated) is much faster compared to previous versions.. hope that clears all doubts.. if you need any further help installing centos4 (or even 3.x) i could be contacted off the list. i recently upgraded 4 servers to centos4.x and am quite happy with the performance and so far do not notice any compatibility or performance related issues. happy decision making.. - dhawal DNSAdmin writes: > At 03:17 PM 4/5/2005, you wrote: > > Please see inline comments > >> Thanks for more information on this all. >> To see if I understand you correctly DNSAdmin, I understood that you when >> you say centos, you mean centos 4? You reference centos otherwise as >> centos >> 3.x. > > No, CentOS has had versions 3.0 - 3.4 iso distros with applied updates > throughout the life of RedHat ES 3.0 while RedHat only had version ES 3.0 > with constant updates (that you have to pay to get support for). > >> I do not understand your line of: >> " selinux can be set to disabled / warn during installation." >> Please explain :) >> > > The selinux part is what I was warning about, though Dhawal, referring to > this fact knows more about it than I do.. that's why my description was so > vague about CentOS 4.0/RedHat ES 4.0 and Dhawal was more precise. > > You'll be a lot more familiar with the CentOS 3.4. > > You'll have a whole new kernel and selinux to deal with in 4.0. You chose! > > Cheers! > > >> > -----Original Message----- >> > From: Dhawal Doshy [mailto:dhawal@NETMAGICSOLUTIONS.COM] >> > Sent: Tuesday, April 05, 2005 11:58 AM >> > To: MAILSCANNER@JISCMAIL.AC.UK >> > Subject: Re: Starting from scratch >> > >> > DNSAdmin wrote: >> > > At 10:40 AM 4/5/2005, you wrote: >> > > >> > >> Hhmm... thank you for all of the replies. I was just about to >> install >> > >> red >> > >> hat 9 just because I have the media already and it seemed to me it >> > >> would be >> > >> stable. Majority people are talking Centos. >> > >> >> > >> I will go centos if everyone thinks it is good. >> > >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ >> > ?? >> > >> I have not used centos before at all, is it a simple setup such as >> red >> > >> hat? >> > >> Also I will have to look into up2date as I have not heard of it >> either. >> > > >> > > >> > > Hey Billy, >> > > >> > > I had suggested earlier that you take a look at CentOS 3.4 as opposed >> to >> > > the 4.0 route. The reason is you will be a a lot more familiar with >> it >> > and >> > > will have less headaches with implementation. >> > > >> > > The 4.0 version is much more secure, but you have to disable those >> > security >> > > capabilities to get the OS to behave with MailScanner and a whole >> other >> > > mess of services. >> > > >> > >> > selinux can be set to disabled / warn during installation. >> > >> > Also centos comes with mysql4 (for mailwatch if required) and SA 3.0.1 >> > so that is nice. It is quite simple to install (as easy as rh9 or >> centos >> > 3.x). Plus yum is faster.. >> > >> > If you use postfix, (though i think not) you get v2.1 opposed to v2.0 >> in >> > centos4 and finally it comes with kernel 2.6 (as compared to 2.4 in >> > centos v3.x) >> > >> > If you have some time at your disposal, it'll be best if you try out >> > both options before finalising. >> > >> > - dhawal > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > http://www.sng.ecs.soton.ac.uk/mailscanner/ > Configuration by Glenn Parsons dnsadmin-at-1bigthink.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 5 22:07:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:15 2006 Subject: Wildcard support in phishing.safe.sites.conf Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Attached is a patch for the Message.pm in the latest stable (4.40) version. With this patch applied, you can list wildcarded hosts in phishing.safe.sites.conf. So instead of listing www.safedomain.com www2.safedomain.com www.internal.safedomain.com and other hosts like that one at a time, you can just use *.safedomain.com instead. I strongly advise against adding *.com to your safe.sites file! Use this feature with care. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-GZIP 900bytes. ] [ Unable to print this part. ] From ivessm at softecusa.com Wed Apr 6 00:24:10 2005 From: ivessm at softecusa.com (Stewart M. Ives) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Billy, The MailWatch I'm talking about is: http://sourceforge.net/projects/mailwatch/ As to centos.org I haven't done anything with it. stew ---------- Original Message ----------- From: Billy Pumphrey To: MAILSCANNER@JISCMAIL.AC.UK Sent: Tue, 5 Apr 2005 09:40:51 -0500 Subject: Re: Starting from scratch > Hhmm... thank you for all of the replies. I was just about to > install red hat 9 just because I have the media already and it > seemed to me it would be stable. Majority people are talking Centos. > > I will go centos if everyone thinks it is good. > Is the mailwatch you are speaking of this: http://www.mailwatch.com/ > ?? I have not used centos before at all, is it a simple setup such > as red hat? Also I will have to look into up2date as I have not > heard of it either. > > > -----Original Message----- > > From: Stewart M. Ives [mailto:ivessm@SOFTECUSA.COM] > > Sent: Tuesday, April 05, 2005 7:41 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: Starting from scratch > > > > Ref OS question: > > > > I've been using FC2 without any problems what so ever. up2date works and > > keeps the box updated. > > > > I also run MailWatch on it. Great program to get an overall look at what > > is > > coming into the box and to keep records. If you ever needed something to > > justify your job MailWatch will do it for you. It will show what is > > happening and make you shine in that it is all being taken care of. > > > > I'll probably move up to FC4 a while after it is released. > > > > stew > > > > > > ---------- Original Message ----------- > > From: Res > > To: MAILSCANNER@JISCMAIL.AC.UK > > Sent: Tue, 5 Apr 2005 18:58:01 +1000 > > Subject: Re: Starting from scratch > > > > > On Tue, 5 Apr 2005, Peter Russell wrote: > > > > > > > I reckon centos 4.0 (which is just rhel without the license and groovy > > > > installer) is the go, or buy a red hat license and use Red Hat > > > > Proffessional 4.0 > > > > > > > > Red Hat 9 is too old now... > > > > > > Its tried and proven, we have RH9 boxes with manual kernel upgrades when > > > security dictates, they are unbreakable, centos has had to be > > > rebooted a few times, I have no intention of changing my mail > > > servers off RH9 because i couldnt break the damn thing if i tried > > > its so stable. > > > > > > > > > > > Billy Pumphrey wrote: > > > >> I searched the mailscanner archives at > > > >> http://www.jiscmail.ac.uk/cgi-bin/wa.exe? > > S1=mailscanner&D=0&T=0&H=0&O=T&F=&S > > > >> = > > > >> > > > >> But I could not locate updates information. I also tried to find the > > > >> recently topic of "Complete Build". I know that there is a ton of > > > >> information in there but I just could not find it. I know that a lot > > is > > > >> talked about what to run it on, however if I may inquire on my setup > > as > > > >> Linux is not my environment of expertise. I will try to make my > > questions > > > >> short. My main and pretty much only question is what versions should > > I > > > >> use? > > > >> > > > >> What I have now: > > > >> 550mhz > > > >> 384 RAM > > > >> IDE hard drive (desktop) > > > >> > > > >> I will be moving to: > > > >> Server > > > >> Dual 600PIII > > > >> 1024 RAM > > > >> 3x9.1GB RAID 5 Hard drives > > > >> > > > >> What I have now: > > > >> Redhat 9 (Shrike) > > > >> MailScanner 4.25 > > > >> Spamassassin 2.61 > > > >> MailStats for statistics > > > >> Running RulesDuJour > > > >> Running other rules too > > > >> Sendmail version ?? > > > >> Sophos virus scanning > > > >> > > > >> In question to move to: > > > >> Should I still use Redhat 9? Seems to work fine > > > >> MailScanner 4.40.11 > > > >> Sendmails latest version 8.13.4 > > > >> Spamassassin latest version 3.0.2 > > > >> Different rule sets from the web sites > > > >> > > > >> ------------------------ MailScanner list ------------------------ > > > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > >> 'leave mailscanner' in the body of the email. > > > >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >> > > > >> Support MailScanner development - buy the book off the website! > > > >> > > > >> > > > >> > > > > > > > > ------------------------ MailScanner list ------------------------ > > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > > 'leave mailscanner' in the body of the email. > > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > > > > -- > > > Cheers > > > Res > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > ------- End of Original Message ------- > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------- End of Original Message ------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Wed Apr 6 06:13:40 2005 From: pete at ENITECH.COM.AU (Peter Russell) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] DNSAdmin wrote: > At 10:40 AM 4/5/2005, you wrote: > >> Hhmm... thank you for all of the replies. I was just about to install >> red >> hat 9 just because I have the media already and it seemed to me it >> would be >> stable. Majority people are talking Centos. >> >> I will go centos if everyone thinks it is good. >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ ?? >> I have not used centos before at all, is it a simple setup such as red >> hat? >> Also I will have to look into up2date as I have not heard of it either. > > > Hey Billy, > > I had suggested earlier that you take a look at CentOS 3.4 as opposed to > the 4.0 route. The reason is you will be a a lot more familiar with it and > will have less headaches with implementation. > > The 4.0 version is much more secure, but you have to disable those security > capabilities to get the OS to behave with MailScanner and a whole other > mess of services. > why? Does Red HAt 4 and centos almost the same? PLenty of us using RHEL4. Pete > Cheers! > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > http://www.sng.ecs.soton.ac.uk/mailscanner/ > Configuration by Glenn Parsons dnsadmin-at-1bigthink.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-list at OKLA.COM Wed Apr 6 07:27:58 2005 From: mailscanner-list at OKLA.COM (Tracy Greggs) Date: Thu Jan 12 21:29:15 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] He is probably referring to SELinux which if enabled breaks a ton of things. Tracy ----- Original Message ----- From: "Peter Russell" To: Sent: Wednesday, April 06, 2005 12:13 AM Subject: Re: Starting from scratch > DNSAdmin wrote: > > At 10:40 AM 4/5/2005, you wrote: > > > >> Hhmm... thank you for all of the replies. I was just about to install > >> red > >> hat 9 just because I have the media already and it seemed to me it > >> would be > >> stable. Majority people are talking Centos. > >> > >> I will go centos if everyone thinks it is good. > >> Is the mailwatch you are speaking of this: http://www.mailwatch.com/ ?? > >> I have not used centos before at all, is it a simple setup such as red > >> hat? > >> Also I will have to look into up2date as I have not heard of it either. > > > > > > Hey Billy, > > > > I had suggested earlier that you take a look at CentOS 3.4 as opposed to > > the 4.0 route. The reason is you will be a a lot more familiar with it and > > will have less headaches with implementation. > > > > The 4.0 version is much more secure, but you have to disable those security > > capabilities to get the OS to behave with MailScanner and a whole other > > mess of services. > > > > why? Does Red HAt 4 and centos almost the same? PLenty of us using RHEL4. > Pete > > Cheers! > > > > > > -- > > This message has been scanned for viruses and > > dangerous content by MailScanner, and is > > believed to be clean. > > http://www.sng.ecs.soton.ac.uk/mailscanner/ > > Configuration by Glenn Parsons dnsadmin-at-1bigthink.com > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Oklahoma Network Consulting has scanned this > message for viruses and dangerous content with > MailScanner, and commercial virus scanners McAfee > and F-Prot and is believed to be clean. > --- -- Oklahoma Network Consulting has scanned this message for viruses and dangerous content with MailScanner, and commercial virus scanners McAfee and F-Prot and is believed to be clean. --- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Wed Apr 6 08:21:36 2005 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:29:15 2006 Subject: Phishing net doesn't like backslashes... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > MailScanner has > detected a possible fraud attempt from "http:\\www.example.com" claiming > to be http:\\www.example.com Not that backslashes should ever be used in URIs, of course, but they are occasionally seen in practice and are totally harmless. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 09:28:11 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I have a question about MailScanner's support for IPv6. I checked the mailing list archives and found the release notes for 4.21-8, stating: - Now support IPv6 addresses completely. I also found some IPv6 references in .pm files in lib/MailScanner/. However, I'm having troubles with IPv6. The OS is SuSE Linux 9.2 (kernel 2.6.11.6). Whenever a message is received over IPv6, MailScanner seems to think the sending mail server is the localhost (127.0.0.1). Here is an example (some info obscured): ******************************************************************** Apr 6 09:53:38 mx1 sendmail-in[13464]: j367qhO9013464: from=SENDER, size=105, class=0, nrcpts=1, msgid=MSGID, proto=SMTP, daemon=MTA-Inet, relay=xs6.xs4all.nl [IPv6:2001:888:0:1::666] Apr 6 09:53:38 mx1 sendmail-in[13464]: j367qhO9013464: to=RECIPIENT, delay=00:00:32, mailer=esmtp, pri=30105, stat=queued Apr 6 09:53:40 mx1 MailScanner[31983]: New Batch: Scanning 1 messages, 670 bytes Apr 6 09:53:41 mx1 MailScanner[31983]: Saved archive copies of j367qhO9013464 Apr 6 09:53:41 mx1 MailScanner[31983]: MCP Checks completed at 670 bytes per second Apr 6 09:53:41 mx1 MailScanner[31983]: Spam Checks: Starting Apr 6 09:53:45 mx1 MailScanner[31983]: Message j367qhO9013464 from 127.0.0.1 (SENDER) to RECIPIENT is not spam, SpamAssassin (score=-15, required 4, autolearn=not spam, BAYES_00 -15.00) ******************************************************************** Because of this, all mail received from the IPv6 net is tagged as non spam, since localhost is bypassed for several checks (mainly because of MailWatch). Does MailScanner have some sort of default (127.0.0.1), when the IP address cannot be determined or something? Does anyone else experience this or are there not much IPv6 connected mail hosts out there? ;-) Regards, Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at ZANKER.ORG Wed Apr 6 09:52:19 2005 From: mike at ZANKER.ORG (Mike Zanker) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike wrote: > Does anyone else experience this or are there not much IPv6 connected mail hosts out there? ;-) I receive a fair amount of mail over IPv6 (including everything from the Exim mailing list) but have not had any problems. I am using Exim, though, not sendmail. Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Apr 6 09:53:13 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: Will you take this Peter? Or perhaps better... Dahwal, driop Ugo a line and join in the fun...:-). -- Glenn -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy Sent: den 5 april 2005 18:41 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SA 3.0.2 and MySQL Pete Russell wrote: Mmm that sounds like a treat. Would make a great addition to the new wiki documentation project. Care to write a guide and post it up? okay, here goes, apologies for the HTML: You'll need the perl-DBI and perl-DBD-MySQL modules installed before you try this. Assumptions and Variables: SpamAssassin Bayes Database Name: sa_bayes SpamAssassin Bayes Database UserName: sa_user SpamAssassin Bayes Database Password: sa_password Your database server's real name: local_fqdn Every other server that'll connect to and use this database, this name should be resolvable by the DNS or /etc/hosts: remote_fqdn First of all, create a database where you intend on storing the bayesian information # mysql -u root -p #(some distros like redhat and clones have no password set by default.) mysql> create database sa_bayes; mysql> GRANT ALL ON sa_bayes.* TO sa_user@localhost IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@local_fqdn IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@remote_fqdn IDENTIFIED BY 'sa_password'; Locate the bayes_mysql.sql file For RedHat(like) systems: /usr/share/doc/spamassassin-%version%/sql/bayes_mysql.sql # mysql -u sa_user -p sa_bayes < /path/to/bayes_mysql.sql Now backup your current bayes database: sa-learn -p /path/to/spam.assassin.prefs.conf --backup > sa_bayes_backup.txt sa-learn -p /path/to/spam.assassin.prefs.conf --clear #(optional, incase you want to rollback) Make some changes to your spam.assassin.prefs.conf, on remote (MS Front-end) servers replace 'localhost' with the value of 'local-fqdn' bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:sa_bayes:localhost bayes_sql_username sa_user bayes_sql_password sa_password and comment out the following lines bayes_path /etc/MailScanner/bayes/bayes bayes_file_mode 0660 Now for recovering the bayes_dbm to bayes_sql # sa-learn -p /path/to/spam.assassin.prefs.conf --restore sa_bayes_backup.txt And finally the acid test # spamassassin -x -D -p /path/to/spam.assassin.prefs.conf --lint Check for lines like debug: bayes: Database connection established debug: bayes: found bayes db version 3 debug: bayes: Using userid: 2 and some more like debug: bayes: tok_get_all: Token Count: 20 debug: bayes token 'somewhat' => 0.978 debug: bayes: score = 0.845189622547555 Make sure you stop and start MailScanner.. Futther reading / discussion can be taken up here: /usr/share/doc/spamassassin-%version%/sql/README.bayes OR on the sa-users / sa-dev lists cheers, - dhawal PS: Any mistakes are entirely mine (any yours if you follow this blindly), please test thoroughly before you go production. Also i couldn't find any way to post this to the new wiki, can someone guide me? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ^@ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Apr 6 09:59:14 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: Oops, missed the PS... It's quite simple, just register a user, make a blurb on the volonteers page... and off you go:-). -- Glenn -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: den 6 april 2005 10:53 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SA 3.0.2 and MySQL Will you take this Peter? Or perhaps better... Dahwal, driop Ugo a line and join in the fun...:-). -- Glenn -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy Sent: den 5 april 2005 18:41 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: SA 3.0.2 and MySQL Pete Russell wrote: Mmm that sounds like a treat. Would make a great addition to the new wiki documentation project. Care to write a guide and post it up? okay, here goes, apologies for the HTML: You'll need the perl-DBI and perl-DBD-MySQL modules installed before you try this. Assumptions and Variables: SpamAssassin Bayes Database Name: sa_bayes SpamAssassin Bayes Database UserName: sa_user SpamAssassin Bayes Database Password: sa_password Your database server's real name: local_fqdn Every other server that'll connect to and use this database, this name should be resolvable by the DNS or /etc/hosts: remote_fqdn First of all, create a database where you intend on storing the bayesian information # mysql -u root -p #(some distros like redhat and clones have no password set by default.) mysql> create database sa_bayes; mysql> GRANT ALL ON sa_bayes.* TO sa_user@localhost IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@local_fqdn IDENTIFIED BY 'sa_password'; mysql> GRANT ALL ON sa_bayes.* TO sa_user@remote_fqdn IDENTIFIED BY 'sa_password'; Locate the bayes_mysql.sql file For RedHat(like) systems: /usr/share/doc/spamassassin-%version%/sql/bayes_mysql.sql # mysql -u sa_user -p sa_bayes < /path/to/bayes_mysql.sql Now backup your current bayes database: sa-learn -p /path/to/spam.assassin.prefs.conf --backup > sa_bayes_backup.txt sa-learn -p /path/to/spam.assassin.prefs.conf --clear #(optional, incase you want to rollback) Make some changes to your spam.assassin.prefs.conf, on remote (MS Front-end) servers replace 'localhost' with the value of 'local-fqdn' bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:sa_bayes:localhost bayes_sql_username sa_user bayes_sql_password sa_password and comment out the following lines bayes_path /etc/MailScanner/bayes/bayes bayes_file_mode 0660 Now for recovering the bayes_dbm to bayes_sql # sa-learn -p /path/to/spam.assassin.prefs.conf --restore sa_bayes_backup.txt And finally the acid test # spamassassin -x -D -p /path/to/spam.assassin.prefs.conf --lint Check for lines like debug: bayes: Database connection established debug: bayes: found bayes db version 3 debug: bayes: Using userid: 2 and some more like debug: bayes: tok_get_all: Token Count: 20 debug: bayes token 'somewhat' => 0.978 debug: bayes: score = 0.845189622547555 Make sure you stop and start MailScanner.. Futther reading / discussion can be taken up here: /usr/share/doc/spamassassin-%version%/sql/README.bayes OR on the sa-users / sa-dev lists cheers, - dhawal PS: Any mistakes are entirely mine (any yours if you follow this blindly), please test thoroughly before you go production. Also i couldn't find any way to post this to the new wiki, can someone guide me? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ^@ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 10:32:13 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Mike Zanker > >I receive a fair amount of mail over IPv6 (including everything from the >Exim mailing list) but have not had any problems. I am using Exim, >though, not sendmail. I think I've located the problem, it's in lib/Sendmail.pm (so it's sendmail related): ********************** if ($Line =~ /^\$_/) { $ip = $Line; #chomp $ip; if ($ip =~ /\[([\d.:abcdef]+)\]/) { $message->{clientip} = $1; } else { # It is a locally-created message and doesn't have an smtp client ip $message->{clientip} = '127.0.0.1'; } $IPFound = 1; # We have found the client IP address } ********************** Now to figure out what the "if ($ip =~ /\[([\d.:abcdef]+)\]/) {" check needs to be (I'm not a perl guru). I'll try to experiment a bit. >Mike. Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Wed Apr 6 11:15:46 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] ? I will add this to the wiki on his behalf. Kind regards and thanks for providing this doco. I am going to try it on a new test machine i am building next week. Thanks again Pete Steen, Glenn wrote: > Will you take this Peter? > Or perhaps better... Dahwal, driop Ugo a line and join in the fun...:-). > > -- Glenn > > -----Original Message----- > *From:* MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] > *On Behalf Of *Dhawal Doshy > *Sent:* den 5 april 2005 18:41 > *To:* MAILSCANNER@JISCMAIL.AC.UK > *Subject:* Re: SA 3.0.2 and MySQL > > Pete Russell wrote: > >> Mmm that sounds like a treat. Would make a great addition to the new >> wiki documentation project. >> >> Care to write a guide and post it up? > > okay, here goes, apologies for the HTML: > > You'll need the perl-DBI and perl-DBD-MySQL modules installed before > you try this. > > _Assumptions and Variables:_ > SpamAssassin Bayes Database Name: *sa_bayes* > SpamAssassin Bayes Database UserName: *sa_user* > SpamAssassin Bayes Database Password: *sa_password* > Your database server's real name: *local_fqdn* > Every other server that'll connect to and use this database, this > name should be resolvable by the DNS or /etc/hosts: *remote_fqdn* > > First of all, create a database where you intend on storing the > bayesian information > /# mysql -u root -p/ #(some distros like redhat and clones have no > password set by default.) > /mysql> create database sa_bayes; > mysql> GRANT ALL ON *sa_bayes*.* TO *sa_user*@localhost IDENTIFIED > BY '*sa_password*'; > mysql> GRANT ALL ON *sa_bayes*.* TO *sa_user*@*local_fqdn* > IDENTIFIED BY '*sa_password*'; > mysql> GRANT ALL ON *sa_bayes*.* TO *sa_user*@*remote_fqdn* > IDENTIFIED BY '*sa_password*'; > / > Locate the bayes_mysql.sql file > For RedHat(like) systems: > /usr/share/doc/spamassassin-%version%/sql/bayes_mysql.sql > > /# mysql -u sa_user -p sa_bayes < /path/to/bayes_mysql.sql/ > > Now backup your current bayes database: > /sa-learn -p /path/to/spam.assassin.prefs.conf --backup > > sa_bayes_backup.txt > sa-learn -p /path/to/spam.assassin.prefs.conf --clear #(optional, > incase you want to rollback) > / > Make some changes to your spam.assassin.prefs.conf, on remote (MS > Front-end) servers replace '*localhost*' with the value of > '*local-fqdn*' > > bayes_store_module Mail::SpamAssassin::BayesStore::SQL > bayes_sql_dsn DBI:mysql:*sa_bayes:localhost* > bayes_sql_username *sa_user* > bayes_sql_password *sa_password* > * > *and comment out the following lines > bayes_path /etc/MailScanner/bayes/bayes > bayes_file_mode 0660 > > Now for recovering the bayes_dbm to bayes_sql > /# sa-learn -p /path/to/spam.assassin.prefs.conf --restore > sa_bayes_backup.txt/ > > And finally the acid test > /# spamassassin -x -D -p /path/to/spam.assassin.prefs.conf --lint/ > > Check for lines like > debug: bayes: Database connection established > debug: bayes: found bayes db version 3 > debug: bayes: Using userid: 2 > and some more like > debug: bayes: tok_get_all: Token Count: 20 > debug: bayes token 'somewhat' => 0.978 > debug: bayes: score = 0.845189622547555 > > Make sure you stop and start MailScanner.. > > Futther reading / discussion can be taken up here: > /usr/share/doc/spamassassin-%version%/sql/README.bayes OR on the > sa-users / sa-dev lists > > cheers, > - dhawal > > PS: Any mistakes are entirely mine (any yours if you follow this > blindly), please test thoroughly before you go production. > Also i couldn't find any way to post this to the new wiki, can > someone guide me? > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 11:37:05 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Mike > >Now to figure out what the "if ($ip =~ /\[([\d.:abcdef]+)\]/) {" check >needs to be (I'm not a perl guru). I'll try to experiment a bit. I solved this (see patch) by changing if ($ip =~ /\[([\d.:abcdef]+)\]/) { into if ($ip =~ /\[([IPv6\d.:abcdef]+)\]/) { in Sendmail.pm. I'm not sure if this is the best check (ItWorksForMe[tm]), but I'll leave that to Julian. Now I'm off to MailWatch, since it seems there's also something going wrong there. The mailscanner database does have the correct clientip record, however the details of a IPv6 message shows "127.0.0.1" as "Received from:". There will probably a similar check with default "127.0.0.1" in one of the .php files. Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "Sendmail.pm-IPv6.diff" Application/OCTET-STREAM (Name: ] [ "Sendmail.pm-IPv6.diff") 592bytes. ] [ Unable to print this part. ] From rcooper at DWFORD.COM Wed Apr 6 11:47:45 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Mike > Sent: Wednesday, April 06, 2005 5:37 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner & IPv6 [SOLVED] > > > >-----Original Message----- > >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >Behalf Of Mike > > > >Now to figure out what the "if ($ip =~ /\[([\d.:abcdef]+)\]/) {" check > >needs to be (I'm not a perl guru). I'll try to experiment a bit. > > I solved this (see patch) by changing > > if ($ip =~ /\[([\d.:abcdef]+)\]/) { > > into > > if ($ip =~ /\[([IPv6\d.:abcdef]+)\]/) { I was about to suggest you go with if ($ip =~ /\[IPv6:([\d.:abcdef]+)\]/) { if they are using the same format as in the log snipet you showed I don't believe you actually want the "IPv6:" portion in the IP address, unless somewhere else in the code it's removed. Your change would return the IP as IPv6:2001:888:0:1::666 not 2001:888:0:1::666 Rick > > in Sendmail.pm. I'm not sure if this is the best check > (ItWorksForMe[tm]), but I'll leave that to Julian. > > Now I'm off to MailWatch, since it seems there's also something > going wrong there. The mailscanner database does have the correct > clientip record, however the details of a IPv6 message shows > "127.0.0.1" as "Received from:". There will probably a similar > check with default "127.0.0.1" in one of the .php files. > > Mike. > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 11:57:53 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Rick Cooper > >I was about to suggest you go with if ($ip =~ /\[IPv6:([\d.:abcdef]+)\]/) { > >if they are using the same format as in the log snipet you showed I don't >believe you actually want the "IPv6:" portion in the IP address, unless >somewhere else in the code it's removed. Your change would return the IP as >IPv6:2001:888:0:1::666 not 2001:888:0:1::666 Well, actually you do want that, since it's easier to distinguish that's an IPv6 address. I also believe that the IPv6: tag is mantory (at least for now), or am I wrong? Also, I don't think your statement works. It also has to match non IPv6 addresses, which your solution does not. In your case IPv6 works, but regular IPv4 addresses will get the default "127.0.0.1", since the if only matches when it starts with IPv6. I'll let Julian come up with a good/better solution than mine. I just made a quick fix, so IPv6 mail is no longer automagically tagged as coming from the localhost and ergo being non spam. >Rick Thanks, Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Wed Apr 6 12:11:10 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Mike > Sent: Wednesday, April 06, 2005 5:58 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner & IPv6 [SOLVED] > > > >-----Original Message----- > >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >Behalf Of Rick Cooper > > > >I was about to suggest you go with if ($ip =~ > /\[IPv6:([\d.:abcdef]+)\]/) { > > > >if they are using the same format as in the log snipet you showed I don't > >believe you actually want the "IPv6:" portion in the IP address, unless > >somewhere else in the code it's removed. Your change would > return the IP as > >IPv6:2001:888:0:1::666 not 2001:888:0:1::666 > > Well, actually you do want that, since it's easier to distinguish > that's an IPv6 address. I also believe that the IPv6: tag is > mantory (at least for now), or am I wrong? > It's not part of the specification, which is why I mentioned it. It's easy to spot an IPv6 address anyway because of the format. > Also, I don't think your statement works. It also has to match > non IPv6 addresses, which your solution does not. In your case > IPv6 works, but regular IPv4 addresses will get the default > "127.0.0.1", since the if only matches when it starts with IPv6. > Yeah, should have made that "(?:Ipv6:)?" oops! I doubt that the accuracy of the address is an issue once it's gotten to mailscanner anyway. > I'll let Julian come up with a good/better solution than mine. I > just made a quick fix, so IPv6 mail is no longer automagically > tagged as coming from the localhost and ergo being non spam. > > >Rick > > Thanks, > Mike. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Apr 6 12:35:05 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Pete Russell > Sent: den 6 april 2005 12:16 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: SA 3.0.2 and MySQL > > > ? Well... I would've done it myself if I had the time... But Real Work(tm) is limiting that resource for me ATM... Aparantly Dahwal would've too, but failed somehow (can't imagine how, seeing as it is so simple:-). Cheers -- Glenn > > I will add this to the wiki on his behalf. > > Kind regards and thanks for providing this doco. I am going > to try it on > a new test machine i am building next week. > > Thanks again > Pete > > Steen, Glenn wrote: > > Will you take this Peter? > > Or perhaps better... Dahwal, driop Ugo a line and join in > the fun...:-). > > > > -- Glenn > > > > -----Original Message----- > > *From:* MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] > > *On Behalf Of *Dhawal Doshy > > *Sent:* den 5 april 2005 18:41 > > *To:* MAILSCANNER@JISCMAIL.AC.UK > > *Subject:* Re: SA 3.0.2 and MySQL > > > > Pete Russell wrote: > > > >> Mmm that sounds like a treat. Would make a great > addition to the new > >> wiki documentation project. > >> > >> Care to write a guide and post it up? > > > > okay, here goes, apologies for the HTML: > > > > You'll need the perl-DBI and perl-DBD-MySQL modules > installed before > > you try this. > > > > _Assumptions and Variables:_ > > SpamAssassin Bayes Database Name: *sa_bayes* > > SpamAssassin Bayes Database UserName: *sa_user* > > SpamAssassin Bayes Database Password: *sa_password* > > Your database server's real name: *local_fqdn* > > Every other server that'll connect to and use this > database, this > > name should be resolvable by the DNS or /etc/hosts: > *remote_fqdn* > > > > First of all, create a database where you intend on storing the > > bayesian information > > /# mysql -u root -p/ #(some distros like redhat and > clones have no > > password set by default.) > > /mysql> create database sa_bayes; > > mysql> GRANT ALL ON *sa_bayes*.* TO *sa_user*@localhost > IDENTIFIED > > BY '*sa_password*'; > > mysql> GRANT ALL ON *sa_bayes*.* TO *sa_user*@*local_fqdn* > > IDENTIFIED BY '*sa_password*'; > > mysql> GRANT ALL ON *sa_bayes*.* TO *sa_user*@*remote_fqdn* > > IDENTIFIED BY '*sa_password*'; > > / > > Locate the bayes_mysql.sql file > > For RedHat(like) systems: > > /usr/share/doc/spamassassin-%version%/sql/bayes_mysql.sql > > > > /# mysql -u sa_user -p sa_bayes < /path/to/bayes_mysql.sql/ > > > > Now backup your current bayes database: > > /sa-learn -p /path/to/spam.assassin.prefs.conf --backup > > > sa_bayes_backup.txt > > sa-learn -p /path/to/spam.assassin.prefs.conf --clear > #(optional, > > incase you want to rollback) > > / > > Make some changes to your spam.assassin.prefs.conf, on > remote (MS > > Front-end) servers replace '*localhost*' with the value of > > '*local-fqdn*' > > > > bayes_store_module Mail::SpamAssassin::BayesStore::SQL > > bayes_sql_dsn DBI:mysql:*sa_bayes:localhost* > > bayes_sql_username *sa_user* > > bayes_sql_password *sa_password* > > * > > *and comment out the following lines > > bayes_path /etc/MailScanner/bayes/bayes > > bayes_file_mode 0660 > > > > Now for recovering the bayes_dbm to bayes_sql > > /# sa-learn -p /path/to/spam.assassin.prefs.conf --restore > > sa_bayes_backup.txt/ > > > > And finally the acid test > > /# spamassassin -x -D -p > /path/to/spam.assassin.prefs.conf --lint/ > > > > Check for lines like > > debug: bayes: Database connection established > > debug: bayes: found bayes db version 3 > > debug: bayes: Using userid: 2 > > and some more like > > debug: bayes: tok_get_all: Token Count: 20 > > debug: bayes token 'somewhat' => 0.978 > > debug: bayes: score = 0.845189622547555 > > > > Make sure you stop and start MailScanner.. > > > > Futther reading / discussion can be taken up here: > > /usr/share/doc/spamassassin-%version%/sql/README.bayes OR on the > > sa-users / sa-dev lists > > > > cheers, > > - dhawal > > > > PS: Any mistakes are entirely mine (any yours if you follow this > > blindly), please test thoroughly before you go production. > > Also i couldn't find any way to post this to the new wiki, can > > someone guide me? > > ------------------------ MailScanner list > ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > > and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.h> tml). > > > > > *Support MailScanner development - buy the > book off the website!* > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > *Support MailScanner development - buy the book off the website!* > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 12:38:45 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Rick Cooper > >It's not part of the specification, which is why I mentioned it. It's easy >to spot an IPv6 address anyway because of the format. Ok, it's just that every program/service that uses IPv6, seems to leave the IPv6 tag in tact. I'll leave it to Julian. >Yeah, should have made that "(?:Ipv6:)?" oops! I doubt that the accuracy of >the address is an issue once it's gotten to mailscanner anyway. It's important for ACL I think, since you need to know what to match against. I've done some tests with "(?:Ipv6:)?", but that only works for IPv4, no longer for IPv6. This is what I used for testing: **************** #! /usr/bin/perl $ip = "$_xs6.xs4all.nl [IPv6:2001:888:0:1::666]"; #$ip = "$_smtp.jiscmail.ac.uk [130.246.192.55]"; if ($ip =~ /\[(?:Ipv6:)?([\d.:abcdef]+)\]/) { print "match\n"; print "$1\n"; } else { print "no match\n"; print "$1\n"; } **************** Anyway, Julian will hopefully shed his guru perl light on the problem and a proper fix! ;-) >> >Rick Thanks, Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Wed Apr 6 12:48:06 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Mike > Sent: Wednesday, April 06, 2005 6:39 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner & IPv6 [SOLVED] > > > >-----Original Message----- > >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >Behalf Of Rick Cooper > > > >It's not part of the specification, which is why I mentioned it. > It's easy > >to spot an IPv6 address anyway because of the format. > > Ok, it's just that every program/service that uses IPv6, seems to > leave the IPv6 tag in tact. I'll leave it to Julian. > > >Yeah, should have made that "(?:Ipv6:)?" oops! I doubt that the > accuracy of > >the address is an issue once it's gotten to mailscanner anyway. > > It's important for ACL I think, since you need to know what to > match against. > > I've done some tests with "(?:Ipv6:)?", but that only works for > IPv4, no longer for IPv6. This is what I used for testing: > should be IPv6 not Ipv6, my apologies, I actually tested it but didn't clip and copy... I am working on a couple of other things and this conversation was in the periphery and I shouldn't do that, I am sorry. Whole line: if ($ip =~ /\[(?:IPv6:)?([\d.:abcdef]+)\]/) { will match both formats. Rick > **************** > #! /usr/bin/perl > > $ip = "$_xs6.xs4all.nl [IPv6:2001:888:0:1::666]"; > #$ip = "$_smtp.jiscmail.ac.uk [130.246.192.55]"; > > if ($ip =~ /\[(?:Ipv6:)?([\d.:abcdef]+)\]/) { > print "match\n"; > print "$1\n"; > } else { > print "no match\n"; > print "$1\n"; > } > **************** > > Anyway, Julian will hopefully shed his guru perl light on the > problem and a proper fix! ;-) > > >> >Rick > > Thanks, > Mike. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 12:56:05 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Rick Cooper > >Yeah, should have made that "(?:Ipv6:)?" oops! I doubt that the accuracy of >the address is an issue once it's gotten to mailscanner anyway. How about this then: if ($ip =~ /\[[IPv6:]*([\d.:abcdef]+)\]/) { This way, the IP address can optionally consist of the "IPv6:" tag. I'm not sure if the IPv6: tag is Linux specific. If it DOES consists of the IPv6: tag, the tag will not be removed. Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Wed Apr 6 13:36:48 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Mike > Sent: Wednesday, April 06, 2005 6:56 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner & IPv6 [SOLVED] > > > >-----Original Message----- > >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >Behalf Of Rick Cooper > > > >Yeah, should have made that "(?:Ipv6:)?" oops! I doubt that the > accuracy of > >the address is an issue once it's gotten to mailscanner anyway. > > How about this then: > > if ($ip =~ /\[[IPv6:]*([\d.:abcdef]+)\]/) { > > This way, the IP address can optionally consist of the "IPv6:" > tag. I'm not sure if the IPv6: tag is Linux specific. If it DOES > consists of the IPv6: tag, the tag will not be removed. I am thinking, and again I am not a sendmail man, that the IPv6: is a sendmail designation for logging or other internal use. If you do a: host IPv6:2001:888:0:1::666 you get Host IPv6:2001:888:0:1::666 not found: 3(NXDOMAIN) but if you do: host 2001:888:0:1::666 you get 6.6.6.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0.0.0.0.0.8.8.8.0.1.0.0.2.ip6.arpa domain name pointer xs6.xs4all.nl. So as you can see the IPv6 is not actually part of the IP address and the code fragment is attempting to retrieve the IP address (hence the $message->{clientip} = $1; part). That is why I used (?:IPv6:)? which is non-capturing and leaves the $1 set as the actual IP portion of [IPv6:address] or [dotted quad address]. I haven't looked through all the code so I don't know if this address is used for anything other than logging. If it is, then it would be important that only an accurate address be returned. Anyway as you can verify by doing a lookup on the address in your example adding in the IPv6: portion results in an address that cannot be resolved, removing it results in a resolvable address. Rick > > Mike. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > > > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Apr 6 13:54:18 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn wrote: > > Well... I would've done it myself if I had the time... But Real > Work(tm) is limiting that resource for me ATM... > Aparantly Dahwal would've too, but failed somehow (can't imagine > how, seeing as it is so simple:-). > > Cheers > -- Glenn http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassin:bayes:sql btw, there is no mention or link of this wiki on the mailscanner.info site (none that i could spot easily) - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 14:00:03 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Rick Cooper > >I am thinking, and again I am not a sendmail man, that the IPv6: is a >sendmail designation for logging or other internal use. If you do a: > >host IPv6:2001:888:0:1::666 you get Host IPv6:2001:888:0:1::666 not found: >3(NXDOMAIN) > >but if you do: > >host 2001:888:0:1::666 you get >6.6.6.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0.0.0.0.0.8.8.8.0.1.0.0.2.ip6.arpa >domain name pointer xs6.xs4all.nl. Yes, this is absolutely true. The IPv6: tag is NOT part of the address itself of course. However, other applications (I seem to recall BIND) also use the IPv6: tag, so I'm not sure if it's sendmail specific. If it however is sendmail specific, then I think the tag should be removed as early as possible, in which case your solution is preferable. But that's not clear to me at this point. For the moment I'm using the same solution for MailWatch, since functions.php contains a function called get_mail_relays(), which is used by detail.php to show through which relays the mail has gone. At the moment I remove the IPv6: tag, since else the gethostbyaddr() fails (as with your example). >Rick Thanks, Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Wed Apr 6 14:46:30 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > Steen, Glenn wrote: > >> >> Well... I would've done it myself if I had the time... But Real >> Work(tm) is limiting that resource for me ATM... >> Aparantly Dahwal would've too, but failed somehow (can't imagine >> how, seeing as it is so simple:-). >> >> Cheers >> -- Glenn > > > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:spamassassin:bayes:sql > > > btw, there is no mention or link of this wiki on the mailscanner.info > site (none that i could spot easily) > Still in development i believe. > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wollie at FEYERABEND.LIS.BREMEN.DE Wed Apr 6 14:14:18 2005 From: wollie at FEYERABEND.LIS.BREMEN.DE (Wolfgang Kohnen (FEYERABEND)) Date: Thu Jan 12 21:29:15 2006 Subject: undoing mailscanner modifications before feeding into sa-learn Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi folks, I want to feed back spam and ham messages to the bayes filter. I've setup two shared folders (ham & spam) on my imap machine and a fetchmail which fetches the messages from there and puts it into sa-learn with fetchmails --mda feature. This works fine so far. The docs of sa-learn say, that it internally does some undos (like spamassassin -d) in order to remove mail headers which originates by spamassassin so that there is no bias reinforcement. My question: is sa-learn aware of how mailscanner modifies the message and can sa-learn undo it? How do I have to tweak mailscanner? For example, I will have to turn off disarming of html and other destructive conversions. Any experiences? The faq-o-matic doesn't note this issue at all. TIA, Wollie ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 6 15:07:46 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:15 2006 Subject: undoing mailscanner modifications before feeding into sa-learn Message-ID: Wolfgang in spam.assassin.prefs.conf you'll need something like.... bayes_ignore_header X-SSL-MailScanner bayes_ignore_header X-SSL-MailScanner-SpamCheck bayes_ignore_header X-SSL-MailScanner-SpamScore bayes_ignore_header X-SSL-MailScanner-Information bayes_ignore_header X-SSL-Mailscanner-From Where SSL needs to be replaced with the org-name setting in your MailScanner.conf Other settings should make much difference as the first thing sa-learn does is to token-ise the email... then run sa-learn -p /spam.assassin.prefs.cong --spam .... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Wolfgang Kohnen (FEYERABEND) wrote: > Hi folks, > > I want to feed back spam and ham messages to the bayes filter. I've > setup two shared folders (ham & spam) on my imap machine and a fetchmail > which fetches the messages from there and puts it into sa-learn with > fetchmails --mda feature. This works fine so far. > > The docs of sa-learn say, that it internally does some undos (like > spamassassin -d) in order to remove mail headers which originates by > spamassassin so that there is no bias reinforcement. > > My question: is sa-learn aware of how mailscanner modifies the message > and can sa-learn undo it? How do I have to tweak mailscanner? For > example, I will have to turn off disarming of html and other destructive > conversions. Any experiences? The faq-o-matic doesn't note this issue > at all. > > TIA, > Wollie > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Apr 6 15:29:32 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:15 2006 Subject: SA 3.0.2 and MySQL Message-ID: Yep, and that's why I directed you (dahwal) to Ugo (who is project lead in this). Anyway, very nice, thanks... and wellcome aboard. -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Pete Russell > Sent: den 6 april 2005 15:47 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: SA 3.0.2 and MySQL > > > Dhawal Doshy wrote: > > Steen, Glenn wrote: > > > >> > >> Well... I would've done it myself if I had the time... But Real > >> Work(tm) is limiting that resource for me ATM... > >> Aparantly Dahwal would've too, but failed somehow (can't imagine > >> how, seeing as it is so simple:-). > >> > >> Cheers > >> -- Glenn > > > > > > > http://wiki.mailscanner.info/doku.php?id=documentation:anti_sp am:spamassassin:bayes:sql > > > btw, there is no mention or link of this wiki on the mailscanner.info > site (none that i could spot easily) > Still in development i believe. > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wollie at FEYERABEND.LIS.BREMEN.DE Wed Apr 6 15:50:05 2005 From: wollie at FEYERABEND.LIS.BREMEN.DE (Wolfgang Kohnen (FEYERABEND)) Date: Thu Jan 12 21:29:15 2006 Subject: undoing mailscanner modifications before feeding into sa-learn Message-ID: Hi, Martin Hepworth schrieb: > Other settings should make much difference as the first thing sa-learn > does is to token-ise the email... can I tell MailScanner to attach spams as a mime attachment to a spam notification email and can sa-learn undo this? Thanks, Wollie ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 6 15:54:04 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:15 2006 Subject: undoing mailscanner modifications before feeding into sa-learn Message-ID: no sa-learn needs the emails pretty much intact with all the original headers.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Wolfgang Kohnen (FEYERABEND) wrote: > Hi, > > Martin Hepworth schrieb: > >> Other settings should make much difference as the first thing sa-learn >> does is to token-ise the email... > > > can I tell MailScanner to attach spams as a mime attachment > to a spam notification email and can sa-learn undo this? > > Thanks, > Wollie > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wollie at FEYERABEND.LIS.BREMEN.DE Wed Apr 6 16:00:13 2005 From: wollie at FEYERABEND.LIS.BREMEN.DE (Wolfgang Kohnen (FEYERABEND)) Date: Thu Jan 12 21:29:15 2006 Subject: undoing mailscanner modifications before feeding into sa-learn Message-ID: Martin Hepworth schrieb: > no > sa-learn needs the emails pretty much intact with all the original > headers.. > Hm, sad. Thanks! This is everything I need to know. Wollie ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From waldner at WALDNER.PRIV.AT Wed Apr 6 16:07:20 2005 From: waldner at WALDNER.PRIV.AT (Robert Waldner) Date: Thu Jan 12 21:29:15 2006 Subject: Problem with MailScanner, postfix and corrupt mails Message-ID: Since running with perl 5.6 isn't going to last, a colleague has written a perl script which converts the corrupted mails for bsmtp's use. Since a couple of you also have seen this problem, it might be helpful for you, too. Feedback welcoem ;) cheers, &rw ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 1.2, "corrupt2bsmtp.pl" Text/X-PERL (Name: ] [ "corrupt2bsmtp.pl") 334 lines. ] [ Unable to print this part. ] [ Part 1.3: "Attached Text" ] -- You know you have a bad personality when you swallow -- your pride and it gives you food poisoning. -- http://www.glasbergen.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Wed Apr 6 18:14:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am pretty sure the IPv6: leader is Linux-specific, it should just put the IP(v6) address in there. I certainly do not want the IPv6: included in the IP address inside MailScanner. So I'm going with Rick's suggestion below. Rick Cooper wrote: > if ($ip =~ /\[(?:IPv6:)?([\d.:abcdef]+)\]/) { So the relevant bit of Sendmail.pm (starting line 317) now reads: if ($Line =~ /^\$_/) { $ip = $Line; #chomp $ip; # Linux adds "IPv6:" on the front of the IPv6 address, so remove it if ($ip =~ /\[(?:IPv6:)?([\d.:abcdef]+)\]/) { $message->{clientip} = $1; } else { # It is a locally-created message and doesn't have an smtp client ip $message->{clientip} = '127.0.0.1'; } $IPFound = 1; # We have found the client IP address } -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michael at NOMENNESCIO.NET Wed Apr 6 18:57:39 2005 From: michael at NOMENNESCIO.NET (Mike) Date: Thu Jan 12 21:29:15 2006 Subject: MailScanner & IPv6 [SOLVED] Message-ID: [ The following text is in the "ISO-8859-15" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field > >I am pretty sure the IPv6: leader is Linux-specific, it should just put >the IP(v6) address in there. >I certainly do not want the IPv6: included in the IP address inside >MailScanner. >So I'm going with Rick's suggestion below. It seems the IPv6: tag is sendmail specific, not Linux. I went through some documentation of some IPv6 related services, i.e. ssh, sendmail and BIND. Although I first thought that the IPv6: tag also appeared in the other services, I was wrong. It's only mentioned in sendmail. The only place where I've also found them is in milters, but those are obviously sendmail related. Rick's solution is therefore the correct one. ;-) Thanks, Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 6 20:28:11 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:15 2006 Subject: Phishing net doesn't like backslashes... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please try this patch for Message.pm: -----SNIP----- --- Message.pm.old 2005-04-05 22:11:00.000000000 +0100 +++ Message.pm 2005-04-06 20:24:49.396377737 +0100 @@ -4729,6 +4729,7 @@ #print STDERR "Was $linkurl\n"; $linkurl = "" unless $linkurl =~ /[.\/]/; # Ignore if it is not a website at all $linkurl =~ s/\s+//g; # Remove any whitespace + $linkurl =~ s/\\/\//g; # Change \ to / as many browsers do this #print STDERR "Is $linkurl\n"; $linkurl = "" if $linkurl =~ /\@/ && $linkurl !~ /\//; # Ignore emails #$linkurl =~ s/(\<\/?[^>]*\>)*//ig; # Remove tags -----SNIP----- Seems to work for me. Let me know how you get on. John Wilcock wrote: >> MailScanner has >> detected a possible fraud attempt from "http:\\www.example.com" claiming >> to be http:\\www.example.com > > > Not that backslashes should ever be used in URIs, of course, but they > are occasionally seen in practice and are totally harmless. > > John. > > -- > -- Over 2500 webcams from ski resorts around the world - www.snoweye.com > -- Translate your technical documents and web pages - www.tradoc.fr > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kyle at MLUG.MISSOURI.EDU Thu Apr 7 00:29:05 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:16 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I just got back from on the road and tried uninstalling perl-Compress-Zlib again and ran the new install.sh script with the same errors. The link below has zlib-1.2.2.2-1 for an rpm. I have zlib-1.2.1.2-1 on my FC3 machine. I'm a little confused with this. Is perl-Compress-Zlib and zlib-1.2.2.2-1 the same and I can upgrade to zlib-1.2.2.2-1 to solve my problems with installing per-Compress-Zlib? Attached is the install.sh log and what errored out... Peter Russell wrote: > Raymon Dijkxhoorn have provided alternate zlib that work fine on FC3 and > RHEL4 (i pasted some of his post in below) - these were required to > compile clamav (which i guess we were all doing before installing MS and > therefore didnt have this problem) > > Is there any reason you would use FC3 over CentOS 4 for a mailscanner > machine? > > http://mailscanner.prolocation.net/ > > Or the direct links: > > http://mailscanner.prolocation.net/zlib/zlib-1.2.2.2-1.i386.rpm > http://mailscanner.prolocation.net/zlib/zlib-devel-1.2.2.2-1.i386.rpm > > > Julian Field wrote: > >> It is probably having trouble with Compress-Zlib. Try uninstalling >> perl-Compress-Zlib (rpm -e perl-Compress-Zlib) and then running >> install.sh again. >> >> perl-Archive-Zip itself doesn't do anything platform-dependent I think, >> it's Compress-Zlib that does the hard work. >> >> Kyle Krieg wrote: >> >>> I used your new install.sh script, and looks like it had a small >>> problem with perl-Archive-Zip. Here is the output from the >>> install...it's only failing on this one package.... >>> >>> >>> Julian Field wrote: >>> >>>> You have 2 packages installed both called "perl-5.8.5-9". Just 2 >>>> different architectures. >>>> That should break RPM :-( >>>> >>>> Please do >>>> >>>> rpm -ql perl | grep bin >>>> >>>> The install.sh script I just sent you works around this problem. >>>> >>>> >>>> Kyle Krieg wrote: >>>> >>>>> Here is the output from the commands you asked for. My install was >>>>> Fedora 3 base (full install) and the current yum updates. My yum >>>>> updates are pointing to livna server. >>>>> >>>>> Thanks!! >>>>> >>>>> Kyle >>>>> >>>>> >>>>> [root@skywalker framadmn]# rpm -qi perl >>>>> Name : perl Relocations: (not >>>>> relocatable) >>>>> Version : 5.8.5 Vendor: Red Hat, Inc. >>>>> Release : 9 Build Date: Tue 12 Oct >>>>> 2004 11:55:57 AM CDT >>>>> Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: >>>>> tweety.build.redh at.com >>>>> Group : Development/Languages Source RPM: >>>>> perl-5.8.5-9.src.rpm >>>>> Size : 28442178 License: Artistic >>>>> or GPL >>>>> Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID >>>>> b44269d04f2a6fd2 >>>>> Packager : Red Hat, Inc. *MailScanner has detected a possible >>>>> fraud >>>>> attempt from "bugzilla.redhat.com" claiming to be * >>>>> *MailScanner has detected a possible fraud attempt from >>>>> "bugzilla.redhat.com" claiming to be * >>>>> >>>>> URL : http://www.perl.org/ >>>>> Summary : The Perl programming language. >>>>> Description : >>>>> Perl is a high-level programming language with roots in C, sed, awk >>>>> and shell scripting. Perl is good at handling processes and files, >>>>> and is especially good at handling text. Perl's hallmarks are >>>>> practicality and efficiency. While it is used to do a lot of >>>>> different things, Perl's most common applications are system >>>>> administration utilities and web programming. A large proportion of >>>>> the CGI scripts on the web are written in Perl. You need the perl >>>>> package installed on your system so that your system can handle Perl >>>>> scripts. >>>>> >>>>> Install this package if you want to program in Perl or enable your >>>>> system to handle Perl scripts. >>>>> Name : perl Relocations: (not >>>>> relocatable) >>>>> Version : 5.8.5 Vendor: Red Hat, Inc. >>>>> Release : 9 Build Date: Tue 12 Oct >>>>> 2004 12:01:58 PM CDT >>>>> Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: >>>>> dolly.build.redha t.com >>>>> Group : Development/Languages Source RPM: >>>>> perl-5.8.5-9.src.rpm >>>>> Size : 34190638 License: Artistic >>>>> or GPL >>>>> Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID >>>>> b44269d04f2a6fd2 >>>>> Packager : Red Hat, Inc. *MailScanner has detected a possible >>>>> fraud >>>>> attempt from "bugzilla.redhat.com" claiming to be * >>>>> *MailScanner has detected a possible fraud attempt from >>>>> "bugzilla.redhat.com" claiming to be * >>>>> >>>>> URL : http://www.perl.org/ >>>>> Summary : The Perl programming language. >>>>> Description : >>>>> Perl is a high-level programming language with roots in C, sed, awk >>>>> and shell scripting. Perl is good at handling processes and files, >>>>> and is especially good at handling text. Perl's hallmarks are >>>>> practicality and efficiency. While it is used to do a lot of >>>>> different things, Perl's most common applications are system >>>>> administration utilities and web programming. A large proportion of >>>>> the CGI scripts on the web are written in Perl. You need the perl >>>>> package installed on your system so that your system can handle Perl >>>>> scripts. >>>>> >>>>> Install this package if you want to program in Perl or enable your >>>>> system to handle Perl scripts. >>>>> [root@skywalker framadmn]# rpm -qa | grep '^perl' >>>>> perl-LDAP-0.31-5 >>>>> perl-Compress-Zlib-1.33-6 >>>>> perl-Net-CIDR-0.10-1 >>>>> perl-XML-NamespaceSupport-1.08-6 >>>>> perl-XML-LibXML-1.58-1 >>>>> perl-RPM-Specfile-1.17-2 >>>>> perl-Convert-TNEF-0.17-3 >>>>> perl-5.8.5-9 >>>>> perl-libwww-perl-5.79-5 >>>>> perl-Time-HiRes-1.55-3 >>>>> perl-BSD-Resource-1.23-6 >>>>> perl-HTML-Tagset-3.03-30 >>>>> perl-Devel-Symdump-2.03-19 >>>>> perl-HTML-Parser-3.35-6 >>>>> perl-Convert-ASN1-0.18-3 >>>>> perl-XML-LibXML-Common-0.13-7 >>>>> perl-Convert-BinHex-1.119-2 >>>>> perl-MailTools-1.66-1 >>>>> perl-TimeDate-1.1301-3 >>>>> perl-Bit-Vector-6.3-3 >>>>> perl-RPM2-0.66-7 >>>>> perl-5.8.5-9 >>>>> perl-URI-1.30-4 >>>>> perl-XML-Dumper-0.71-2 >>>>> perl-Digest-SHA1-2.07-5 >>>>> perl-XML-Twig-3.13-6 >>>>> perl-Filter-Simple-0.79-4 >>>>> perl-Cyrus-2.2.10-3.fc3 >>>>> perl-DateManip-5.42a-3 >>>>> perl-XML-Encoding-1.01-26 >>>>> perl-XML-Grove-0.46alpha-27 >>>>> perl-IO-stringy-2.110-1 >>>>> perl-File-MMagic-1.21-2 >>>>> perl-TermReadKey-2.20-17 >>>>> perl-DBD-MySQL-2.9003-5 >>>>> perl-XML-Parser-2.34-5 >>>>> perl-Net-DNS-0.48-1 >>>>> perl-Crypt-SSLeay-0.51-5 >>>>> perl-NKF-2.04-3 >>>>> perl-Archive-Tar-1.08-3 >>>>> perl-Frontier-RPC-0.06-38 >>>>> perl-Inline-0.44-14 >>>>> perl-Filter-1.30-6 >>>>> perl-DBI-1.40-5 >>>>> perl-libxml-perl-0.07-30 >>>>> perl-Digest-HMAC-1.01-13 >>>>> perl-Parse-Yapp-1.05-32 >>>>> perl-Date-Calc-5.3-9 >>>>> perl-MIME-tools-5.417-1 >>>>> perl-Text-Kakasi-1.05-11 >>>>> perl-DBD-Pg-1.31-6 >>>>> perl-Parse-RecDescent-1.94-4 >>>>> perl-PDL-2.4.1-5 >>>>> perl-libxml-enno-1.02-31 >>>>> perl-XML-SAX-0.12-7 >>>>> perl-SGMLSpm-1.03ii-14 >>>>> perl-suidperl-5.8.5-9.1 >>>>> [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} >>>>> %{ARCH}\n' perl >>>>> perl 5.8.5 i386 >>>>> perl 5.8.5 x86_64 >>>>> [root@skywalker framadmn]# which perl >>>>> /usr/bin/perl >>>>> [root@skywalker framadmn]# perl -v >>>>> >>>>> This is perl, v5.8.5 built for x86_64-linux-thread-multi >>>>> >>>>> Copyright 1987-2004, Larry Wall >>>>> >>>>> Perl may be copied only under the terms of either the Artistic >>>>> License >>>>> or the >>>>> GNU General Public License, which may be found in the Perl 5 source >>>>> kit. >>>>> >>>>> Complete documentation for Perl, including FAQ lists, should be >>>>> found on >>>>> this system using `man perl' or `perldoc perl'. If you have access >>>>> to the >>>>> Internet, point your browser at http://www.perl.com/, the Perl Home >>>>> Page. >>>>> >>>>> [root@skywalker framadmn]# >>>>> >>>>> >>>>> >>>>> Julian Field wrote: >>>>> >>>>>> I think it actually built stuff okay, but has calculated the >>>>>> architecture wrongly. >>>>>> Please can you send me the output of >>>>>> rpm -qi perl >>>>>> rpm -qa | grep '^perl' >>>>>> rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl >>>>>> which perl >>>>>> perl -v >>>>>> >>>>>> For some reason it is picking up both i386 and x86_64 as the >>>>>> architecture, when it should just be x86_64 (which is what RHEL4 >>>>>> returns). >>>>>> >>>>>> That bunch of commands should give me an idea what is happening. >>>>>> >>>>>> Kyle Krieg wrote: >>>>>> >>>>>>> Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. >>>>>>> Thanks for looking into this Julian. I've been using >>>>>>> Mailscanner for >>>>>>> 2 years now on a RH 8.0 machine with no issues. >>>>>>> >>>>>>> I've also show the following errors when using the install.sh >>>>>>> script. >>>>>>> Looks like to me, the install scripts it looking for packages in >>>>>>> the >>>>>>> i386x86_64 directory, which is not there. All the packages are in >>>>>>> either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or >>>>>>> /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. >>>>>>> >>>>>>> There are two outputs below, the first from the rpmbuild -bc >>>>>>> perl-Archive-Zip.spec and another from when I try and reinstall >>>>>>> MailScanner from the install.sh script. I've cut out most of it >>>>>>> and >>>>>>> only given the errors that I think are important, but have the >>>>>>> whole >>>>>>> install log, if you would like it see it. >>>>>>> >>>>>>> Kyle >>>>>>> >>>>>>> ************************************************ >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> Julian Field >>>>>> www.MailScanner.info >>>>>> Buy the MailScanner book at www.MailScanner.info/store >>>>>> Professional Support Services at www.MailScanner.biz >>>>>> MailScanner thanks transtec Computers for their support >>>>>> >>>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>>>> >>>>>> ------------------------ MailScanner list ------------------------ >>>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>> 'leave mailscanner' in the body of the email. >>>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>>> >>>>> ------------------------ MailScanner list ------------------------ >>>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>> 'leave mailscanner' in the body of the email. >>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >>>>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> *Support MailScanner development - buy the book off the website!* >>>> >>>> >>>> >>>> >>>> >>>> -- >>>> Julian Field >>>> www.MailScanner.info >>>> Buy the MailScanner book at www.MailScanner.info/store >>>> Professional Support Services at www.MailScanner.biz >>>> MailScanner thanks transtec Computers for their support >>>> >>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) >>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> *Support MailScanner development - buy the book off the website!* >> >> >> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2: "Attached Text" ] Attempting to build and install perl-Compress-Zlib-1.33-2 Detected Compress-Zlib, building appropriately... Installing perl-Compress-Zlib-1.33-2.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.15945 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Compress-Zlib-1.33 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Compress-Zlib-1.33.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Compress-Zlib-1.33 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.15945 + umask 022 + cd /usr/src/redhat/BUILD + cd Compress-Zlib-1.33 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Compress-Zlib-1.33-2-root/usr Parsing config.in... Building Zlib enabled Looks Good. Up/Downgrade complete. Checking if your kit is complete... Looks good Writing Makefile for Compress::Zlib + make cp Zlib.pm blib/lib/Compress/Zlib.pm AutoSplitting blib/lib/Compress/Zlib.pm (blib/lib/auto/Compress/Zlib) /usr/bin/perl /usr/lib/perl5/5.8.5/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.5/ExtUtils/typemap -typemap typemap Zlib.xs > Zlib.xsc && mv Zlib.xsc Zlib.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" Zlib.c Zlib.xs: In function `XS_Compress__Zlib__inflateStream_inflate': Zlib.xs:982: warning: comparison is always false due to limited range of data type Zlib.xs: In function `XS_Compress__Zlib__inflateStream_inflateSync': Zlib.xs:1017: warning: comparison is always false due to limited range of data type gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" adler32.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" compress.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" crc32.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" gzio.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" uncompr.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" deflate.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" trees.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" zutil.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" inflate.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" infblock.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" inftrees.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" infcodes.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" infutil.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" inffast.c Running Mkbootstrap for Compress::Zlib () chmod 644 Zlib.bs rm -f blib/arch/auto/Compress/Zlib/Zlib.so gcc -shared Zlib.o adler32.o compress.o crc32.o gzio.o uncompr.o deflate.o trees.o zutil.o inflate.o infblock.o inftrees.o infcodes.o infutil.o inffast.o -o blib/arch/auto/Compress/Zlib/Zlib.so chmod 755 blib/arch/auto/Compress/Zlib/Zlib.so cp Zlib.bs blib/arch/auto/Compress/Zlib/Zlib.bs chmod 644 blib/arch/auto/Compress/Zlib/Zlib.bs Manifying blib/man3/Compress::Zlib.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/01version..... t/01version.....ok 1/1 t/01version.....ok t/02zlib........ t/02zlib........ok 1/239 t/02zlib........ok 2/239 t/02zlib........ok 3/239 t/02zlib........ok 4/239 t/02zlib........ok 5/239 t/02zlib........ok 6/239 t/02zlib........ok 7/239 t/02zlib........ok 8/239 t/02zlib........ok 9/239 t/02zlib........ok 10/239 t/02zlib........ok 11/239 t/02zlib........ok 12/239 t/02zlib........ok 13/239 t/02zlib........ok 14/239 t/02zlib........ok 15/239 t/02zlib........ok 16/239 t/02zlib........ok 17/239 t/02zlib........ok 18/239 t/02zlib........ok 19/239 t/02zlib........ok 20/239 t/02zlib........ok 21/239 t/02zlib........ok 22/239 t/02zlib........ok 23/239 t/02zlib........ok 24/239 t/02zlib........ok 25/239 t/02zlib........ok 26/239 t/02zlib........ok 27/239 t/02zlib........ok 28/239 t/02zlib........ok 29/239 t/02zlib........ok 30/239 t/02zlib........ok 31/239 t/02zlib........ok 32/239 t/02zlib........ok 33/239 t/02zlib........ok 34/239 t/02zlib........ok 35/239 t/02zlib........ok 36/239 t/02zlib........ok 37/239 t/02zlib........ok 38/239 t/02zlib........ok 39/239 t/02zlib........ok 40/239 t/02zlib........ok 41/239 t/02zlib........ok 42/239 t/02zlib........ok 43/239 t/02zlib........ok 44/239 t/02zlib........ok 45/239 t/02zlib........ok 46/239 t/02zlib........ok 47/239 t/02zlib........ok 48/239 t/02zlib........ok 49/239 t/02zlib........ok 50/239 t/02zlib........ok 51/239 t/02zlib........ok 52/239 t/02zlib........ok 53/239 t/02zlib........ok 54/239 t/02zlib........ok 55/239 t/02zlib........ok 56/239 t/02zlib........ok 57/239 t/02zlib........ok 58/239 t/02zlib........ok 59/239 t/02zlib........ok 60/239 t/02zlib........ok 61/239 t/02zlib........ok 62/239 t/02zlib........ok 63/239 t/02zlib........ok 64/239 t/02zlib........ok 65/239 t/02zlib........ok 66/239 t/02zlib........ok 67/239 t/02zlib........ok 68/239 t/02zlib........ok 69/239 t/02zlib........ok 70/239 t/02zlib........ok 71/239 t/02zlib........ok 72/239 t/02zlib........ok 73/239 t/02zlib........ok 74/239 t/02zlib........ok 75/239 t/02zlib........ok 76/239 t/02zlib........ok 77/239 t/02zlib........ok 78/239 t/02zlib........ok 79/239 t/02zlib........ok 80/239 t/02zlib........ok 81/239 t/02zlib........ok 82/239 t/02zlib........ok 83/239 t/02zlib........ok 84/239 t/02zlib........ok 85/239 t/02zlib........ok 86/239 t/02zlib........ok 87/239 t/02zlib........ok 88/239 t/02zlib........ok 89/239 t/02zlib........ok 90/239 t/02zlib........ok 91/239 t/02zlib........ok 92/239 t/02zlib........ok 93/239 t/02zlib........ok 94/239 t/02zlib........ok 95/239 t/02zlib........ok 96/239 t/02zlib........ok 97/239 t/02zlib........ok 98/239 t/02zlib........ok 99/239 t/02zlib........ok 100/239 t/02zlib........ok 101/239 t/02zlib........ok 102/239 t/02zlib........ok 103/239 t/02zlib........ok 104/239 t/02zlib........ok 105/239 t/02zlib........ok 106/239 t/02zlib........ok 107/239 t/02zlib........ok 108/239 t/02zlib........ok 109/239 t/02zlib........ok 110/239 t/02zlib........ok 111/239 t/02zlib........ok 112/239 t/02zlib........ok 113/239 t/02zlib........ok 114/239 t/02zlib........ok 115/239 t/02zlib........ok 116/239 t/02zlib........ok 117/239 t/02zlib........ok 118/239 t/02zlib........ok 119/239 t/02zlib........ok 120/239 t/02zlib........ok 121/239 t/02zlib........ok 122/239 t/02zlib........ok 123/239 t/02zlib........ok 124/239 t/02zlib........ok 125/239 t/02zlib........ok 126/239 t/02zlib........ok 127/239 t/02zlib........ok 128/239 t/02zlib........ok 129/239 t/02zlib........ok 130/239 t/02zlib........ok 131/239 t/02zlib........ok 132/239 t/02zlib........ok 133/239 t/02zlib........ok 134/239 t/02zlib........ok 135/239 t/02zlib........ok 136/239 t/02zlib........ok 137/239 t/02zlib........ok 138/239 t/02zlib........ok 139/239 t/02zlib........ok 140/239 t/02zlib........ok 141/239 t/02zlib........ok 142/239 t/02zlib........ok 143/239 t/02zlib........ok 144/239 t/02zlib........ok 145/239 t/02zlib........ok 146/239 t/02zlib........ok 147/239 t/02zlib........ok 148/239 t/02zlib........ok 149/239 t/02zlib........ok 150/239 t/02zlib........ok 151/239 t/02zlib........ok 152/239 t/02zlib........ok 153/239 t/02zlib........ok 154/239 t/02zlib........ok 155/239 t/02zlib........ok 156/239 t/02zlib........ok 157/239 t/02zlib........ok 158/239 t/02zlib........ok 159/239 t/02zlib........ok 160/239 t/02zlib........ok 161/239 t/02zlib........ok 162/239 t/02zlib........ok 163/239 t/02zlib........ok 164/239 t/02zlib........ok 165/239 t/02zlib........ok 166/239 t/02zlib........ok 167/239 t/02zlib........ok 168/239 t/02zlib........ok 169/239 t/02zlib........ok 170/239 t/02zlib........ok 171/239 t/02zlib........ok 172/239 t/02zlib........ok 173/239 t/02zlib........ok 174/239 t/02zlib........ok 175/239 t/02zlib........ok 176/239 t/02zlib........ok 177/239 t/02zlib........ok 178/239 t/02zlib........ok 179/239 t/02zlib........ok 180/239 t/02zlib........ok 181/239 t/02zlib........ok 182/239 t/02zlib........ok 183/239 t/02zlib........ok 184/239 t/02zlib........ok 185/239 t/02zlib........ok 186/239 t/02zlib........ok 187/239 t/02zlib........ok 188/239 t/02zlib........ok 189/239 t/02zlib........ok 190/239 t/02zlib........ok 191/239 t/02zlib........ok 192/239 t/02zlib........ok 193/239 t/02zlib........ok 194/239 t/02zlib........ok 195/239 t/02zlib........ok 196/239 t/02zlib........ok 197/239 t/02zlib........ok 198/239 t/02zlib........ok 199/239 t/02zlib........ok 200/239 t/02zlib........ok 201/239 t/02zlib........ok 202/239 t/02zlib........ok 203/239 t/02zlib........ok 204/239 t/02zlib........ok 205/239 t/02zlib........ok 206/239 t/02zlib........ok 207/239 t/02zlib........ok 208/239 t/02zlib........ok 209/239 t/02zlib........ok 210/239 t/02zlib........ok 211/239 t/02zlib........ok 212/239 t/02zlib........ok 213/239 t/02zlib........ok 214/239 t/02zlib........ok 215/239 t/02zlib........ok 216/239 t/02zlib........ok 217/239 t/02zlib........ok 218/239 t/02zlib........ok 219/239 t/02zlib........ok 220/239 t/02zlib........ok 221/239 t/02zlib........ok 222/239 t/02zlib........ok 223/239 t/02zlib........ok 224/239 t/02zlib........ok 225/239 t/02zlib........ok 226/239 t/02zlib........ok 227/239 t/02zlib........ok 228/239 t/02zlib........ok 229/239 t/02zlib........ok 230/239 t/02zlib........ok 231/239 t/02zlib........ok 232/239 t/02zlib........ok 233/239 t/02zlib........ok 234/239 t/02zlib........ok 235/239 t/02zlib........ok 236/239 t/02zlib........ok 237/239 t/02zlib........ok 238/239 t/02zlib........ok 239/239 t/02zlib........ok t/03examples.... t/03examples....ok 1/13 t/03examples....ok 2/13 t/03examples....ok 3/13 t/03examples....ok 4/13 t/03examples....ok 5/13 t/03examples....ok 6/13 t/03examples....ok 7/13 t/03examples....ok 8/13 t/03examples....ok 9/13 t/03examples....ok 10/13 t/03examples....ok 11/13 t/03examples....ok 12/13 t/03examples....ok 13/13 t/03examples....ok t/04encoding.... t/04encoding....ok 1/15 t/04encoding....ok 2/15 t/04encoding....ok 3/15 t/04encoding....ok 4/15 t/04encoding....ok 5/15 t/04encoding....ok 6/15 t/04encoding....ok 7/15 t/04encoding....ok 8/15 t/04encoding....ok 9/15 t/04encoding....ok 10/15 t/04encoding....ok 11/15 t/04encoding....ok 12/15 t/04encoding....ok 13/15 t/04encoding....ok 14/15 t/04encoding....ok 15/15 t/04encoding....ok t/05gzsetp...... t/05gzsetp......ok 1/11 t/05gzsetp......ok 2/11 t/05gzsetp......ok 3/11 t/05gzsetp......ok 4/11 t/05gzsetp......ok 5/11 t/05gzsetp......ok 6/11 t/05gzsetp......ok 7/11 t/05gzsetp......ok 8/11 t/05gzsetp......ok 9/11 t/05gzsetp......ok 10/11 t/05gzsetp......ok 11/11 t/05gzsetp......ok t/06gzdopen..... t/06gzdopen.....ok 1/23 t/06gzdopen.....ok 2/23 t/06gzdopen.....ok 3/23 t/06gzdopen.....ok 4/23 t/06gzdopen.....ok 5/23 t/06gzdopen.....ok 6/23 t/06gzdopen.....ok 7/23 t/06gzdopen.....ok 8/23 t/06gzdopen.....ok 9/23 t/06gzdopen.....ok 10/23 t/06gzdopen.....ok 11/23 t/06gzdopen.....ok 12/23 t/06gzdopen.....ok 13/23 t/06gzdopen.....ok 14/23 t/06gzdopen.....ok 15/23 t/06gzdopen.....ok 16/23 t/06gzdopen.....ok 17/23 t/06gzdopen.....ok 18/23 t/06gzdopen.....ok 19/23 t/06gzdopen.....ok 20/23 t/06gzdopen.....ok 21/23 t/06gzdopen.....ok 22/23 t/06gzdopen.....ok 23/23 t/06gzdopen.....ok All tests successful. Files=6, Tests=302, 1 wallclock secs ( 0.48 cusr + 0.15 csys = 0.63 CPU) + exit 0 Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.54310 + umask 022 + cd /usr/src/redhat/BUILD + cd Compress-Zlib-1.33 + LANG=C + export LANG + unset DISPLAY + rm -rf /var/tmp/perl-Compress-Zlib-1.33-2-root ++ perl -V:installarchlib + eval 'installarchlib='\''/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi'\'';' ++ installarchlib=/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi + mkdir -p /var/tmp/perl-Compress-Zlib-1.33-2-root//usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi + make install Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.so Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.bs Files found in blib/arch: installing files in blib/lib into architecture dependent library tree Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/Compress/Zlib.pm Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/autosplit.ix Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/share/man/man3/Compress::Zlib.3pm Writing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/.packlist Appending installation info to /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/perllocal.pod + '[' -x /usr/lib/rpm/brp-compress ']' + /usr/lib/rpm/brp-compress + find /var/tmp/perl-Compress-Zlib-1.33-2-root/usr -type f -print + sed 's@^/var/tmp/perl-Compress-Zlib-1.33-2-root@@g' + grep -v perllocal.pod + grep -v '\.packlist' ++ cat Compress-Zlib-1.33-filelist + '[' '/usr/share/man/man3/Compress::Zlib.3pm.gz /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/Compress/Zlib.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/autosplit.ix /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.so /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.bsX' = X ']' + /usr/lib/rpm/find-debuginfo.sh /usr/src/redhat/BUILD/Compress-Zlib-1.33 extracting debug info from /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.so cpio: Compress-Zlib-1.33/: No such file or directory 723 blocks + /usr/lib/rpm/redhat/brp-compress + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-static-archive /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump Processing files: perl-Compress-Zlib-1.33-2 Provides: Zlib.so()(64bit) perl(Compress::Zlib) = 1.33 Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(VersionedDependencies) <= 3.0.3-1 Requires: libc.so.6()(64bit) libc.so.6(GLIBC_2.2.5)(64bit) perl >= 0:5.004 perl(AutoLoader) perl(Carp) perl(DynaLoader) perl(Exporter) perl(IO::Handle) perl(constant) perl(strict) perl(warnings) Processing files: perl-Compress-Zlib-debuginfo-1.33-2 Provides: Zlib.so.debug()(64bit) Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/perl-Compress-Zlib-1.33-2-root warning: Installed (but unpackaged) file(s) found: /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/perllocal.pod /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/.packlist Wrote: /usr/src/redhat/RPMS/x86_64/perl-Compress-Zlib-1.33-2.x86_64.rpm Wrote: /usr/src/redhat/RPMS/x86_64/perl-Compress-Zlib-debuginfo-1.33-2.x86_64.rpm Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.72190 + umask 022 + cd /usr/src/redhat/BUILD + cd Compress-Zlib-1.33 + rm -rf /var/tmp/perl-Compress-Zlib-1.33-2-root + exit 0 Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.72190 + umask 022 + cd /usr/src/redhat/BUILD + rm -rf Compress-Zlib-1.33 + exit 0 Do not worry too much about errors from the next command. It is quite likely that some of the Perl modules are already installed on your system. The important ones are HTML-Parser and MIME-tools. Preparing... (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H# (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H#### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H##### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H###### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H####### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############ (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############# (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################ (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################# (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H#################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H##################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H###################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H####################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################ (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################# (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################ (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################# (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H#################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H##################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H###################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H####################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################################### [100%] 1:perl-Compress-Zlib ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H# ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H## ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H### ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H#### ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H##### ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H###### ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H####### ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######## ( 20%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########## ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############ ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############# ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############## ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################ ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################# ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################## ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H#################### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H##################### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H###################### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H####################### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################## ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################### ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################## ( 61%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################ ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################# ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################## ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H############################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################ ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################# ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################## ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H################################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H#################################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H##################################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H###################################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H####################################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################################## ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H######################################### ( 94%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################################## (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################################### (100%)^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H########################################### [100%] Attempting to build and install perl-Archive-Zip-1.14-1 Installing perl-Archive-Zip-1.14-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.82128 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Archive-Zip-1.14 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Archive-Zip-1.14.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Archive-Zip-1.14 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.82128 + umask 022 + cd /usr/src/redhat/BUILD + cd Archive-Zip-1.14 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Archive-Zip-1.14-1-root/usr Checking if your kit is complete... Looks good Writing Makefile for Archive::Zip + make cp lib/Archive/Zip.pod blib/lib/Archive/Zip.pod cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm cp crc32 blib/script/crc32 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/crc32 Manifying blib/man3/Archive::Zip::Tree.3pm Manifying blib/man3/Archive::Zip.3pm Manifying blib/man3/Archive::Zip::FAQ.3pm Manifying blib/man3/Archive::Zip::MemberRead.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/test.............. t/test..............ok 1/123 t/test..............ok 2/123 t/test..............ok 3/123 t/test..............ok 4/123 t/test..............ok 5/123 t/test..............ok 6/123 t/test..............ok 7/123 t/test..............ok 8/123 t/test..............ok 9/123 t/test..............ok 10/123 t/test..............ok 11/123 t/test..............ok 12/123 t/test..............ok 13/123 t/test..............ok 14/123 t/test..............ok 15/123 t/test..............ok 16/123 t/test..............ok 17/123 t/test..............ok 18/123 t/test..............ok 19/123 t/test..............ok 20/123 t/test..............ok 21/123 t/test..............ok 22/123 t/test..............ok 23/123 t/test..............ok 24/123 t/test..............ok 25/123 t/test..............ok 26/123 t/test..............ok 27/123 t/test..............ok 28/123 t/test..............ok 29/123 t/test..............ok 30/123 t/test..............ok 31/123 t/test..............ok 32/123 t/test..............ok 33/123 t/test..............ok 34/123 t/test..............ok 35/123 t/test..............ok 36/123 t/test..............ok 37/123 t/test..............ok 38/123 t/test..............ok 39/123 t/test..............ok 40/123 t/test..............ok 41/123 t/test..............ok 42/123 t/test..............ok 43/123 t/test..............ok 44/123 t/test..............ok 45/123 t/test..............ok 46/123 t/test..............ok 47/123 t/test..............ok 48/123 t/test..............ok 49/123 t/test..............ok 50/123 t/test..............ok 51/123 t/test..............ok 52/123 t/test..............ok 53/123 t/test..............ok 54/123 t/test..............ok 55/123 t/test..............ok 56/123 t/test..............ok 57/123 t/test..............ok 58/123 t/test..............ok 59/123 t/test..............ok 60/123 t/test..............ok 61/123 t/test..............ok 62/123 t/test..............ok 63/123 t/test..............ok 64/123 t/test..............ok 65/123 t/test..............ok 66/123 t/test..............ok 67/123 t/test..............ok 68/123 t/test..............ok 69/123 t/test..............ok 70/123 t/test..............ok 71/123 t/test..............ok 72/123 t/test..............ok 73/123 t/test..............ok 74/123 t/test..............ok 75/123 t/test..............ok 76/123 t/test..............ok 77/123 t/test..............ok 78/123 t/test..............ok 79/123 t/test..............ok 80/123 t/test..............ok 81/123 t/test..............ok 82/123 t/test..............ok 83/123 t/test..............ok 84/123 t/test..............ok 85/123 t/test..............ok 86/123 t/test..............ok 87/123 t/test..............ok 88/123 t/test..............ok 89/123 t/test..............ok 90/123 t/test..............ok 91/123 t/test..............ok 92/123 t/test..............ok 93/123 t/test..............ok 94/123 t/test..............ok 95/123 t/test..............ok 96/123 t/test..............ok 97/123 t/test..............ok 98/123 t/test..............ok 99/123 t/test..............ok 100/123 t/test..............ok 101/123 t/test..............ok 102/123 t/test..............ok 103/123 t/test..............ok 104/123 t/test..............ok 105/123 t/test..............ok 106/123 t/test..............ok 107/123 t/test..............ok 108/123 t/test..............ok 109/123 t/test..............ok 110/123 t/test..............ok 111/123 t/test..............ok 112/123 t/test..............ok 113/123 t/test..............ok 114/123 t/test..............ok 115/123 t/test..............ok 116/123 t/test..............ok 117/123 t/test..............ok 118/123 t/test..............ok 119/123 t/test..............ok 120/123 t/test..............ok 121/123 t/test..............ok 122/123 t/test..............ok 123/123 t/test..............ok t/testex............ t/testex............NOK 1# Test 1 got: "256" (t/testex.t at line 37) # Expected: "0" # t/testex.t line 37 is: ok( runPerlCommand( 'examples/copy.pl', INPUTZIP, OUTPUTZIP ), 0 ); t/testex............NOK 2# Test 2 got: "256" (t/testex.t at line 39) # Expected: "0" # t/testex.t line 39 is: ok( runPerlCommand( 'examples/extract.pl', OUTPUTZIP, ZFILENAME ), 0 ); t/testex............NOK 3# Test 3 got: "256" (t/testex.t at line 41) # Expected: "0" # t/testex.t line 41 is: ok( runPerlCommand( 'examples/mfh.pl', INPUTZIP ), 0 ); t/testex............NOK 4# Test 4 got: "256" (t/testex.t at line 43) # Expected: "0" # t/testex.t line 43 is: ok( runPerlCommand( 'examples/zip.pl', OUTPUTZIP, INPUTZIP, FILENAME ), 0 ); t/testex............NOK 5# Test 5 got: "256" (t/testex.t at line 46) # Expected: "0" # t/testex.t line 46 is: ok( $status, 0 ); t/testex............NOK 6# Test 6 got: "256" (t/testex.t at line 51) # Expected: "0" # t/testex.t line 51 is: ok( $status, 0 ); t/testex............NOK 7# Test 7 got: "256" (t/testex.t at line 56) # Expected: "0" # t/testex.t line 56 is: ok( $status, 0 ); t/testex............NOK 8# Test 8 got: "" (t/testex.t at line 57) # Expected: "testdir/testing.txt:100\n" # t/testex.t line 57 is: ok( $output, ZFILENAME . ":100\n" ); t/testex............NOK 9# Test 9 got: "256" (t/testex.t at line 66) # Expected: "0" # t/testex.t line 66 is: ok( runPerlCommand( 'examples/selfex.pl', OUTPUTZIP, FILENAME ), 0 ); t/testex............NOK 10# Test 10 got: "256" (t/testex.t at line 68) # Expected: "0" # t/testex.t line 68 is: ok( runPerlCommand(OUTPUTZIP), 0 ); t/testex............NOK 11# Test 11 got: (t/testex.t at line 72) # Expected: "1" (extracted/testdir/testing.txt exists) # t/testex.t line 72 is: ok( -f $fn, 1, "$fn exists" ); t/testex............NOK 12# Test 12 got: "256" (t/testex.t at line 81) # Expected: "0" (updateTree.pl create) # t/testex.t line 81 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl create" ); t/testex............NOK 13# Test 13 got: (t/testex.t at line 82) # Expected: "1" (zip created) # t/testex.t line 82 is: ok( -f OUTPUTZIP, 1, "zip created" ); t/testex............NOK 14# Test 14 got: "256" (t/testex.t at line 83) # Expected: "0" (updateTree.pl update) # t/testex.t line 83 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl update" ); t/testex............NOK 15# Test 15 got: (t/testex.t at line 84) # Expected: "1" (zip updated) # t/testex.t line 84 is: ok( -f OUTPUTZIP, 1, "zip updated" ); t/testex............FAILED tests 1-15 Failed 15/15 tests, 0.00% okay t/testMemberRead.... t/testMemberRead....ok 1/7 t/testMemberRead....ok 2/7 t/testMemberRead....ok 3/7 t/testMemberRead....ok 4/7 t/testMemberRead....ok 5/7 t/testMemberRead....ok 6/7 t/testMemberRead....ok 7/7 t/testMemberRead....ok t/testTree.......... t/testTree..........ok 1/6 t/testTree..........ok 2/6 t/testTree..........ok 3/6 t/testTree..........ok 4/6 t/testTree..........ok 5/6 t/testTree..........ok 6/6 t/testTree..........ok t/testUpdate........ t/testUpdate........ok 1/12 t/testUpdate........ok 2/12 t/testUpdate........ok 3/12 t/testUpdate........ok 4/12 t/testUpdate........ok 5/12 t/testUpdate........ok 6/12 t/testUpdate........ok 7/12 t/testUpdate........ok 8/12 t/testUpdate........ok 9/12 t/testUpdate........ok 10/12 t/testUpdate........ok 11/12 t/testUpdate........ok 12/12 t/testUpdate........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/testex.t 15 15 100.00% 1-15 Failed 1/5 test scripts, 80.00% okay. 15/163 subtests failed, 90.80% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.82128 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.82128 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.14-1.noarch.rpm. Maybe it did not build correctly? Installing tnef decoder ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Apr 7 08:59:32 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:16 2006 Subject: test email Message-ID: All just a test to make sure I'm getting list emails.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Thu Apr 7 09:59:54 2005 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:29:16 2006 Subject: Phishing net doesn't like backslashes... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Please try this patch for Message.pm: ... > Seems to work for me. Let me know how you get on. Seems fine here too. Thanks Julian. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From carinus.carelse at MRC.AC.ZA Thu Apr 7 13:38:05 2005 From: carinus.carelse at MRC.AC.ZA (Carinus Carelse) Date: Thu Jan 12 21:29:16 2006 Subject: [Mailwatch-users] Problem with MSQL Message-ID: I have setup the mysql and it is working well except that it doesn't seen to log everything and then I get this message in the dbitrace.log. Then whenever i try to write to the database I just get the DBI:END. Can anyone help me with this problem. -> commit for DBD::mysql::db (DBI::db=HASH(0x1060e80)~0x105af3c) Commmit ineffective while AutoCommit is on warning 20 recorded: Commmit ineffective while AutoCommit is on !! ERROR: 20 'Commmit ineffective while AutoCommit is on' (err#0) <- commit= 1 at MailWatch.pm line 93 -> disconnect for DBD::mysql::db (DBI::db=HASH(0x1060e80)~0x105af3c) &imp_dbh->mysql: 103c830 <- disconnect= 1 at MailWatch.pm line 94 -- DBI::END -> disconnect_all for DBD::mysql::dr (DBI::dr=HASH(0x6fb028)~0x1061f64) <- disconnect_all= (not implemented) at DBI.pm line 677 ! -> DESTROY for DBD::mysql::st (DBI::st=HASH(0x103668c)~INNER) ! <- DESTROY= undef during global destruction ! -> DESTROY for DBD::mysql::db (DBI::db=HASH(0x105af3c)~INNER) ! <- DESTROY= undef during global destruction ! -> DESTROY in DBD::_::common for DBD::mysql::dr (DBI::dr=HASH(0x1061f64)~INNER) ! <- DESTROY= undef during global destruction -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END -- DBI::END ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Andreas.Doerfler at KEMPTEN.DE Thu Apr 7 14:12:50 2005 From: Andreas.Doerfler at KEMPTEN.DE ([iso-8859-1] Dörfler Andreas) Date: Thu Jan 12 21:29:16 2006 Subject: [Mailwatch-users] Problem with MSQL Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] please dont crosspost to mailwatch and mailscanner list ! greetings andy --free your mind, use open source http://www.mono-project.com ASCII ribbon campaign ( ) - against HTML email X & vCards / \ -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Carinus Carelse Sent: Thursday, April 07, 2005 2:38 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: [Mailwatch-users] Problem with MSQL I have setup the mysql and it is working well except that it doesn't seen to log everything and then I get this message in the dbitrace.log. Then whenever i try to write to the database I just get the DBI:END. Can anyone help me with this problem. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Thu Apr 7 15:31:05 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:16 2006 Subject: Starting from scratch Message-ID: I didn't know if I should continue this topic or start a new one. I have gotten thus far with installing MailScanner, but I cannot figure out what I have done wrong or haven't done yet. 1. Downloaded CentOS4 and installed with most server packages, development packages, sendmail, spamassassin. 2. Installed this mailscanner: Version 4.40.11-1 for RedHat and Mandrake Linux (and other RPM-based Linux distributions) 3. Ran these commands: Chkconfig --level all sendmail off Chkconfig --leve 345 MailScanner on Service sendmail stop Service MailScanner start 4. I changed the following files (my mailscanner is a gateway to a Microsoft Exchange machine: Mailertable Woodmaclaw.com esmtp:[10.1.1.2] www.woowmaclaw.com esmtp:[10.1.1.2] ran the command make -C /etc/mail relaydomains woodmaclaw.com www.woodmaclaw.com mailscanner.conf various options, but mostly default. No virus scanners, as I have not installed them yet Turned on spamassassin 5. restarted MailScanner several times. 6. Info... I do not see any errors, here are some entries of my maillog: Apr 7 09:25:34 dell8600 MailScanner[22695]: Using locktype = flock Apr 7 09:25:38 dell8600 MailScanner[22685]: MailScanner child caught a SIGHUP Apr 7 09:25:38 dell8600 MailScanner[22693]: MailScanner child caught a SIGHUP Apr 7 09:25:38 dell8600 MailScanner[22689]: MailScanner child caught a SIGHUP Apr 7 09:25:38 dell8600 MailScanner[22692]: MailScanner child caught a SIGHUP Apr 7 09:25:38 dell8600 MailScanner[22695]: MailScanner child caught a SIGHUP Apr 7 09:25:49 dell8600 sendmail[22741]: alias database /etc/aliases rebuilt by bpumphrey Apr 7 09:25:49 dell8600 sendmail[22741]: /etc/aliases: 78 aliases, longest 10 b ytes, 802 bytes total Apr 7 09:25:49 dell8600 sendmail[22749]: starting daemon (8.13.1): SMTP Apr 7 09:25:49 dell8600 sm-msp-queue[22753]: starting daemon (8.13.1): queueing @00:15:00 Apr 7 09:25:49 dell8600 sendmail[22758]: starting daemon (8.13.1): queueing@00: 15:00 Apr 7 09:25:53 dell8600 MailScanner[22777]: MailScanner E-Mail Virus Scanner ve rsion 4.40.11 starting... Apr 7 09:25:54 dell8600 MailScanner[22777]: Read 108 hostnames from the phishin g whitelist Apr 7 09:25:55 dell8600 MailScanner[22777]: Enabling SpamAssassin auto-whitelis t functionality... Apr 7 09:25:57 dell8600 MailScanner[22777]: Using locktype = flock Apr 7 09:26:04 dell8600 MailScanner[22781]: MailScanner E-Mail Virus Scanner ve rsion 4.40.11 starting... Apr 7 09:26:05 dell8600 MailScanner[22781]: Read 108 hostnames from the phishin g whitelist Apr 7 09:26:06 dell8600 MailScanner[22781]: Enabling SpamAssassin auto-whitelis t functionality... Apr 7 09:26:08 dell8600 MailScanner[22781]: Using locktype = flock Apr 7 09:26:15 dell8600 MailScanner[22783]: MailScanner E-Mail Virus Scanner ve rsion 4.40.11 starting... Apr 7 09:26:16 dell8600 MailScanner[22783]: Read 108 hostnames from the phishin g whitelist Apr 7 09:26:17 dell8600 MailScanner[22783]: Enabling SpamAssassin auto-whitelis t functionality... Apr 7 09:26:19 dell8600 MailScanner[22783]: Using locktype = flock 7. I do not even though if this says anything, but I checked the /var/spool/MailScanner/incoming directory and there seem to be mail in there. There were these folders: 22777 22781 22783 22785 22786 I checked the directories and they were empty. My first guess is that MailScanner is not picking them up? Help is appreciated on trouble shooting this. Thank you! :) Billy Pumphrey ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Apr 7 15:38:58 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:16 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Billy Pumphrey wrote: > I didn't know if I should continue this topic or start a new one. > > I have gotten thus far with installing MailScanner, but I cannot figure out > what I have done wrong or haven't done yet. > > 1. Downloaded CentOS4 and installed with most server packages, development > packages, sendmail, spamassassin. > > 2. Installed this mailscanner: Version 4.40.11-1 for RedHat and Mandrake > Linux (and other RPM-based Linux distributions) > > 3. Ran these commands: > Chkconfig --level all sendmail off > Chkconfig --leve 345 MailScanner on > Service sendmail stop > Service MailScanner start > > 4. I changed the following files (my mailscanner is a gateway to a > Microsoft Exchange machine: > Mailertable > Woodmaclaw.com esmtp:[10.1.1.2] > www.woowmaclaw.com esmtp:[10.1.1.2] > ran the command make -C /etc/mail > > relaydomains > woodmaclaw.com > www.woodmaclaw.com > > mailscanner.conf > various options, but mostly default. > No virus scanners, as I have not installed them yet > Turned on spamassassin > > 5. restarted MailScanner several times. > > 6. Info... > I do not see any errors, here are some entries of my maillog: > Apr 7 09:25:34 dell8600 MailScanner[22695]: Using locktype = flock > Apr 7 09:25:38 dell8600 MailScanner[22685]: MailScanner child caught a > SIGHUP > Apr 7 09:25:38 dell8600 MailScanner[22693]: MailScanner child caught a > SIGHUP > Apr 7 09:25:38 dell8600 MailScanner[22689]: MailScanner child caught a > SIGHUP > Apr 7 09:25:38 dell8600 MailScanner[22692]: MailScanner child caught a > SIGHUP > Apr 7 09:25:38 dell8600 MailScanner[22695]: MailScanner child caught a > SIGHUP > Apr 7 09:25:49 dell8600 sendmail[22741]: alias database /etc/aliases > rebuilt by > bpumphrey > Apr 7 09:25:49 dell8600 sendmail[22741]: /etc/aliases: 78 aliases, longest > 10 b > ytes, 802 bytes total > Apr 7 09:25:49 dell8600 sendmail[22749]: starting daemon (8.13.1): SMTP > Apr 7 09:25:49 dell8600 sm-msp-queue[22753]: starting daemon (8.13.1): > queueing > @00:15:00 > Apr 7 09:25:49 dell8600 sendmail[22758]: starting daemon (8.13.1): > queueing@00: > 15:00 > Apr 7 09:25:53 dell8600 MailScanner[22777]: MailScanner E-Mail Virus > Scanner ve > rsion 4.40.11 starting... > Apr 7 09:25:54 dell8600 MailScanner[22777]: Read 108 hostnames from the > phishin > g whitelist > Apr 7 09:25:55 dell8600 MailScanner[22777]: Enabling SpamAssassin > auto-whitelis > t functionality... > Apr 7 09:25:57 dell8600 MailScanner[22777]: Using locktype = flock > Apr 7 09:26:04 dell8600 MailScanner[22781]: MailScanner E-Mail Virus > Scanner ve > rsion 4.40.11 starting... > Apr 7 09:26:05 dell8600 MailScanner[22781]: Read 108 hostnames from the > phishin > g whitelist > Apr 7 09:26:06 dell8600 MailScanner[22781]: Enabling SpamAssassin > auto-whitelis > t functionality... > Apr 7 09:26:08 dell8600 MailScanner[22781]: Using locktype = flock > Apr 7 09:26:15 dell8600 MailScanner[22783]: MailScanner E-Mail Virus > Scanner ve > rsion 4.40.11 starting... > Apr 7 09:26:16 dell8600 MailScanner[22783]: Read 108 hostnames from the > phishin > g whitelist > Apr 7 09:26:17 dell8600 MailScanner[22783]: Enabling SpamAssassin > auto-whitelis > t functionality... > Apr 7 09:26:19 dell8600 MailScanner[22783]: Using locktype = flock > > 7. I do not even though if this says anything, but I checked the > /var/spool/MailScanner/incoming directory and there seem to be mail in > there. There were these folders: > 22777 > 22781 > 22783 > 22785 > 22786 > I checked the directories and they were empty. My first guess is that > MailScanner is not picking them up? > > > Help is appreciated on trouble shooting this. Thank you! :) > Billy Pumphrey > First thing to try is setting locking to posix, because Sendmail 13 has issues with flock. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hkclark at gmail.com Thu Apr 7 15:56:11 2005 From: hkclark at gmail.com (Kennedy Clark) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I installed MailScanner/SpamAssassin/ClamAV last week. I used Johnny Hughes' excellent guide at http://www.hughesjr.com/content/category/1/14/30/Guides (see Part 4). I'm using RHEL 3/CentOS 3.4. On the MTA side, I am using Postfix with a virtual alias table. I want to have MailScanner use the "forward" "Spam Actions" option to put all spam in a central email account (it's a local account on the same server). I can email to this central spam account no problem (both locally and from outside accounts such as gmail). The "Spam Actions = forward blah@blah.com" works if blah@blah.com is an account on a separate system (such as this account on gmail). However, no matter what I do, I cannot make it work with a local account -- I always get the following postfix error in /var/log/maillog: ..., status=bounced (user unknown in virtual alias table). I'm guessing it has something to do with the fact that I'm using a virtual alias table, but I don't want to get rid of that (even for testing purposes) because it's obviously being used for live email. :-) Many thanks for any assistance! Kennedy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From carinus.carelse at MRC.AC.ZA Thu Apr 7 16:21:24 2005 From: carinus.carelse at MRC.AC.ZA (Carinus Carelse) Date: Thu Jan 12 21:29:16 2006 Subject: Error when Running MailScanner in Debug Mode Message-ID: I wonder if anyone on the list can help me with this one. I am using the Patched MailWatch.pm Can't modify non-lvalue subroutine call at /opt/MailScanner/lib/MailScanner/MailWatch.pm line 93, line 26. Carinus ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 7 16:29:10 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:16 2006 Subject: Error when Running MailScanner in Debug Mode Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please ask MailWatch questions on the MailWatch mailing list. They should be able to help you there. Carinus Carelse wrote: > > I wonder if anyone on the list can help me with this one. I am using > the Patched MailWatch.pm > > Can't modify non-lvalue subroutine call at > /opt/MailScanner/lib/MailScanner/MailWatch.pm line 93, line 26. > > > Carinus > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 7 16:32:16 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kennedy Clark > Sent: den 7 april 2005 16:56 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: MailScanner SPAM Forward & Postfix Problem > > > I installed MailScanner/SpamAssassin/ClamAV last week. I used Johnny > Hughes' excellent guide at > http://www.hughesjr.com/content/category/1/14/30/Guides (see Part 4). This uses the older (unsafe) "two postfix" setup (unsafe since postfix and MailScanner will try manage the deferred queue *without there being any locking*). You should've followed the instructions in http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml on how to setup and use a "one postfix through the HOLD feature". > > I'm using RHEL 3/CentOS 3.4. On the MTA side, I am using > Postfix with a > virtual alias table. I want to have MailScanner use the "forward" > "Spam Actions" option to put all spam in a central email account (it's > a local account on the same server). I can email to this central spam > account no problem (both locally and from outside accounts such as > gmail). The "Spam Actions = forward blah@blah.com" works if > blah@blah.com is an account on a separate system (such as this account > on gmail). However, no matter what I do, I cannot make it work with > a local account -- I always get the following postfix error in > /var/log/maillog: > > ..., status=bounced (user unknown in virtual alias table). > > I'm guessing it has something to do with the fact that I'm using a > virtual alias table, but I don't want to get rid of that (even for > testing purposes) because it's obviously being used for live email. > :-) You can keep the table, but you cannot use any virtual alias for forward spam actions. This is a known (unresolved/unresolvable) issue, methinks. Workaround is to use a real address in the forward (IIRC). Or do a real address bork out too? -- Glenn > Many thanks for any assistance! > Kennedy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gdoris at rogers.com Thu Apr 7 16:39:55 2005 From: gdoris at rogers.com (Gerry Doris) Date: Thu Jan 12 21:29:16 2006 Subject: recommended SA rules to stop SPAM Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Jason wrote: > >>Specifically, the ones that have recently come out about buying certain >> pieces >>of stock. >> >>Currently running SA 2.63. >> >> > > upgrade to 2.64 or higher ASAP.. 2.63 is vulnerable to a DoS attack by > sending it a message with malformed mime sections. > > This is a remote exploit. Anyone can exploit it by sending you a > carefully crafted email. > > Admittedly it's just a DoS, but still not something you want on any kind > of production server. > > http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0796 > > This is not exactly new news. It's from August of last year. > >>Was skimming the SARE this morning, trying to see if there are any >> additional >>rules that are good ones to add. >> >>I am also using surbl_uri.cf and chickenpox.cf. (made a few of my own, >> but >>need better ones) >> > > surbl is a VERY good one to be using, provided of course you added the > Mail::SpamAssassin::SpamCopURI plugin. Also note, when you upgrade to > 2.64 you'll need to re-install spamcopURI. SpamCopURI installs as a > source-code patch to SA's evaltests.pm, and upgrading SA will clobber it. > > Not to toot my own horn, but another ruleset I'd recommend is antidrug. > It was incorporated into SA 3.0 and works fairly well on pill-spam. A > few of the latest ones evade it, but it catches a LOT of common > obfuscations of drug names. > > http://mywebpages.comcast.net/mkettler/sa/antidrug.cf > > Note: if you upgrade to SA 3.x instead of 2.64, you won't need to mess > with SpamCopURI or antidrug, both are built-in with 3.0. However, 3.x > does have a minimum perl version of 5.6.1. If you're on an older version > of perl, you'll have to stick to 2.64. > > I also like SARE's fraud, random and specific rulesets. Lately, I've also noticed more spam getting through. I've moved the Bayes and spamcop scores up especially for high end bayes in spam.assassin.prefs.conf as well as spamcop. This has virtually eliminated spam again. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Apr 7 16:44:42 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kennedy Clark said: > I installed MailScanner/SpamAssassin/ClamAV last week. I used Johnny Hughes' excellent guide at > http://www.hughesjr.com/content/category/1/14/30/Guides (see Part 4). > > I'm using RHEL 3/CentOS 3.4. On the MTA side, I am using Postfix with a virtual alias table. I want to have MailScanner use the "forward" "Spam Actions" option to put all spam in a central email account (it's a local account on the same server). I can email to this central spam account no problem (both locally and from outside accounts such as gmail). The "Spam Actions = forward blah@blah.com" works if > blah@blah.com is an account on a separate system (such as this account on gmail). However, no matter what I do, I cannot make it work with a local account -- I always get the following postfix error in > /var/log/maillog: > > ..., status=bounced (user unknown in virtual alias table). > > I'm guessing it has something to do with the fact that I'm using a virtual alias table, but I don't want to get rid of that (even for testing purposes) because it's obviously being used for live email. :-) This is a Postfix err, 'feature'. Because of the way that Postfix and MailScanner work, you can't forward spam to a virtual user. The why: Postfix uses the cleanup agent to do the virtual aliasing, unfortunately this happens _before_ MailScanner sees the message. So when you re-inject a spam message to a virtual user, it's after Postfix would have alised it to it's real destination, hence the bounce. The solution: Forward spam to a local account that is alised to your virual user e.g. forward spam to localuser@box.domain.tld then in the aliases table put localuser: virtual@virtual.tld and then $newaliases That will then do the job for you. HTH Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Thu Apr 7 16:59:41 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:16 2006 Subject: Spam Actions Message-ID: I am putting together a set of rules for spam actions. Does it matter in which order the actions come? eg: is To: a@b.com delete forward spamtrap@b.com FromOrTo: default deliver the same as To: a@b.com forward spamtrap@b.com delete FromOrTo: default deliver And is tab spacing important in this type of ruleset? Thanks Stef Stefan Morrell | Director Tel: 0870 365 2813 | Level 5 Internet Ltd Fax: 0192 450 7307 | Part of the Alpha Omega Group stef@l5net.net | stef@aoc-uk.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Thu Apr 7 17:10:16 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:16 2006 Subject: Spam Actions Message-ID: I think the key is that the default entry be LAST in your list. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stef Morrell Sent: Thursday, April 07, 2005 11:00 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Spam Actions I am putting together a set of rules for spam actions. Does it matter in which order the actions come? eg: is To: a@b.com delete forward spamtrap@b.com FromOrTo: default deliver the same as To: a@b.com forward spamtrap@b.com delete FromOrTo: default deliver And is tab spacing important in this type of ruleset? Thanks Stef Stefan Morrell | Director Tel: 0870 365 2813 | Level 5 Internet Ltd Fax: 0192 450 7307 | Part of the Alpha Omega Group stef@l5net.net | stef@aoc-uk.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Thu Apr 7 17:15:58 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:16 2006 Subject: Spam Actions Message-ID: Sorry, I've not been clear. It's where I have multiple actions for a single recipient, I want to delete the message, ie not have it delivered to it's usual recipient *and* forward a copy to another address. The example given is Spam Actions = store forward anonymous@ecs.soton.ac.uk I want effectively Spam Actions = delete forward anonymous@ecs.soton.ac.uk The question is, does it matter if the delete comes before the forward, or vice versa? For the ruleset, do I need to use tabs to separate the fields, or will any whitespace do? Stef > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mike Kercher > Sent: 07 April 2005 17:10 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Spam Actions > > I think the key is that the default entry be LAST in your list. > > Mike > > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stef Morrell > Sent: Thursday, April 07, 2005 11:00 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Spam Actions > > I am putting together a set of rules for spam actions. > > Does it matter in which order the actions come? > > eg: > > is > > To: a@b.com delete forward spamtrap@b.com > FromOrTo: default deliver > > the same as > > To: a@b.com forward spamtrap@b.com delete > FromOrTo: default deliver > > And is tab spacing important in this type of ruleset? > > Thanks > > Stef > Stefan Morrell | Director > Tel: 0870 365 2813 | Level 5 Internet Ltd > Fax: 0192 450 7307 | Part of the Alpha Omega Group > stef@l5net.net | stef@aoc-uk.com > > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This email has been scanned by the Level 5 Internet > MailCrusader for viruses, spam and dangerous content. > For more information please visit http://www.l5net.net > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chuck.foster at STREAMSHIELD.COM Thu Apr 7 17:27:38 2005 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:29:16 2006 Subject: TodayDir() function Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Finally had time to play with the new MailScanner code, and looked at the changes made from below. One thing that I've realised now that I hadn't before is that the originating time() value isn't being kept, which meant that it wasn't available to my custom functions as I'd hoped - having to parse the string to get the hours and minutes out is a bit painful! A simple addition to the new function to keep that value would be very useful; I used $dateval for that in my code: # Set the date string and number $this->{dateval} = time; $this->{datestring} = scalar localtime($this->{dateval}); my ($day, $month, $year) = (localtime($this->dateval))[3,4,5]; $this->{datenumber} = sprintf("%04d%02d%02d", $year+1900, $month+1, $day); This also avoided the (very very slight!) situation where the day changes between the setting of datestring and datenumber in the original code, which both called a fresh time in localtime(). Also, there are a couple of points in the code that still call TodayDir() in the archiving (Message.pm line 669,3982, MCPMessage.pm line 372) which could conceivably end up with different dates - any plans to move those to $this->{datenumber} too? (unless I missed something obvious!) Best Wishes, Chuck -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Julian Field Sent: 18 March 2005 17:30 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: TodayDir() function Very good idea. I might do this over the weekend, but it certainly should be in the next release. Chuck Foster wrote: >Hi, > >Sorry if this is a general discussion point, I hadn't spotted it in the >archives as yet. > >There's a few places where TodayDir() gets called (and a couple where the >date is still calculated manually); the function uses the current time on >the server to generate the date string used, but this would mean that >there's going to be the odd time (sorry!) when it will flick from 23:59:59 >to 00:00:00 whilst a message is being processed, so yielding two potential >dates for where a file might be quarantined/archived. > >I think. > >Would it be more beneficial to record a message's "date" within the object >itself, so that the same one could be used anywhere in the code relating to >that message without having to re-calculate it and potentially get a >different result? The reason this came up for me in the first place is that >I do some housekeeping in a custom function, one of which was to work out >where a quarantined message would be ... if the function is called on a >different day then ... oops! Having a $m->{date} type variable would be >quite invaluable! > >C:> > > >This message should be regarded as confidential. If you have received this >email in error please notify the sender and destroy it immediately. >Statements of intent shall only become binding when confirmed in hard copy >by an authorized signatory. > > >-- >This message has been scanned for all known viruses >and dangerous content by StreamShield Protector, >and has been found to be clean. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for all known viruses and dangerous content by StreamShield Protector, and has been found to be clean. This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. -- This message has been scanned for viruses and potentially harmful content by StreamShield Protector. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stebaume2004 at YAHOO.FR Thu Apr 7 17:28:28 2005 From: stebaume2004 at YAHOO.FR (ste baume) Date: Thu Jan 12 21:29:16 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello all, Since many days our MailScanner server have a curious behavior: - Most of the time they work slowly (less than 50 mails by minute are treated) which causes latency to mail delivery (up to 4 hours) - Sometimes, they work normaly and they can empty the queues. First we suspected an issue between the Mailscanner server and the Exchange servers. But after many tests all seem to be OK on this point. When we disable SpamAssasin from the mailscanner.conf, the queues decrease quickly, but after hours the queues increase again. When we disable the Anti-virus from mailscanner.conf, we have no improvement. When we diable Mailscanner, and use only postfix, we have no problem. Volume : 150 000 messages per day Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G SCSI HDD Software : RHE3, Mailscanner 4.40.11, Postfix 2.2.1, SpammAssassin 3.0.2, Kaspersky 5.0 RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in MailScanner, all in SPAMASSASSIN Average Load : Around 6 Is anybody can help us please, we are in dead end ? Stephane __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Thu Apr 7 17:52:45 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:16 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Are you running a local caching nameserver on your MailScanner box? Sounds like it could be DNS latency killing you. Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of ste baume Sent: Thursday, April 07, 2005 11:28 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Mailscanner treats the mails very slowly Hello all, Since many days our MailScanner server have a curious behavior: - Most of the time they work slowly (less than 50 mails by minute are treated) which causes latency to mail delivery (up to 4 hours) - Sometimes, they work normaly and they can empty the queues. First we suspected an issue between the Mailscanner server and the Exchange servers. But after many tests all seem to be OK on this point. When we disable SpamAssasin from the mailscanner.conf, the queues decrease quickly, but after hours the queues increase again. When we disable the Anti-virus from mailscanner.conf, we have no improvement. When we diable Mailscanner, and use only postfix, we have no problem. Volume : 150 000 messages per day Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G SCSI HDD Software : RHE3, Mailscanner 4.40.11, Postfix 2.2.1, SpammAssassin 3.0.2, Kaspersky 5.0 RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in MailScanner, all in SPAMASSASSIN Average Load : Around 6 Is anybody can help us please, we are in dead end ? Stephane __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Thu Apr 7 17:52:11 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:29:16 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Do you run DNS on your mailscanner box? Are DNS lookups slow? Having local (cached) DNS on the mailscanner box can make a big difference in thruput. Jeff Earickson Colby College On Thu, 7 Apr 2005, ste baume wrote: > Date: Thu, 7 Apr 2005 18:28:28 +0200 > From: ste baume > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Mailscanner treats the mails very slowly > > Hello all, > > Since many days our MailScanner server have a curious > behavior: > - Most of the time they work slowly (less than 50 > mails by minute are treated) which causes latency to > mail delivery (up to 4 hours) > - Sometimes, they work normaly and they can empty the > queues. > > > First we suspected an issue between the Mailscanner > server and the > Exchange servers. But after many tests all seem to be > OK on this point. > > > When we disable SpamAssasin from the mailscanner.conf, > the queues > decrease quickly, but after hours the queues increase > again. > When we disable the Anti-virus from mailscanner.conf, > we have no improvement. > When we diable Mailscanner, and use only postfix, we > have no problem. > > Volume : 150 000 messages per day > Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G SCSI > HDD > Software : RHE3, Mailscanner 4.40.11, Postfix 2.2.1, > SpammAssassin 3.0.2, Kaspersky 5.0 > RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in > MailScanner, all in SPAMASSASSIN > Average Load : Around 6 > > Is anybody can help us please, we are in dead end ? > > Stephane > > > > > > > __________________________________________________________________ > Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! > Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Thu Apr 7 16:31:09 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:16 2006 Subject: Starting from scratch Message-ID: > First thing to try is setting locking to posix, because Sendmail 13 has > issues with flock. > Ok, I did this. Now the log says to the effect of: Apr 7 10:25:21 WoodenMS MailScanner[2574]: Using locktype = posix Apr 7 10:25:21 WoodenMS MailScanner[2574]: Creating hardcoded struct_flock subr outine for linux (Linux-type) I did not know that the log does not show as it did before in previous versions. Before I would do tail -f /var/log/maillog and see the emails coming through. How does it work now? Looking that the log was what I was doing to see if it would work or not. Since nothing came through the log I did not think that it was working. MailScanner is Working!! However I would like to know how to "view the log". Thank you ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 7 18:29:00 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:16 2006 Subject: Spam Actions Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] No, it doesn't make any difference. Stef Morrell wrote: >Sorry, I've not been clear. > >It's where I have multiple actions for a single recipient, >I want to delete the message, ie not have it delivered to >it's usual recipient *and* forward a copy to another >address. > >The example given is > >Spam Actions = store forward anonymous@ecs.soton.ac.uk > >I want effectively > >Spam Actions = delete forward anonymous@ecs.soton.ac.uk > >The question is, does it matter if the delete comes >before the forward, or vice versa? > >For the ruleset, do I need to use tabs to separate the >fields, or will any whitespace do? > >Stef > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mike Kercher >>Sent: 07 April 2005 17:10 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: Spam Actions >> >>I think the key is that the default entry be LAST in your list. >> >>Mike >> >> >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stef Morrell >>Sent: Thursday, April 07, 2005 11:00 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Spam Actions >> >>I am putting together a set of rules for spam actions. >> >>Does it matter in which order the actions come? >> >>eg: >> >>is >> >>To: a@b.com delete forward spamtrap@b.com >>FromOrTo: default deliver >> >>the same as >> >>To: a@b.com forward spamtrap@b.com delete >>FromOrTo: default deliver >> >>And is tab spacing important in this type of ruleset? >> >>Thanks >> >>Stef >>Stefan Morrell | Director >>Tel: 0870 365 2813 | Level 5 Internet Ltd >>Fax: 0192 450 7307 | Part of the Alpha Omega Group >>stef@l5net.net | stef@aoc-uk.com >> >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the MAQ >>(http://www.mailscanner.biz/maq/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>-- >>This email has been scanned by the Level 5 Internet >>MailCrusader for viruses, spam and dangerous content. >>For more information please visit http://www.l5net.net >> >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Thu Apr 7 18:35:12 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn wrote: -----Original Message----- From: MailScanner mailing list ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Thu Apr 7 18:40:37 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Trying 2nd time, looks like message got truncated last attempt Steen, Glenn wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kennedy Clark >>Sent: den 7 april 2005 16:56 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: MailScanner SPAM Forward & Postfix Problem >> >> >>I installed MailScanner/SpamAssassin/ClamAV last week. I used Johnny >>Hughes' excellent guide at >>http://www.hughesjr.com/content/category/1/14/30/Guides (see Part 4). >> >> >This uses the older (unsafe) "two postfix" setup (unsafe since postfix >and MailScanner will try manage the deferred queue *without there being >any locking*). >You should've followed the instructions in >http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml >on how to setup and use a "one postfix through the HOLD feature". > > > Having not followed these instructions, is it possible/safe to go back and follow them after having setup a "two postfix" operation? -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Apr 7 18:37:49 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:16 2006 Subject: Starting from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Billy Pumphrey wrote: >>First thing to try is setting locking to posix, because Sendmail 13 has >>issues with flock. >> > > > > Ok, I did this. Now the log says to the effect of: > Apr 7 10:25:21 WoodenMS MailScanner[2574]: Using locktype = posix > Apr 7 10:25:21 WoodenMS MailScanner[2574]: Creating hardcoded struct_flock > subr > outine for linux (Linux-type) > > > I did not know that the log does not show as it did before in previous > versions. Before I would do tail -f /var/log/maillog and see the emails > coming through. How does it work now? > > Looking that the log was what I was doing to see if it would work or not. > Since nothing came through the log I did not think that it was working. > > MailScanner is Working!! > > However I would like to know how to "view the log". > > Thank you > Have you looked in the /etc/MailScanner/MailScanner.conf section on logging. Maybe you have something off in there. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 7 19:05:24 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hm, haven't spent a lot of thought on that... I treat myself to complete rebuilds from time to time:-). But it shouldn't be to hard.... stop MailScanner, stop both postfix instances (if you use the rpm install it's one "service MailScanner stop" command), then reversa all that you did in /etc/postfix ... Perhaps make sure there are no pending messages in /var spool/postfix.in with a postqueue -c /etc/postfix.in -p and ls -lR /var/spool/postfix.in/defer* (If there is, you'd have to perhaps start some things (like just MailScanner) up to "drain" it... Or move them manually. Then implement the HOLD thing and do the changes in MailScanner.conf (which should undo all the "incompatible" changes (that you did for the 2 postfix setup))... And then fire it up. Should be ratehr easy and safe. (I'm sure all other postfix/MailScanner users will toast me if I missed something... Right Drew:-):-) -- Glenn -----Original Message----- From: MailScanner mailing list on behalf of Ed Bruce Sent: Thu 4/7/2005 7:40 PM To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: MailScanner SPAM Forward & Postfix Problem Trying 2nd time, looks like message got truncated last attempt Steen, Glenn wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kennedy Clark >>Sent: den 7 april 2005 16:56 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: MailScanner SPAM Forward & Postfix Problem >> >> >>I installed MailScanner/SpamAssassin/ClamAV last week. I used Johnny >>Hughes' excellent guide at >>http://www.hughesjr.com/content/category/1/14/30/Guides (see Part 4). >> >> >This uses the older (unsafe) "two postfix" setup (unsafe since postfix >and MailScanner will try manage the deferred queue *without there being >any locking*). >You should've followed the instructions in >http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml >on how to setup and use a "one postfix through the HOLD feature". > > > Having not followed these instructions, is it possible/safe to go back and follow them after having setup a "two postfix" operation? -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Thu Apr 7 19:35:29 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:16 2006 Subject: Starting from scratch Message-ID: I'll thoroughly look at the .conf file in the next few days to see. Other than changing the flock, really that is all that I changed and the rest are defaults. Thank you :) > -----Original Message----- > From: Scott Silva [mailto:ssilva@SGVWATER.COM] > Sent: Thursday, April 07, 2005 12:38 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Starting from scratch > > Billy Pumphrey wrote: > >>First thing to try is setting locking to posix, because Sendmail 13 has > >>issues with flock. > >> > > > > > > > > Ok, I did this. Now the log says to the effect of: > > Apr 7 10:25:21 WoodenMS MailScanner[2574]: Using locktype = posix > > Apr 7 10:25:21 WoodenMS MailScanner[2574]: Creating hardcoded > struct_flock > > subr > > outine for linux (Linux-type) > > > > > > I did not know that the log does not show as it did before in previous > > versions. Before I would do tail -f /var/log/maillog and see the emails > > coming through. How does it work now? > > > > Looking that the log was what I was doing to see if it would work or > not. > > Since nothing came through the log I did not think that it was working. > > > > MailScanner is Working!! > > > > However I would like to know how to "view the log". > > > > Thank you > > > Have you looked in the /etc/MailScanner/MailScanner.conf section on > logging. > Maybe you have something off in there. > > > -- > "If you have ever eaten crow, > It don't taste like chicken!!" > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From tom at SKYRESEARCH.COM Thu Apr 7 22:31:25 2005 From: tom at SKYRESEARCH.COM (Tom Schuetz) Date: Thu Jan 12 21:29:16 2006 Subject: Allow only zipped exe's? Message-ID: Is there a way to deny "naked" exe attachments, but to allow zipped exe's, WITHOUT setting the archive scan depth to 0? In other words, we still want zip files scanned, but exe's in zips should get a free pass. Thanks, Tom ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sub at ICCONSULTING.COM.AU Thu Apr 7 22:48:57 2005 From: sub at ICCONSULTING.COM.AU (Scott Farrell) Date: Thu Jan 12 21:29:16 2006 Subject: Just reading man sa-learn - you are not supposed to learn spam/ham from this mail list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, thanx for the reply (and on the word/pdf one as well). I ended up putting a rule on "Spam Checks" To: sub@icconsulting.com.au no default: yes given sub@icconsulting.com.au is my mail subscription user, mostly for spamassassin and this list, I assume it now wont go through anything in spamassassin at all. That way I wont re-inforce any bad bayes learning from content in this list. thanx again Scott Julian Field Sent by: MailScanner mailing list 02/04/2005 08:28 PM Please respond to MailScanner mailing list To MAILSCANNER@JISCMAIL.AC.UK cc Subject Re: Just reading man sa-learn - you are not supposed to learn spam/ham from this mail list You could use a ruleset for "Is Definitely Not Spam", and put a rule in that ruleset that says "yes" to mail from the list address and to you. Make it say "no" for the default. If you need more help on rulesets, check out the online docs and buy the book. Scott Farrell wrote: > > This is from man sa-learn (see below) > > I have subscribed to this list (and spamassassin list) using > sub@icconsulting.com.au > > I guess I can spam whitelist with a rule, but that might further > re-inforce learning. Can I tell it to bypass learning? > > or do I have to do something smtp/domain specific, like subscribe an > address in a domain that is not scanned at all. > > EFFECTIVE TRAINING > > Note that if your mail folders contain things like for¡ > warded spam, discussions of spam-catching rules, etc., > this will cause trouble. You should avoid scanning those > messages if possible. (An easy way to do this is to move > them aside, into a folder which is not scanned.) > > > > Scott > sfarrell@icconsulting.com.au > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Fri Apr 8 00:41:35 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:16 2006 Subject: Allow only zipped exe's? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tom Schuetz wrote: >Is there a way to deny "naked" exe attachments, but to allow zipped exe's, >WITHOUT setting the archive scan depth to 0? > >In other words, we still want zip files scanned, but exe's in zips should >get a free pass. > Define "we still want zipfiles scanned". Do you mean you still want files inside zips to be scanned for viruses, or scanned for filename restrictions? If you set archive scan depth to 0, archives, and all the files within zipfiles and other archives are still scanned for viruses. Your virus scanner will do the unpacking itself. The archive depth setting setting ONLY applies to how deep MailScanner goes when applying filename.rules and filetype.rules. It has no effect on virus scans. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bg.mahesh at INDIAINFO.COM Fri Apr 8 05:47:07 2005 From: bg.mahesh at INDIAINFO.COM (BG Mahesh) Date: Thu Jan 12 21:29:16 2006 Subject: ExtUtils-MakeMaker-6.05 problem Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hi I am trying to install MS 4.40.11-1 on a Linux machine. I have manually installed ExtUtils-MakeMaker-6.27 from cpan.org During installation of MS the error I get is, /usr/bin/instmodshX' = X ']' + /usr/lib/rpm/find-debuginfo.sh /usr/src/redhat/BUILD/ExtUtils-MakeMaker-6.05 0 blocks find: /var/tmp/perl-ExtUtils-MakeMaker-6.05-1-root/usr/lib/debug: No such file or directory Shouldn't MS skip the installation of ExtUtils-MakeMaker-6.05 because I have a newer version? find: /var/tmp/perl-Net-CIDR-0.10-1-root/usr/lib/debug: No such file or directory + /usr/lib/rpm/redhat/brp-compress + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-static-archive /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump Processing files: perl-Net-CIDR-0.10-1 error: Couldn't exec /usr/lib/rpm/perl.prov: No such file or directory getOutputFrom(): Broken pipe I already have the latest Net::CDIR, not sure why it is being installed. HOw can I solve this? -- B.G. Mahesh bg.mahesh@indiainfo.com http://www.indiainfo.com/ -- ______________________________________________ IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! Powered by Outblaze ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stebaume2004 at YAHOO.FR Fri Apr 8 08:04:44 2005 From: stebaume2004 at YAHOO.FR (ste baume) Date: Thu Jan 12 21:29:16 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I omitted to speak about it but cache DNS is active. I just changed on spam.assassin.pref.conf the following directives : dns_available yes rbl_timeout 5 (instead 20) What do you think about it ? Thanks Stephane Jeff A. Earickson wrote: > Do you run DNS on your mailscanner box? Are DNS lookups slow? > Having local (cached) DNS on the mailscanner box can make a > big difference in thruput. > > Jeff Earickson > Colby College > > On Thu, 7 Apr 2005, ste baume wrote: > >> Date: Thu, 7 Apr 2005 18:28:28 +0200 >> From: ste baume >> Reply-To: MailScanner mailing list >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Mailscanner treats the mails very slowly >> >> Hello all, >> >> Since many days our MailScanner server have a curious >> behavior: >> - Most of the time they work slowly (less than 50 >> mails by minute are treated) which causes latency to >> mail delivery (up to 4 hours) >> - Sometimes, they work normaly and they can empty the >> queues. >> >> >> First we suspected an issue between the Mailscanner >> server and the >> Exchange servers. But after many tests all seem to be >> OK on this point. >> >> >> When we disable SpamAssasin from the mailscanner.conf, >> the queues >> decrease quickly, but after hours the queues increase >> again. >> When we disable the Anti-virus from mailscanner.conf, >> we have no improvement. >> When we diable Mailscanner, and use only postfix, we >> have no problem. >> >> Volume : 150 000 messages per day >> Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G SCSI >> HDD >> Software : RHE3, Mailscanner 4.40.11, Postfix 2.2.1, >> SpammAssassin 3.0.2, Kaspersky 5.0 >> RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in >> MailScanner, all in SPAMASSASSIN >> Average Load : Around 6 >> >> Is anybody can help us please, we are in dead end ? >> >> Stephane __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Fri Apr 8 08:45:14 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:16 2006 Subject: Spam Actions Message-ID: Ok thanks :) > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: 07 April 2005 18:29 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Spam Actions > > No, it doesn't make any difference. > > Stef Morrell wrote: > > >Sorry, I've not been clear. > > > >It's where I have multiple actions for a single recipient, I want to > >delete the message, ie not have it delivered to it's usual recipient > >*and* forward a copy to another address. > > > >The example given is > > > >Spam Actions = store forward anonymous@ecs.soton.ac.uk > > > >I want effectively > > > >Spam Actions = delete forward anonymous@ecs.soton.ac.uk > > > >The question is, does it matter if the delete comes before > the forward, > >or vice versa? > > > >For the ruleset, do I need to use tabs to separate the > fields, or will > >any whitespace do? > > > >Stef > > > > > > > >>-----Original Message----- > >>From: MailScanner mailing list > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Mike Kercher > >>Sent: 07 April 2005 17:10 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: Spam Actions > >> > >>I think the key is that the default entry be LAST in your list. > >> > >>Mike > >> > >> > >>-----Original Message----- > >>From: MailScanner mailing list > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stef Morrell > >>Sent: Thursday, April 07, 2005 11:00 AM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Spam Actions > >> > >>I am putting together a set of rules for spam actions. > >> > >>Does it matter in which order the actions come? > >> > >>eg: > >> > >>is > >> > >>To: a@b.com delete forward spamtrap@b.com > >>FromOrTo: default deliver > >> > >>the same as > >> > >>To: a@b.com forward spamtrap@b.com delete > >>FromOrTo: default deliver > >> > >>And is tab spacing important in this type of ruleset? > >> > >>Thanks > >> > >>Stef > >>Stefan Morrell | Director > >>Tel: 0870 365 2813 | Level 5 Internet Ltd > >>Fax: 0192 450 7307 | Part of the Alpha Omega Group > >>stef@l5net.net | stef@aoc-uk.com > >> > >> > >>------------------------ MailScanner list > >>------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk > >>with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the MAQ > >>(http://www.mailscanner.biz/maq/) and the archives > >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >>------------------------ MailScanner list > >>------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk > >>with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the MAQ > >>(http://www.mailscanner.biz/maq/) and the archives > >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >>-- > >>This email has been scanned by the Level 5 Internet > MailCrusader for > >>viruses, spam and dangerous content. > >>For more information please visit http://www.l5net.net > >> > >> > >> > >> > > > >------------------------ MailScanner list > ------------------------ To > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This email has been scanned by the Level 5 Internet > MailCrusader for viruses, spam and dangerous content. > For more information please visit http://www.l5net.net > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Apr 8 08:51:29 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:16 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kennedy Clark said: > Drew, > Great info. Thanks! Quick question: I'm not completely following your example. So, say I have two domains called "mydomain.com" and "myotherdomain.com" (the server is "svr.mydomain.com"). I want to forward MailScanner SPAM to an email address called > "spamstuff@mydomain.com" (and spamstuff exists as a system/shell account as well). Would I then do this... > > /etc/MailScanner/MailScanner.conf: > Spam Actions = store forward spamstuff@mydomain.com > > /etc/postfix/aliases > spamstuff: spamstuff > > And remove "spamstuff@mydomain.com spamstuff@localhost" from my /etc/postfix/virtial_alias table. > > When I try this, I don't get anything for spamstuff@mydomain.com when I try to his it from a gmail account. > > Sorry if I'm being dense here, If the account you are forwarding to is a local account (Which it would be if it has a shell account) then you don't need to do anything other than specify it in MailScanner. I have assumed that you have defined mydomains = mydomain.com (So Postfix knows it's local), then remove spamstuff from your aliases file and that should work. If you haven't specified mydomain as local in /etc/postfix/main.cf then the easiest way to make it work is just to specify the local address in MailScanner.conf e.g. Spam Actions = store forward spamstuff@svr.mydomain.com and that will work also. The problem only really pops up when MailScanner is used as a gateway for another machine and where you want spam forwarded to an account on this other machine, but even that can be got round :-) I hope that makes sense (Not enough coffee yet!) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Apr 8 08:56:45 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:17 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn said: > Hm, haven't spent a lot of thought on that... I treat myself > to complete rebuilds from time to time:-). > But it shouldn't be to hard.... stop MailScanner, stop both > postfix instances (if you use the rpm install it's one > "service MailScanner stop" command), then reversa all that you > did in /etc/postfix ... Perhaps make sure there are no pending > messages in /var spool/postfix.in with a > postqueue -c /etc/postfix.in -p > and > ls -lR /var/spool/postfix.in/defer* > (If there is, you'd have to perhaps start some things (like > just MailScanner) up to "drain" it... Or move them manually. > Then implement the HOLD thing and do the changes in > MailScanner.conf (which should undo all the "incompatible" > changes (that you did for the 2 postfix setup))... And then > fire it up. > Should be ratehr easy and safe. > (I'm sure all other postfix/MailScanner users will toast me > if I missed something... Right Drew:-):-) Glenn You do yourself an injustice :-) In fact you can get away with following the single set up instructions (With MailScanner stopped) and just move the /etc/postfix.in directory (to /etc/postfix.in.old?) and move the spool directory also in a similar way. That way you have a quick back out if you need. Re-start MailScanner/ Postfix, make sure it's working properly, then delete the now disused 'second Postfix' directories. Either way works fine! Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 8 09:02:00 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:17 2006 Subject: Just reading man sa-learn - you are not supposed to learn spam/ham from this mail list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott mine is.. From: owner-mailscanner@jiscmail.ac.uk yes that way any spam that's to your address gets spam scanned too, rather from this list.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Scott Farrell wrote: > > Julian, > > > thanx for the reply (and on the word/pdf one as well). > > I ended up putting a rule on "Spam Checks" > > To: sub@icconsulting.com.au no > default: yes > > given sub@icconsulting.com.au is my mail subscription user, mostly for > spamassassin and this list, I assume it now wont go through anything in > spamassassin at all. That way I wont re-inforce any bad bayes learning > from content in this list. > > thanx again > Scott > > > > *Julian Field * > Sent by: MailScanner mailing list > > 02/04/2005 08:28 PM > Please respond to > MailScanner mailing list > > > > To > MAILSCANNER@JISCMAIL.AC.UK > cc > > Subject > Re: Just reading man sa-learn - you are not supposed to learn spam/ham > from this mail list > > > > > > > > > You could use a ruleset for "Is Definitely Not Spam", and put a rule in > that ruleset that says "yes" to mail from the list address and to you. > Make it say "no" for the default. > > If you need more help on rulesets, check out the online docs and buy the > book. > > Scott Farrell wrote: > > > > > This is from man sa-learn (see below) > > > > I have subscribed to this list (and spamassassin list) using > > sub@icconsulting.com.au > > > > I guess I can spam whitelist with a rule, but that might further > > re-inforce learning. Can I tell it to bypass learning? > > > > or do I have to do something smtp/domain specific, like subscribe an > > address in a domain that is not scanned at all. > > > > EFFECTIVE TRAINING > > > > Note that if your mail folders contain things like for¡ > > warded spam, discussions of spam-catching rules, etc., > > this will cause trouble. You should avoid scanning those > > messages if possible. (An easy way to do this is to move > > them aside, into a folder which is not scanned.) > > > > > > > > Scott > > sfarrell@icconsulting.com.au > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > *Support MailScanner development - buy the book off the website!* > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Apr 8 13:23:50 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:17 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kennedy Clark said: > On Apr 8, 2005 3:50 AM, Drew Marshall wrote: >> If the account you are forwarding to is a local account (Which it would >> be >> if it has a shell account) then you don't need to do anything other than >> specify it in MailScanner. I have assumed that you have defined >> mydomains >> = mydomain.com (So Postfix knows it's local), then remove spamstuff from >> your aliases file and that should work. >> > > Yeah, this makes perfect sense... which is why this is driving me nuts > (this is what I tried first). I have "mydomain = mydomain.com" in > main.conf, so it should know it's local. I then remove all mention > of spamstuff from both /etc/postfix/aliases and > /etc/postfix/virtual_alias (and obviously rebuild both .db files). I > have then tried several options in MailScanner.conf (I'm using the > "Non Spam Actions" here because I can test it right away vs. having to > wait for spam to come in -- once I get it working I'll obviously > remove this and put it in as a spam action): > Non Spam Actions = deliver forward spamstuff > Non Spam Actions = deliver forward spamstuff@mydomain.com > Non Spam Actions = deliver forward spamstuff@localhost.mydomain.com > Non Spam Actions = deliver forward spamstuff@svr.mydomain.com > I try every one of these (one at a time, of course) and I get the same > result: > > Apr 8 05:43:18 svr postfix/error[19471]: 5CF4C73C651: > to=, orig_to=, relay=none, delay=3, > status=deferred (SOFT BOUNCE - user unknown in virtual alias table) > > No matter what I do, it always says the users isn't in the virtual > table. I have found this to be true before I installed MailScanner... > it's like it ignores the /etc/postfix/aliases. BTW, I believe I do > have both aliases and virtial_alias correctly specified in my postfix > main.cf -- here are thre relevant bits: > mydestination = $myhostname, localhost.$mydomain > virtual_alias_domains = mydomain.com, myotherdomain.com OK here is the first problem. You _don't_ have mydomain listed under mydestination. Move it from virtual_alias_domains to mydestination. (This assumes that you deliver mail to local mailboxes, which I believe is true but you haven't confirmed). > virtual_alias_maps = hash:/etc/postfix/virtual_alias Again with the same assumption, move any reference to mydomain out of virtual_alias and any aliases to _real_ accounts into /etc/postfix/aliases > alias_maps = hash:/etc/postfix/aliases > Have I got something else hosed? Is using the virtual_alias_maps > supposed to complete shut off the normal aliases file? No, the idea of virtual_alias_maps is that it translates virtual aliases to either virtual mailboxes or other addresses for example, sales@virtdomain.com becomes salesman@internal.virtdomain.com (So you can run MailScanner as a gateway in front of Exchange or Notes for example). For anything local, you must use proper shell accounts and the aliases table (Where domains are not listed). Some times users don't want/ need shell accounts so you can use virtual_mailbox_domains for these, this needs more setting up to do correctly, but it's not too tricky. Speak to me off list if you want help with that). > (Actually, I know it's still there in some way [it still works for the "devnull: > /dev/null" entry I have in /etc/postfix/aliases], but all I can't get > it to work for normal email addresses [local or remote]). > > It's driving me crazy! Am I doing something dumb here? Maybe I'm the > one who needs coffee. :-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Fri Apr 8 14:49:55 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:29:17 2006 Subject: quarantine report running amok Message-ID: Julian, MS 4.40.11, Solaris 9. I found this in my daily report of quarantined stuff. The push @quarantines in CreatePostmasterNotice() seems to have run amok here. Any idea why it would push the same string so many times? j37L9Nr5007705: 137.146.156.144 (xxx@colby.edu) quarantine: /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, /var/spool/MailScanne! MailScanner: Executable DOS/Windows programs are dangerous in email (SETUP.EXE) Jeff Earickson Colby College ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 8 15:06:04 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:17 2006 Subject: quarantine report running amok Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] This is possible. Here is a patch for Message.pm to clean up the output: -----SNIP----- --- Message.pm.old 2005-04-08 14:33:30.000000000 +0100 +++ Message.pm 2005-04-08 15:03:20.940680796 +0100 @@ -3872,12 +3872,18 @@ my $from = $this->{from}; #my $to = join(', ', @{$this->{to}}); my $subj = $this->{subject}; + my $ip = $this->{clientip}; my $rept = join(" $reportword: ", @everyrept); + #print STDERR "Rept is\n$rept\n"; + + # Build list of unique archive and quarantine storage locations my @quarantines = grep /\//, @{$this->{archiveplaces}}; push @quarantines, grep /\//, @{$this->{quarantineplaces}}; - my $quarantine = join(", ", @quarantines); - my $ip = $this->{clientip}; - #print STDERR "Rept is\n$rept\n"; + my($quarantine, %quarantinelist); + foreach $quarantine (@quarantines) { + $quarantinelist{$quarantine} = 1; + } + $quarantine = join(', ', sort keys %quarantinelist); # Build unique list of recipients. Avoids Postfix problem which has # separate lists of real recipients and original recipients. -----SNIP----- Please give this a try and let me know how you get on. Jeff A. Earickson wrote: > Julian, > > MS 4.40.11, Solaris 9. I found this in my daily report of quarantined > stuff. The push @quarantines in CreatePostmasterNotice() seems to have > run amok here. Any idea why it would push the same string so many times? > > j37L9Nr5007705: 137.146.156.144 (xxx@colby.edu) > quarantine: /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, > /var/spool/MailScanne! > MailScanner: Executable DOS/Windows programs are dangerous in email > (SETUP.EXE) > > Jeff Earickson > Colby College > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Fri Apr 8 15:10:05 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:29:17 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I use the defaults of dns_available yes rbl_timeout 20 I would suggest moving some of the RBL's (like SpamHaus) to the MTA if possible, to get rid of some of the spam early. You might need more memory for your system. Jeff Earickson Colby College On Fri, 8 Apr 2005, ste baume wrote: > Date: Fri, 8 Apr 2005 09:04:44 +0200 > From: ste baume > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Mailscanner treats the mails very slowly > > Hello, > > I omitted to speak about it but cache DNS is active. > I just changed on spam.assassin.pref.conf the > following directives : > dns_available yes > rbl_timeout 5 (instead 20) > > What do you think about it ? > > Thanks > > Stephane > > Jeff A. Earickson wrote: >> Do you run DNS on your mailscanner box? Are DNS > lookups slow? >> Having local (cached) DNS on the mailscanner box can > make a >> big difference in thruput. >> >> Jeff Earickson >> Colby College >> >> On Thu, 7 Apr 2005, ste baume wrote: >> >>> Date: Thu, 7 Apr 2005 18:28:28 +0200 >>> From: ste baume >>> Reply-To: MailScanner mailing list > >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Mailscanner treats the mails very slowly >>> >>> Hello all, >>> >>> Since many days our MailScanner server have a > curious >>> behavior: >>> - Most of the time they work slowly (less than 50 >>> mails by minute are treated) which causes latency > to >>> mail delivery (up to 4 hours) >>> - Sometimes, they work normaly and they can empty > the >>> queues. >>> >>> >>> First we suspected an issue between the Mailscanner >>> server and the >>> Exchange servers. But after many tests all seem to > be >>> OK on this point. >>> >>> >>> When we disable SpamAssasin from the > mailscanner.conf, >>> the queues >>> decrease quickly, but after hours the queues > increase >>> again. >>> When we disable the Anti-virus from > mailscanner.conf, >>> we have no improvement. >>> When we diable Mailscanner, and use only postfix, > we >>> have no problem. >>> >>> Volume : 150 000 messages per day >>> Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G > SCSI >>> HDD >>> Software : RHE3, Mailscanner 4.40.11, Postfix > 2.2.1, >>> SpammAssassin 3.0.2, Kaspersky 5.0 >>> RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in >>> MailScanner, all in SPAMASSASSIN >>> Average Load : Around 6 >>> >>> Is anybody can help us please, we are in dead end ? >>> >>> Stephane > > > > > > > __________________________________________________________________ > Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! > Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Fri Apr 8 15:25:17 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:17 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What does your /etc/resolv.conf have in it? Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of ste baume Sent: Friday, April 08, 2005 2:05 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Mailscanner treats the mails very slowly Hello, I omitted to speak about it but cache DNS is active. I just changed on spam.assassin.pref.conf the following directives : dns_available yes rbl_timeout 5 (instead 20) What do you think about it ? Thanks Stephane Jeff A. Earickson wrote: > Do you run DNS on your mailscanner box? Are DNS lookups slow? > Having local (cached) DNS on the mailscanner box can make a > big difference in thruput. > > Jeff Earickson > Colby College > > On Thu, 7 Apr 2005, ste baume wrote: > >> Date: Thu, 7 Apr 2005 18:28:28 +0200 >> From: ste baume >> Reply-To: MailScanner mailing list >> To: MAILSCANNER@JISCMAIL.AC.UK >> Subject: Mailscanner treats the mails very slowly >> >> Hello all, >> >> Since many days our MailScanner server have a curious >> behavior: >> - Most of the time they work slowly (less than 50 mails by minute are >> treated) which causes latency to >> mail delivery (up to 4 hours) >> - Sometimes, they work normaly and they can empty the >> queues. >> >> >> First we suspected an issue between the Mailscanner server and the >> Exchange servers. But after many tests all seem to be >> OK on this point. >> >> >> When we disable SpamAssasin from the mailscanner.conf, >> the queues >> decrease quickly, but after hours the queues increase >> again. >> When we disable the Anti-virus from mailscanner.conf, >> we have no improvement. >> When we diable Mailscanner, and use only postfix, we >> have no problem. >> >> Volume : 150 000 messages per day >> Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G SCSI >> HDD >> Software : RHE3, Mailscanner 4.40.11, Postfix 2.2.1, >> SpammAssassin 3.0.2, Kaspersky 5.0 >> RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in MailScanner, all in >> SPAMASSASSIN Average Load : Around 6 >> >> Is anybody can help us please, we are in dead end ? >> >> Stephane __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kodak at FRONTIERHOMEMORTGAGE.COM Fri Apr 8 15:32:40 2005 From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing subject line Message-ID: Sorry if this has been addressed, but I just went through (quickly) my MailScanner.conf again and did a cursory check of google: Is there any way to make the phishing detection change the subject of admin notifications to "Phishing fraud detected"? Right now viruses say "Bad Filename Detected: Virus Detected" and phishing fraud says "Virus Detected" which isn't bad, but I'm getting ready to turn the reins over for one set of mail servers to someone else and I want things to be as clear as possible. I'm running mailscanner-4.39.6-1 on that particular box (I'm doing an overhaul next Saturday on it, so I'm going to upgrade it to whatever is the most recent version at that point.) So if this is in a more recent version, just point me at it. Thanks, --J(K) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 8 16:14:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing subject line Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] No there isn't. Jason Balicki wrote: >Sorry if this has been addressed, but I just went >through (quickly) my MailScanner.conf again and >did a cursory check of google: > >Is there any way to make the phishing detection >change the subject of admin notifications to >"Phishing fraud detected"? > >Right now viruses say "Bad Filename Detected: >Virus Detected" and phishing fraud says "Virus >Detected" which isn't bad, but I'm getting ready >to turn the reins over for one set of mail servers >to someone else and I want things to be as clear >as possible. > >I'm running mailscanner-4.39.6-1 on that particular >box (I'm doing an overhaul next Saturday on it, >so I'm going to upgrade it to whatever is the >most recent version at that point.) So if this >is in a more recent version, just point me at >it. > > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stebaume2004 at YAHOO.FR Fri Apr 8 16:24:31 2005 From: stebaume2004 at YAHOO.FR (ste baume) Date: Thu Jan 12 21:29:17 2006 Subject: Mailscanner treats the mails very slowly Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, /etc/resolv.conf nameserver 127.0.0.1 nameserver 2ndary DNS Server domain mydomain.com Stephane Mike Kercher wrote: > What does your /etc/resolv.conf have in it? > > Mike > > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of ste baume > Sent: Friday, April 08, 2005 2:05 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Mailscanner treats the mails very slowly > > Hello, > > I omitted to speak about it but cache DNS is active. > I just changed on spam.assassin.pref.conf the following directives : > dns_available yes > rbl_timeout 5 (instead 20) > > What do you think about it ? > > Thanks > > Stephane > > Jeff A. Earickson wrote: > >>Do you run DNS on your mailscanner box? Are DNS > > lookups slow? > >>Having local (cached) DNS on the mailscanner box can > > make a > >>big difference in thruput. >> >>Jeff Earickson >>Colby College >> >>On Thu, 7 Apr 2005, ste baume wrote: >> >> >>>Date: Thu, 7 Apr 2005 18:28:28 +0200 >>>From: ste baume >>>Reply-To: MailScanner mailing list > > > >>>To: MAILSCANNER@JISCMAIL.AC.UK >>>Subject: Mailscanner treats the mails very slowly >>> >>>Hello all, >>> >>>Since many days our MailScanner server have a > > curious > >>>behavior: >>>- Most of the time they work slowly (less than 50 mails by minute are >>>treated) which causes latency > > to > >>>mail delivery (up to 4 hours) >>>- Sometimes, they work normaly and they can empty > > the > >>>queues. >>> >>> >>>First we suspected an issue between the Mailscanner server and the >>>Exchange servers. But after many tests all seem to > > be > >>>OK on this point. >>> >>> >>>When we disable SpamAssasin from the > > mailscanner.conf, > >>>the queues >>>decrease quickly, but after hours the queues > > increase > >>>again. >>>When we disable the Anti-virus from > > mailscanner.conf, > >>>we have no improvement. >>>When we diable Mailscanner, and use only postfix, > > we > >>>have no problem. >>> >>>Volume : 150 000 messages per day >>>Hardware : 1 Pentium Xeon 2.4G, 1.5 MB RAM, 36G > > SCSI > >>>HDD >>>Software : RHE3, Mailscanner 4.40.11, Postfix > > 2.2.1, > >>>SpammAssassin 3.0.2, Kaspersky 5.0 >>>RBL : Postfix (SpamCop, ORDB, SPAMHAUS); None in MailScanner, all in >>>SPAMASSASSIN Average Load : Around 6 >>> >>>Is anybody can help us please, we are in dead end ? >>> >>>Stephane __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Apr 8 16:38:09 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing net behaving strangely Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I am testing the phishing net for the first time. I use MS 4.40.11 on a brand new machine. Language.conf contains: PossibleFraudStart = MailScanner soupçonne le lien PossibleFraudEnd = d'être une tentative de fraude de la part de Here is what I sent to test (I added some underscores to make sure my message would not be trapped again): bad tag
Here is what I got: MailScanner soupçonne le lien "132.210.244.102" d'être une tentative de fraude de la part de pas le bon
Which makes MS' message appear as a link. The message translates to: MS believes the link "132.210.0.0" to be a phishing fraud attempt from bad tag. Is this normal behaviour? Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From martinh at SOLID-STATE-LOGIC.COM Fri Apr 8 16:43:39 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing net behaving strangely Message-ID: Denis there's a setting in MailScanner.conf that will enable or disable the phishing net for ip-address.... # While detecting "Phishing" attacks, do you also want to point out links # to numeric IP addresses. Genuine links to totally numeric IP addresses # are very rare, so this option is set to "yes" by default. If a numeric # IP address is found in a link, the same phishing warning message is used # as in the Find Phishing Fraud option above. # This can also be the filename of a ruleset. Also Find Numeric Phishing = yes -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Denis Beauchemin wrote: > Hello, > > I am testing the phishing net for the first time. I use MS 4.40.11 on a > brand new machine. Language.conf contains: > PossibleFraudStart = MailScanner soupçonne > le lien > PossibleFraudEnd = d'être une tentative de fraude de la part > de > > Here is what I sent to test (I added some underscores to make sure my > message would not be trapped again): > bad tag
> > Here is what I got: > MailScanner > soupçonne le lien "132.210.244.102" d'être une tentative de > fraude de la part de pas le bon
> > Which makes MS' message appear as a link. The message translates to: MS > believes the link "132.210.0.0" to be a phishing fraud attempt from bad > tag. > > Is this normal behaviour? > > Denis > ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Apr 8 16:46:11 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing net behaving strangely Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Hello, > > I am testing the phishing net for the first time. I use MS 4.40.11 on > a brand new machine. Language.conf contains: > PossibleFraudStart = MailScanner soupçonne > le lien > PossibleFraudEnd = d'être une tentative de fraude de la part > de > > Here is what I sent to test (I added some underscores to make sure my > message would not be trapped again): > bad tag
> > Here is what I got: > color="red">MailScanner soupçonne le lien "132.210.244.102" > d'être une tentative de fraude de la part de pas le > bon
> > Which makes MS' message appear as a link. The message translates to: > MS believes the link "132.210.0.0" to be a phishing fraud attempt from > bad tag. > > Is this normal behaviour? > I just tried it again after changing MS' setup to English and the results are the same: MS' warning is inside the link... so I guess it is normal behaviour... I just noticed Martin's answer. I noticed the setup for IP addresses and I think it should be on on my servers. Thanks! -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Fri Apr 8 16:51:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing net behaving strangely Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Denis Beauchemin wrote: > >> Hello, >> >> I am testing the phishing net for the first time. I use MS 4.40.11 >> on a brand new machine. Language.conf contains: >> PossibleFraudStart = MailScanner >> soupçonne le lien >> PossibleFraudEnd = d'être une tentative de fraude de la part >> de >> >> Here is what I sent to test (I added some underscores to make sure my >> message would not be trapped again): >> bad tag
>> >> Here is what I got: >> > color="red">MailScanner soupçonne le lien "132.210.244.102" >> d'être une tentative de fraude de la part de pas le >> bon
>> >> Which makes MS' message appear as a link. The message translates to: >> MS believes the link "132.210.0.0" to be a phishing fraud attempt >> from bad tag. >> >> Is this normal behaviour? >> > I just tried it again after changing MS' setup to English and the > results are the same: MS' warning is inside the link... so I guess it > is normal behaviour... The idea is to leave the link active, but make the warning message part of the link. So if it is a false alarm, they can still easily click on the link. They have to be made aware that what they are doing is potentially dangerous, but I don't (and shouldn't) actually stop them being able to follow the link. -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 8 16:53:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:17 2006 Subject: quarantine report running amok Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did the patch work? I'm off very soon and won't be back online much till tomorrow. Julian Field wrote: > This is possible. Here is a patch for Message.pm to clean up the output: > -----SNIP----- > --- Message.pm.old 2005-04-08 14:33:30.000000000 +0100 > +++ Message.pm 2005-04-08 15:03:20.940680796 +0100 > @@ -3872,12 +3872,18 @@ > my $from = $this->{from}; > #my $to = join(', ', @{$this->{to}}); > my $subj = $this->{subject}; > + my $ip = $this->{clientip}; > my $rept = join(" $reportword: ", @everyrept); > + #print STDERR "Rept is\n$rept\n"; > + > + # Build list of unique archive and quarantine storage locations > my @quarantines = grep /\//, @{$this->{archiveplaces}}; > push @quarantines, grep /\//, @{$this->{quarantineplaces}}; > - my $quarantine = join(", ", @quarantines); > - my $ip = $this->{clientip}; > - #print STDERR "Rept is\n$rept\n"; > + my($quarantine, %quarantinelist); > + foreach $quarantine (@quarantines) { > + $quarantinelist{$quarantine} = 1; > + } > + $quarantine = join(', ', sort keys %quarantinelist); > > # Build unique list of recipients. Avoids Postfix problem which has > # separate lists of real recipients and original recipients. > -----SNIP----- > > Please give this a try and let me know how you get on. > > Jeff A. Earickson wrote: > >> Julian, >> >> MS 4.40.11, Solaris 9. I found this in my daily report of quarantined >> stuff. The push @quarantines in CreatePostmasterNotice() seems to have >> run amok here. Any idea why it would push the same string so many >> times? >> >> j37L9Nr5007705: 137.146.156.144 (xxx@colby.edu) >> quarantine: /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >> /var/spool/MailScanne! >> MailScanner: Executable DOS/Windows programs are dangerous in email >> (SETUP.EXE) >> >> Jeff Earickson >> Colby College >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jaearick at COLBY.EDU Fri Apr 8 18:34:17 2005 From: jaearick at COLBY.EDU (Jeff A. Earickson) Date: Thu Jan 12 21:29:17 2006 Subject: quarantine report running amok Message-ID: Julian, Yes, it looks like it worked. Many thanks. Jeff Earickson Colby College On Fri, 8 Apr 2005, Julian Field wrote: > Date: Fri, 8 Apr 2005 16:53:01 +0100 > From: Julian Field > Reply-To: MailScanner mailing list > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: quarantine report running amok > > Did the patch work? I'm off very soon and won't be back online much till > tomorrow. > > Julian Field wrote: > >> This is possible. Here is a patch for Message.pm to clean up the output: >> -----SNIP----- >> --- Message.pm.old 2005-04-08 14:33:30.000000000 +0100 >> +++ Message.pm 2005-04-08 15:03:20.940680796 +0100 >> @@ -3872,12 +3872,18 @@ >> my $from = $this->{from}; >> #my $to = join(', ', @{$this->{to}}); >> my $subj = $this->{subject}; >> + my $ip = $this->{clientip}; >> my $rept = join(" $reportword: ", @everyrept); >> + #print STDERR "Rept is\n$rept\n"; >> + >> + # Build list of unique archive and quarantine storage locations >> my @quarantines = grep /\//, @{$this->{archiveplaces}}; >> push @quarantines, grep /\//, @{$this->{quarantineplaces}}; >> - my $quarantine = join(", ", @quarantines); >> - my $ip = $this->{clientip}; >> - #print STDERR "Rept is\n$rept\n"; >> + my($quarantine, %quarantinelist); >> + foreach $quarantine (@quarantines) { >> + $quarantinelist{$quarantine} = 1; >> + } >> + $quarantine = join(', ', sort keys %quarantinelist); >> >> # Build unique list of recipients. Avoids Postfix problem which has >> # separate lists of real recipients and original recipients. >> -----SNIP----- >> >> Please give this a try and let me know how you get on. >> >> Jeff A. Earickson wrote: >> >>> Julian, >>> >>> MS 4.40.11, Solaris 9. I found this in my daily report of quarantined >>> stuff. The push @quarantines in CreatePostmasterNotice() seems to have >>> run amok here. Any idea why it would push the same string so many >>> times? >>> >>> j37L9Nr5007705: 137.146.156.144 (xxx@colby.edu) >>> quarantine: /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanner/quarantine/20050407/j37L9Nr5007705, >>> /var/spool/MailScanne! >>> MailScanner: Executable DOS/Windows programs are dangerous in email >>> (SETUP.EXE) >>> >>> Jeff Earickson >>> Colby College >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> -- >> Julian Field >> www.MailScanner.info >> MailScanner thanks transtec Computers for their support >> Buy the MailScanner book at www.MailScanner.info/store >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Apr 8 18:54:45 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:17 2006 Subject: Phishing net behaving strangely Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >>> ... >>> >>> Here is what I got: >>> >> color="red">MailScanner soupçonne le lien "132.210.244.102" >>> d'être une tentative de fraude de la part de pas le >>> bon
>>> >>> Which makes MS' message appear as a link. The message translates to: >>> MS believes the link "132.210.0.0" to be a phishing fraud attempt >>> from bad tag. >>> >>> Is this normal behaviour? >>> >> I just tried it again after changing MS' setup to English and the >> results are the same: MS' warning is inside the link... so I guess it >> is normal behaviour... > > > The idea is to leave the link active, but make the warning message part > of the link. So if it is a false alarm, they can still easily click on > the link. They have to be made aware that what they are doing is > potentially dangerous, but I don't (and shouldn't) actually stop them > being able to follow the link. > Julian, It makes perfect sense but the result is somewhat intriguing nonetheless. ;-) Thanks! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From hkclark at gmail.com Fri Apr 8 20:25:07 2005 From: hkclark at gmail.com (Kennedy Clark) Date: Thu Jan 12 21:29:17 2006 Subject: MailScanner SPAM Forward & Postfix Problem Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew, I can't thank you enough! I did something a little bit different than what you describe, but your explanation made a few things *finally* click for me and it's now working like a champ! I VERY much appreciate all the helpful advice I received in this thread. I will carry the info I gained over to the CentOS list so those folks can benefit as well. Now on to getting a single instance of Postfix working as per Glenn's suggestion! :-) Regards, Kennedy PS -- And, to answer your question about local account: yes, I'm using all local mail accounts on this box. On Apr 8, 2005 8:23 AM, Drew Marshall wrote: > > OK here is the first problem. You _don't_ have mydomain listed under > mydestination. Move it from virtual_alias_domains to mydestination. (This > assumes that you deliver mail to local mailboxes, which I believe is true > but you haven't confirmed). > > > virtual_alias_maps = hash:/etc/postfix/virtual_alias > > Again with the same assumption, move any reference to mydomain out of > virtual_alias and any aliases to _real_ accounts into /etc/postfix/aliases > > > alias_maps = hash:/etc/postfix/aliases > > Have I got something else hosed? Is using the virtual_alias_maps > > supposed to complete shut off the normal aliases file? > > No, the idea of virtual_alias_maps is that it translates virtual aliases > to either virtual mailboxes or other addresses for example, > sales@virtdomain.com becomes salesman@internal.virtdomain.com (So you can > run MailScanner as a gateway in front of Exchange or Notes for example). > For anything local, you must use proper shell accounts and the aliases > table (Where domains are not listed). Some times users don't want/ need > shell accounts so you can use virtual_mailbox_domains for these, this > needs more setting up to do correctly, but it's not too tricky. Speak to > me off list if you want help with that). > > > (Actually, I know it's still there in some way [it still works for the > "devnull: > > /dev/null" entry I have in /etc/postfix/aliases], but all I can't get > > it to work for normal email addresses [local or remote]). > > > > It's driving me crazy! Am I doing something dumb here? Maybe I'm the > > one who needs coffee. :-) > > Drew > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Fri Apr 8 22:10:05 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:29:17 2006 Subject: Mail Archiving (OT) Message-ID: I'm working with the "forward" command in a delivery ruleset for MailScanner. I have the actual ruleset working just fine. However, the archiving company that I have to forward the e-mail copies to has a bit of a strange setup. Here's the scenario: Let's say I have to forward the e-mail copies to archive@archivedomain.com But archivedomain.com does not actually have any A records. Further, it has 4 MX records that all point to bogus IP addresses. I have been given the actual IP address and now have the responsibility of configuring my server to ignore the public (bogus) DNS records and deliver any mail that is addressed to archive@archivedomain.com to the IP address I've been given. I'm running FreeBSD 4.7 with Sendmail 8.13.1 Thanks in advance for any help. -Brendan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Fri Apr 8 22:31:52 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:17 2006 Subject: Mail Archiving (OT) Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of chardlist > Sent: Friday, April 08, 2005 5:10 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Mail Archiving (OT) > > I'm working with the "forward" command in a delivery ruleset for > MailScanner. I have the actual ruleset working just fine. However, the > archiving company that I have to forward the e-mail copies to has a bit of > a > strange setup. > > Here's the scenario: > > Let's say I have to forward the e-mail copies to archive@archivedomain.com > > But archivedomain.com does not actually have any A records. Further, it > has > 4 MX records that all point to bogus IP addresses. > > I have been given the actual IP address and now have the responsibility of > configuring my server to ignore the public (bogus) DNS records and deliver > any mail that is addressed to archive@archivedomain.com to the IP address > I've been given. > > I'm running FreeBSD 4.7 with Sendmail 8.13.1 > > Thanks in advance for any help. > > -Brendan > Brendan, This is ugly since Sendmail really really likes to use DNS data. The simplest way might be to set up a DNS server with internal and external views. The internal view would have "faked" entries for the MX records for archivedomain.com that point to the IP addresses they provided you. Steve Steve Swaney President Fortress Systems Ltd. Phone: 202 338-1670 Cell: 202 352-3262 www.fsl.com steve.swaney@fsl.com Steve Swaney President Fortress Systems Ltd. Phone: 202 338-1670 Cell: 202 352-3262 www.fsl.com steve.swaney@fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Fri Apr 8 23:17:59 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:17 2006 Subject: Mail Archiving (OT) Message-ID: I would add archivedomain.com to /etc/mail/relay-domains. Then I'd use a mailertable entry to tell sendmail where to send the mail: archivedomain.com esmtp:[192.168.1.1] Mike -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of chardlist Sent: Friday, April 08, 2005 4:10 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Mail Archiving (OT) I'm working with the "forward" command in a delivery ruleset for MailScanner. I have the actual ruleset working just fine. However, the archiving company that I have to forward the e-mail copies to has a bit of a strange setup. Here's the scenario: Let's say I have to forward the e-mail copies to archive@archivedomain.com But archivedomain.com does not actually have any A records. Further, it has 4 MX records that all point to bogus IP addresses. I have been given the actual IP address and now have the responsibility of configuring my server to ignore the public (bogus) DNS records and deliver any mail that is addressed to archive@archivedomain.com to the IP address I've been given. I'm running FreeBSD 4.7 with Sendmail 8.13.1 Thanks in advance for any help. -Brendan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at ALPHA.RBRANA.CO.ID Sat Apr 9 05:48:16 2005 From: ius at ALPHA.RBRANA.CO.ID (ius) Date: Thu Jan 12 21:29:17 2006 Subject: unsuccesfull make Mail::ClamAV Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Guys, Trying to install Mail::Clamav-0.17 here, and unsuccesfull. [root@sigma Mail-ClamAV-0.17]# perl Makefile.PL Checking if your kit is complete... Looks good Writing Makefile for Mail::ClamAV [root@sigma Mail-ClamAV-0.17]# make cp ClamAV.pm blib/lib/Mail/ClamAV.pm /usr/bin/perl -Mblib -MInline=NOISY,_INSTALL_ -MMail::ClamAV -e1 0.17 blib/arch Starting Build Prepocess Stage Finished Build Prepocess Stage Starting Build Parse Stage Finished Build Parse Stage Starting Build Glue 1 Stage Finished Build Glue 1 Stage Starting Build Glue 2 Stage Finished Build Glue 2 Stage Starting Build Glue 3 Stage Finished Build Glue 3 Stage Starting Build Compile Stage Starting "perl Makefile.PL" Stage Writing Makefile for Mail::ClamAV Finished "perl Makefile.PL" Stage Starting "make" Stage make[1]: Entering directory `/root/.cpan/build/Mail-ClamAV-0.17/_Inline/build/Mail/ClamAV' /usr/bin/perl /usr/lib/perl5/5.8.3/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.3/ExtUtils/typemap ClamAV.xs > ClamAV.xsc && mv ClamAV.xsc ClamAV.c gcc -c -I/root/.cpan/build/Mail-ClamAV-0.17 -I/usr/include -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -march=i386 -mcpu=i686 -DVERSION=\"0.17\" -DXS_VERSION=\"0.17\" -fPIC "-I/usr/lib/perl5/5.8.3/i386-linux-thread-multi/CORE" ClamAV.c Running Mkbootstrap for Mail::ClamAV () chmod 644 ClamAV.bs rm -f blib/arch/auto/Mail/ClamAV/ClamAV.so LD_RUN_PATH="/usr/lib" gcc -shared -L/usr/local/lib ClamAV.o -o blib/arch/auto/Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 -lgmp -lcurl -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl -lz -lz -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl -lz -lz -lpthread -lclamav /usr/bin/ld: cannot find -lbz2 collect2: ld returned 1 exit status make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 make[1]: Leaving directory `/root/.cpan/build/Mail-ClamAV-0.17/_Inline/build/Mail/ClamAV' A problem was encountered while attempting to compile and install your Inline C code. The command that failed was: make The build directory was: /root/.cpan/build/Mail-ClamAV-0.17/_Inline/build/Mail/ClamAV To debug the problem, cd to the build directory, and inspect the output files. at /root/.cpan/build/Mail-ClamAV-0.17/blib/lib/Mail/ClamAV.pm line 193 BEGIN failed--compilation aborted at /root/.cpan/build/Mail-ClamAV-0.17/blib/lib/Mail/ClamAV.pm line 537. Compilation failed in require. BEGIN failed--compilation aborted. make: *** [ClamAV.inl] Error 2 [root@sigma Mail-ClamAV-0.17]# Anybody know what's wrong ? Thanks a lot ius ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Sat Apr 9 11:16:10 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:17 2006 Subject: unsuccesfull make Mail::ClamAV Message-ID: > rm -f blib/arch/auto/Mail/ClamAV/ClamAV.so > LD_RUN_PATH="/usr/lib" gcc -shared -L/usr/local/lib ClamAV.o -o > blib/arch/auto/Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 > -lgmp -lcurl > -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl > -lz -lz -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err > -lk5crypto -lresolv -ldl -lz -lz -lpthread -lclamav > /usr/bin/ld: cannot find -lbz2 You probably don't have the bzip2-devel package installed (assuming you have a redhat-ish rpm-based system)... So there is no lib to link against. Install it, rerun... and you should be fine. -- Glenn > Anybody know what's wrong ? > > Thanks a lot > ius > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From t.d.lee at DURHAM.AC.UK Sat Apr 9 11:25:57 2005 From: t.d.lee at DURHAM.AC.UK (David Lee) Date: Thu Jan 12 21:29:17 2006 Subject: unsuccesfull make Mail::ClamAV Message-ID: On Sat, 9 Apr 2005, ius wrote: > Trying to install Mail::Clamav-0.17 here, and unsuccesfull. > > [root@sigma Mail-ClamAV-0.17]# perl Makefile.PL > Checking if your kit is complete... > Looks good > Writing Makefile for Mail::ClamAV > > [root@sigma Mail-ClamAV-0.17]# make > cp ClamAV.pm blib/lib/Mail/ClamAV.pm > [...] > LD_RUN_PATH="/usr/lib" gcc -shared -L/usr/local/lib ClamAV.o -o > blib/arch/auto/Mail/ClamAV/ClamAV.so -L/usr/lib -lz -lbz2 -lgmp -lcurl > -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto -lresolv -ldl > -lz -lz -lssl -lcrypto -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lcom_err > -lk5crypto -lresolv -ldl -lz -lz -lpthread -lclamav > /usr/bin/ld: cannot find -lbz2 > collect2: ld returned 1 exit status > make[1]: *** [blib/arch/auto/Mail/ClamAV/ClamAV.so] Error 1 > make[1]: Leaving directory > `/root/.cpan/build/Mail-ClamAV-0.17/_Inline/build/Mail/ClamAV' > [...] In my experience, the building and testing of Mail::ClamAV is sensitive to local variations of things like "PATH" and "LD_RUN_PATH". Mail::ClamAV depends on other software. That's fine: indeed, it is a good principle. But if those things are not in the places "Mail:ClamAV" expects them on your system, then errors such as you see above tend to occur. If this is the case, you need to help it along, hold its hand, etc. In your case, when attempting to link "Mail::ClamAV" to the libraries it needs, it cannot find the libraries for "bz2". So firstly you need to find out where the "bz2" library (probably called something like "libbz2.so") lives on your system. Then you probably need to do something like adjusting the LD_RUN_PATH environment variable (and "export" if your shell requires it) to include this directory location that leads to that library. Then rebuild. For safety, rebuild from scratch: "make clean; perl Makefile.PL; make". (If you are comfortable with, and knowledgable about, your shell, make, perl, etc., then you might be able to make some shortcuts in the above.) Note carefully the words "probably" and "something like" in the above. It is intended as a guide to be read, interpreted and adapted; it isn't a guaranteed recipe to work! Hope that helps. (I'm going to be out of email contact for the next week or so, so any further help will have to come from other folk.) -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : University of Durham : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham : : Phone: +44 191 334 2752 U.K. : ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jwilliams at courtesymortgage.com Sun Apr 10 00:52:31 2005 From: jwilliams at courtesymortgage.com (Jason) Date: Thu Jan 12 21:29:17 2006 Subject: FreeBSD users out there... Message-ID: Just wanted to get some friendly advice and recommendations from fellow FreeBSD users out there. i'm going to upgrading Mailscanner this week from 4.29 to the latest stable version in the ports. i will also be updating SA from 2.64 to the latest stable in Ports as well. I have portupgrade installed and was curious as to what others recommend. maybe a simple; portupgrade Or any other nifty tricks. i usually just use portupgrade , but I figured i'd ask here, see what others experience as been. Much appreciated. Jas ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Apr 10 01:11:03 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:17 2006 Subject: FreeBSD users out there... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jason wrote: >Just wanted to get some friendly advice and recommendations from fellow >FreeBSD users out there. > >i'm going to upgrading Mailscanner this week from 4.29 to the latest stable >version in the ports. > >i will also be updating SA from 2.64 to the latest stable in Ports as well. > >I have portupgrade installed and was curious as to what others recommend. > >maybe a simple; portupgrade > > For SpamAssassin, yes. For MailScanner, no. Personally, I would always look to build MS thus: $ cd /usr/ports/mail/mailscanner $ make $make deinstall ^^^^^^^^^^^^ to remove the old version $ make reinstall Then you still keep access to the wrapper and languages update scripts (Details of which you will see at the end of the installation. Once you have done these (If required) then $ make clean You then need to cd to /usr/local/etc/MailScanner and check the MailScanner.conf..new (I think it's called. You won't miss it anyway). It will have been automatically updated with the details from your old MailScanner.conf but there may be new features or options. You can compare against the default, which will also be in the same directory called MailScanner.conf.sample. Check also the differences between the other old files in that directory and the .sample new ones (Use diff to help you). I would also check the change log at www.mailscanner.info for other details as you might want to look at phishing safe site lists for example. Once you are happy you are ready to go. Don't forget you ought to run $ portupgrade -an just to see what else needs updating. There could well be perl modules that MS wants that need updating also. If you upgrade MS first and you are happy with the output of portupgrade -an just run portupgrade -a and go for coffee! The portupgrade will do the rest. Good luck Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jwilliams at courtesymortgage.com Sun Apr 10 01:29:59 2005 From: jwilliams at courtesymortgage.com (Jason) Date: Thu Jan 12 21:29:17 2006 Subject: FreeBSD users out there... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Drew. I appreciate your suggestions. I noted below: > For SpamAssassin, yes. For MailScanner, no. Personally, I would always > look to build MS thus: > $ cd /usr/ports/mail/mailscanner > $ make > $make deinstall > ^^^^^^^^^^^^ to remove the old version > $ make reinstall > Then you still keep access to the wrapper and languages update scripts > (Details of which you will see at the end of the installation. Once you > have done these (If required) then > $ make clean Good to know. Looks pretty straight forward really. No jumping through rings of fire or eating glass. :D > > You then need to cd to /usr/local/etc/MailScanner and check the > MailScanner.conf..new (I think it's called. You won't > miss it anyway). It will have been automatically updated with the > details from your old MailScanner.conf but there may be new features or > options. You can compare against the default, which will also be in the > same directory called MailScanner.conf.sample. Check also the > differences between the other old files in that directory and the > .sample new ones (Use diff to help you). I would also check the change > log at www.mailscanner.info for other details as you might want to look > at phishing safe site lists for example. Once you are happy you are > ready to go. Alright. I'll make sure I do that. Reading the changelog as I write. > > Don't forget you ought to run $ portupgrade -an just to see what else > needs updating. There could well be perl modules that MS wants that need > updating also. If you upgrade MS first and you are happy with the output > of portupgrade -an just run portupgrade -a and go for coffee! The > portupgrade will do the rest. You know, i forgot about using portupgrade -an. Really is a handy tool. If you don't mind, just for kicks i ran it inside the mailscanner port (/usr/ports/mail/mailscanner) as well as the spamassassin port (/usr/ports/mail/p5-Mail-SpamAsassin). Interesting thing happened when I ran portupgrade -an in the SA port: Looking at the output, it looks as if it wants to upgrade quite a bit of ports. Some of them are: bash2 sudo sendmail apache Even had mailscanner in there. :) I was a little surprised by this. Is that correct? I could email you a output list if you like if your curious to see what it came up with. > > Good luck > thanks Jason ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sun Apr 10 01:47:13 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:17 2006 Subject: FreeBSD users out there... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jason wrote: Hi Drew. I appreciate your suggestions. I noted below: For SpamAssassin, yes. For MailScanner, no. Personally, I would always look to build MS thus: $ cd /usr/ports/mail/mailscanner $ make $make deinstall ^^^^^^^^^^^^ to remove the old version $ make reinstall Then you still keep access to the wrapper and languages update scripts (Details of which you will see at the end of the installation. Once you have done these (If required) then $ make clean Good to know. Looks pretty straight forward really. No jumping through rings of fire or eating glass. :D You then need to cd to /usr/local/etc/MailScanner and check the MailScanner.conf..new (I think it's called. You won't miss it anyway). It will have been automatically updated with the details from your old MailScanner.conf but there may be new features or options. You can compare against the default, which will also be in the same directory called MailScanner.conf.sample. Check also the differences between the other old files in that directory and the .sample new ones (Use diff to help you). I would also check the change log at www.mailscanner.info for other details as you might want to look at phishing safe site lists for example. Once you are happy you are ready to go. Alright. I'll make sure I do that. Reading the changelog as I write. Don't forget you ought to run $ portupgrade -an just to see what else needs updating. There could well be perl modules that MS wants that need updating also. If you upgrade MS first and you are happy with the output of portupgrade -an just run portupgrade -a and go for coffee! The portupgrade will do the rest. You know, i forgot about using portupgrade -an. Really is a handy tool. If you don't mind, just for kicks i ran it inside the mailscanner port (/usr/ports/mail/mailscanner) as well as the spamassassin port (/usr/ports/mail/p5-Mail-SpamAsassin). Interesting thing happened when I ran portupgrade -an in the SA port: Looking at the output, it looks as if it wants to upgrade quite a bit of ports. Some of them are: bash2 sudo sendmail apache Even had mailscanner in there. :) I was a little surprised by this. Is that correct? I could email you a output list if you like if your curious to see what it came up with. The -a flag of portupgrade means all and -n is no action. It doesn't matter where you run the command, portupgrade will look to upgrade *all* the packages on your machine. In this instance it includes Apache, Sendmail and I would be surprised to see a raft of perl modules. Now if you don't want to update every thing, you can be clever and just: $ cd /var/db/pkg (Which is the database of all the packages and ports installed on your box) $ portupgrade p5-* (which would upgrade all the perl modules, for example) So you can use wildcards, which is really handy for the perl modules. HTH Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From carinus.carelse at MRC.AC.ZA Mon Apr 11 06:51:28 2005 From: carinus.carelse at MRC.AC.ZA (Carinus Carelse) Date: Thu Jan 12 21:29:17 2006 Subject: Two Copies of Mailscanner with different exim configs Message-ID: I would like to have two copies of mailscanner running with a different exim config for each one and a different set of rules for each one. Is this possible and how do I go about doing it. Carinus ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smilga at MIKROTIK.COM Mon Apr 11 08:04:35 2005 From: smilga at MIKROTIK.COM (Martins Smilga) Date: Thu Jan 12 21:29:17 2006 Subject: Cannot allocate memory Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, What could couse this error? Mailscanner was running more then month without any problem. MailScanner[15034]: fork: Cannot allocate memory Best Regards, Martins Smilga ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 11 08:08:59 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:17 2006 Subject: Two Copies of Mailscanner with different exim configs Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just have 2 different MailScanner.conf files and start them up with MailScanner /etc/MailScanner/config1.conf MailScanner /etc/MailScanner/config2.conf You will obviously need 2 incoming, outgoing directories, though they should be able to share a working and quarantine directory. You will see how to start up exim with different configs in the MailScanner init.d script. Carinus Carelse wrote: > > I would like to have two copies of mailscanner running with a > different exim config for each one and a different set of rules for > each one. Is this possible and how do I go about doing it. > > > Carinus > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 11 08:10:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:17 2006 Subject: Cannot allocate memory Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What is your "Restart Every" setting? How much RAM do you have? What did you set "Max Children" to be? What else is the machine running apart from MailScanner? Martins Smilga wrote: > Hello, > > What could couse this error? Mailscanner was running more then month > without > any problem. > > MailScanner[15034]: fork: Cannot allocate memory -- Julian Field www.MailScanner.info MailScanner thanks transtec Computers for their support Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bg.mahesh at INDIAINFO.COM Mon Apr 11 08:19:17 2005 From: bg.mahesh at INDIAINFO.COM (BG Mahesh) Date: Thu Jan 12 21:29:18 2006 Subject: ExtUtils-MakeMaker-6.05 problem Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Can anyone help me how I could solve this problem? ----- Original Message ----- From: "BG Mahesh" To: MAILSCANNER@JISCMAIL.AC.UK Subject: ExtUtils-MakeMaker-6.05 problem Date: Fri, 8 Apr 2005 10:17:07 +0530 > > hi > > I am trying to install MS 4.40.11-1 on a Linux machine. I have > manually installed ExtUtils-MakeMaker-6.27 from cpan.org > > During installation of MS the error I get is, > > /usr/bin/instmodshX' = X ']' > + /usr/lib/rpm/find-debuginfo.sh /usr/src/redhat/BUILD/ExtUtils-MakeMaker-6.05 > 0 blocks > find: /var/tmp/perl-ExtUtils-MakeMaker-6.05-1-root/usr/lib/debug: > No such file or directory > > Shouldn't MS skip the installation of ExtUtils-MakeMaker-6.05 > because I have a newer version? > > find: /var/tmp/perl-Net-CIDR-0.10-1-root/usr/lib/debug: No such > file or directory > + /usr/lib/rpm/redhat/brp-compress > + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip > + /usr/lib/rpm/redhat/brp-strip-static-archive /usr/bin/strip > + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump > Processing files: perl-Net-CIDR-0.10-1 > error: Couldn't exec /usr/lib/rpm/perl.prov: No such file or directory > getOutputFrom(): Broken pipe > > I already have the latest Net::CDIR, not sure why it is being installed. > > HOw can I solve this? > > -- > B.G. Mahesh > bg.mahesh@indiainfo.com > http://www.indiainfo.com/ > > -- > ______________________________________________ > IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com > Check out our value-added Premium features, such as an extra 20MB > for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! > > Powered by Outblaze > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- B.G. Mahesh bg.mahesh@indiainfo.com http://www.indiainfo.com/ -- ______________________________________________ IndiaInfo Mail - the free e-mail service with a difference! www.indiainfo.com Check out our value-added Premium features, such as an extra 20MB for mail storage, POP3, e-mail forwarding, and ads-free mailboxes! Powered by Outblaze ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smilga at MIKROTIK.COM Mon Apr 11 09:21:03 2005 From: smilga at MIKROTIK.COM (Martins Smilga) Date: Thu Jan 12 21:29:18 2006 Subject: Cannot allocate memory Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, > What is your "Restart Every" setting? Restart Every = 14400 > How much RAM do you have? 776856k > What did you set "Max Children" to be? Max Children = 5 > What else is the machine running apart from MailScanner? Exim and Mailscanner-mrtg Thanks in advance. Best Regards, Martins ----- Original Message ----- From: "Julian Field" To: Sent: Monday, April 11, 2005 10:10 AM Subject: Re: Cannot allocate memory > What is your "Restart Every" setting? > How much RAM do you have? > What did you set "Max Children" to be? > What else is the machine running apart from MailScanner? > > Martins Smilga wrote: > >> Hello, >> >> What could couse this error? Mailscanner was running more then month >> without >> any problem. >> >> MailScanner[15034]: fork: Cannot allocate memory > > > -- > Julian Field > www.MailScanner.info > MailScanner thanks transtec Computers for their support > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Danny_Beland at PCH.GC.CA Mon Apr 11 16:24:18 2005 From: Danny_Beland at PCH.GC.CA (Danny Beland) Date: Thu Jan 12 21:29:18 2006 Subject: Emails are getting stuck in the mqueue.in directory Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm running Linux with sendmail v8.12.10, MailScanner v4.40.11, ClamAV and McAfee command line scanner. The problem we have is that emails get stuck in the mqueue.in folder. When there is new messages, we can see that there is some getting stuck . In the log below we can see that it only gets 4 messages out but there is still 34 left, but after it is done scanning, it doesn't go to grab the 34 messages left. The content of the mqueue.in folder is listed after the mailscanner log. I was using flock as the lock type before, but the same problem occurs. There is also nothing in the incoming folders. I am not sure if it is a setting that is causing this or it is a bug. Thanks!! Apr 11 11:04:24 hound2 MailScanner[13081]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13628]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13349]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13185]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13532]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[12896]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13745]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13869]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[12930]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13044]: MailScanner child caught a SIGHUP Apr 11 11:04:30 hound2 MailScanner[14192]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:04:30 hound2 MailScanner[14192]: Read 0 hostnames from the phishing whitelist Apr 11 11:04:31 hound2 MailScanner[14192]: Using locktype = posix Apr 11 11:04:31 hound2 MailScanner[14192]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:04:31 hound2 MailScanner[14192]: New Batch: Found 34 messages waiting Apr 11 11:04:31 hound2 MailScanner[14192]: New Batch: Scanning 4 messages, 26463 bytes Apr 11 11:04:31 hound2 MailScanner[14192]: Spam Checks: Starting Apr 11 11:04:32 hound2 MailScanner[14192]: Message j3BF4No5014108 from 142.195.251.129 (julie.meloche@desjardins.com) to pch.gc.ca is not spam, SpamAssassin (score=-1.49, required 3.8, AWL 0.01, BAYES_00 -2.60, NO_REAL_NAME 0.01, PRIORITY_NO_NAME 1.10) Apr 11 11:04:34 hound2 MailScanner[14192]: Message j3BF4Oo4014130 from 24.201.245.36 (stephane.01@videotron.ca) to pc.gc.cais not spam, SpamAssassin (score=-2.514, required 3.8, autolearn=not spam, AWL 0.09, BAYES_00 -2.60) Apr 11 11:04:35 hound2 MailScanner[14192]: Message j3BF4Mo4014096 from 129.33.92.44 (christine@thedavisfamily.ca) to pch.gc.ca is not spam, SpamAssassin (score=-2.292, required 3.8, BAYES_00 -2.60, NO_REAL_NAME 0.01, SARE_WEOFFER 0.30) Apr 11 11:04:35 hound2 MailScanner[14192]: Message j3BF4Mo4014099 from 64.254.157.135 (louise.danjou@cossette.com) to pch.gc.ca is not spam, SpamAssassin (score=-2.461, required 3.8, AWL 0.02, BAYES_00 -2.60, HTML_MESSAGE 0.00, HTML_TAG_EXIST_TBODY 0.11) Apr 11 11:04:36 hound2 MailScanner[14192]: Virus and Content Scanning: Starting Apr 11 11:04:37 hound2 MailScanner[14192]: tag found in message j3BF4Mo4014099 from louise.danjou@cossette.com Apr 11 11:04:37 hound2 MailScanner[14192]: Uninfected: Delivered 4 messages Apr 11 11:04:41 hound2 MailScanner[14219]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:04:41 hound2 MailScanner[14219]: Read 0 hostnames from the phishing whitelist Apr 11 11:04:42 hound2 MailScanner[14219]: Using locktype = posix Apr 11 11:04:42 hound2 MailScanner[14219]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:04:52 hound2 MailScanner[14220]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:04:52 hound2 MailScanner[14220]: Read 0 hostnames from the phishing whitelist Apr 11 11:04:53 hound2 MailScanner[14220]: Using locktype = posix Apr 11 11:04:53 hound2 MailScanner[14220]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:03 hound2 MailScanner[14221]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:03 hound2 MailScanner[14221]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:04 hound2 MailScanner[14221]: Using locktype = posix Apr 11 11:05:04 hound2 MailScanner[14221]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:14 hound2 MailScanner[14224]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:14 hound2 MailScanner[14224]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:15 hound2 MailScanner[14224]: Using locktype = posix Apr 11 11:05:15 hound2 MailScanner[14224]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:25 hound2 MailScanner[14227]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:25 hound2 MailScanner[14227]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:27 hound2 MailScanner[14227]: Using locktype = posix Apr 11 11:05:27 hound2 MailScanner[14227]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:36 hound2 MailScanner[14231]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:36 hound2 MailScanner[14231]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:37 hound2 MailScanner[14231]: Using locktype = posix Apr 11 11:05:37 hound2 MailScanner[14231]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:47 hound2 MailScanner[14232]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:47 hound2 MailScanner[14232]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:49 hound2 MailScanner[14232]: Using locktype = posix Apr 11 11:05:49 hound2 MailScanner[14232]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:58 hound2 MailScanner[14235]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:58 hound2 MailScanner[14235]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:59 hound2 MailScanner[14235]: Using locktype = posix Apr 11 11:05:59 hound2 MailScanner[14235]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:06:09 hound2 MailScanner[14236]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:06:09 hound2 MailScanner[14236]: Read 0 hostnames from the phishing whitelist Apr 11 11:06:10 hound2 MailScanner[14236]: Using locktype = posix Apr 11 11:06:10 hound2 MailScanner[14236]: Creating hardcoded struct_flock subroutine for linux (Linux-type) hound2:/var/spool/mqueue.in # date Mon Apr 11 11:09:24 EDT 2005 hound2:/var/spool/mqueue.in # ls -la total 8847 drwx------ 3 root root 2448 Apr 11 11:04 . drwxr-xr-x 14 root root 392 Mar 7 07:08 .. drwx------ 2 root root 48 Apr 1 11:37 .hoststat -rw------- 1 root mail 0 Mar 23 11:18 dfj2NEI6xL013577 -rw------- 1 root mail 28672 Mar 23 10:00 dfj2NEiZxL000663 -rw------- 1 root mail 49152 Mar 23 10:30 dfj2NFNDxL027390 -rw------- 1 root mail 8192 Mar 23 10:27 dfj2NFNRxL027535 -rw------- 1 root mail 933888 Mar 23 11:27 dfj2NGR3xL009916 -rw------- 1 root mail 45056 Mar 23 11:38 dfj2NGZbhN013223 -rw------- 1 root mail 36864 Mar 23 11:52 dfj2NGiFhN018441 -rw------- 1 root mail 16384 Mar 23 11:54 dfj2NGnNhN021755 -rw------- 1 root mail 12288 Mar 23 12:19 dfj2NHG4hN005200 -rw------- 1 root mail 36864 Mar 23 12:33 dfj2NHRChN011805 -rw------- 1 root mail 32768 Mar 23 12:34 dfj2NHTAhN012967 -rw------- 1 root mail 12288 Mar 23 12:37 dfj2NHY3hN016085 -rw------- 1 root mail 20480 Mar 23 12:45 dfj2NHiPhN022029 -rw------- 1 root mail 28672 Mar 23 12:55 dfj2NHpkhN026568 -rw------- 1 root mail 49152 Mar 23 13:10 dfj2NHsnhN028287 -rw------- 1 root mail 1294336 Mar 23 13:11 dfj2NHv6hN029541 -rw------- 1 root mail 2375680 Mar 23 13:11 dfj2NHv6hN029542 -rw------- 1 root mail 24576 Mar 23 13:10 dfj2NI1vhN032534 -rw------- 1 root mail 368640 Mar 23 13:47 dfj2NIlL9h026163 -rw------- 1 root mail 8192 Mar 24 10:55 dfj2OFsFmq028118 -rw------- 1 root mail 16384 Mar 24 10:55 dfj2OFslmq028381 -rw------- 1 root mail 28672 Mar 24 10:56 dfj2OFtpmq028984 -rw------- 1 root mail 139264 Mar 24 10:56 dfj2OFummq029645 -rw------- 1 root mail 541 Apr 1 11:35 dfj31EZ1q7006497 -rw------- 1 root mail 16384 Apr 1 10:19 dfj31FIwq7010985 -rw------- 1 root mail 20480 Apr 1 10:24 dfj31FM9q7013458 -rw------- 1 root mail 16384 Apr 1 11:44 dfj31Gikq7017302 -rw------- 1 root mail 872 Apr 4 10:08 dfj34C8nOj011677 -rw------- 1 root mail 61440 Apr 4 08:53 dfj34ClhOj026253 -rw------- 1 root mail 16384 Apr 4 09:08 dfj34D6YOj020610 -rw------- 1 root mail 155648 Apr 4 09:53 dfj34DaiOj000798 -rw------- 1 root mail 421888 Apr 4 09:44 dfj34Dd0Oj004396 -rw------- 1 root mail 368640 Apr 4 10:05 dfj34E2pOj009876 -rw------- 1 root mail 708608 Apr 4 10:14 dfj34E8UOj017604 -rw------- 1 root mail 28672 Apr 11 09:12 dfj3BDAsWg029242 -rw------- 1 root mail 32768 Apr 11 09:26 dfj3BDJiWg003720 -rw------- 1 root mail 49152 Apr 11 09:33 dfj3BDVOWh011659 -rw------- 1 root mail 61440 Apr 11 09:33 dfj3BDVPWh011695 -rw------- 1 root mail 8192 Apr 11 09:33 dfj3BDVWWh011768 -rw------- 1 root mail 20480 Apr 11 09:34 dfj3BDVXWh011771 -rw------- 1 root mail 32768 Apr 11 09:43 dfj3BDduWg017597 -rw------- 1 root mail 32768 Apr 11 09:48 dfj3BDjOWg021883 -rw------- 1 root mail 831488 Apr 11 10:41 dfj3BEdFWg027932 -rw------- 1 root mail 638976 Apr 11 10:52 dfj3BElWWg001619 -rw------- 1 root mail 923 Apr 5 00:56 qfj352riWh022594 -rw------- 1 root mail 967 Apr 5 09:28 qfj35BSMWh013958 -rw------- 1 root mail 925 Apr 5 14:18 qfj35GHhWh004468 -rw------- 1 root mail 949 Apr 5 16:05 qfj35I5kWh013983 -rw------- 1 root mail 977 Apr 5 16:09 qfj35I60Wh014078 -rw------- 1 root mail 940 Apr 5 19:08 qfj35L7sWh004843 -rw------- 1 root mail 953 Apr 6 01:40 qfj363aaWh008242 -rw------- 1 root mail 1711 Apr 6 00:20 qfj364J3Wo022047 -rw------- 1 root mail 1001 Apr 6 04:52 qfj366q0Wh003389 -rw------- 1 root mail 1046 Apr 6 23:23 qfj371NVWh010276 -rw------- 1 root mail 961 Apr 7 00:54 qfj372qWWh006615 -rw------- 1 root mail 928 Apr 7 02:15 qfj374CoWi031202 -rw------- 1 root mail 971 Apr 7 17:01 qfj37IwpWh004066 -rw------- 1 root mail 924 Apr 8 03:00 qfj38404Wh003283 -rw------- 1 root mail 924 Apr 8 03:35 qfj384YMWh013402 -rw------- 1 root mail 925 Apr 8 04:05 qfj3863tWh006263 -rw------- 1 root mail 916 Apr 8 10:20 qfj38CHnWh000714 -rw------- 1 root mail 965 Apr 8 15:57 qfj38HsLWh004420 -rw------- 1 root mail 915 Apr 8 20:13 qfj38MC0Wh007466 -rw------- 1 root mail 944 Apr 8 23:42 qfj391dvWh009561 -rw------- 1 root mail 915 Apr 9 01:07 qfj39260Wh016687 -rw------- 1 root mail 914 Apr 9 21:58 qfj39MvdWh023748 -rw------- 1 root mail 916 Apr 10 04:46 qfj3A6ebWh030427 -rw------- 1 root mail 916 Apr 10 09:43 qfj3ABWdWh030461 -rw------- 1 root mail 996 Apr 10 11:40 qfj3ADduWh027873 -rw------- 1 root mail 1008 Apr 10 16:23 qfj3AILcWh007512 -rw------- 1 root mail 950 Apr 10 23:05 qfj3B0vZWo005462 -rw------- 1 root mail 1007 Apr 11 00:19 qfj3B4JMWg020843 -rw------- 1 root mail 920 Apr 11 03:50 qfj3B5n2Wh013589 -rw------- 1 root mail 950 Apr 11 10:14 qfj3BCDgWh028342 hound2:/var/spool/mqueue.in # ls -1|wc -l 77 hound2:/var/spool/mqueue.in # ... hound2:/var/spool/MailScanner/incoming # ls * 14192: . .. 14219: . .. 14220: . .. 14221: . .. 14224: . .. 14227: . .. 14231: . .. 14232: . .. 14235: . .. 14236: . .. hound2:/var/spool/MailScanner/incoming # cd ../quarantine/ hound2:/var/spool/MailScanner/quarantine # ls . .. Danny Béland ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Danny_Beland at PCH.GC.CA Mon Apr 11 19:57:55 2005 From: Danny_Beland at PCH.GC.CA (Danny Beland) Date: Thu Jan 12 21:29:18 2006 Subject: Emails are getting stuck in the mqueue.in directory Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] That is what I was using before trying posix and I had the same problem. Danny -----"Chris Picciotto" wrote: ----- To: From: "Chris Picciotto" Date: 04/11/2005 01:56PM Subject: Re: Emails are getting stuck in the mqueue.in directory Hi Danny, Sorry - I did not reply to the list. But it appears you have the incorrect file locking type. MailScanner should be set to "flock" not "posix" to clear the files. Try that? Hope it helps, Chris ----- Original Message ----- From: Danny Beland Newsgroups: gmane.mail.virus.mailscanner Sent: Monday, April 11, 2005 5:24 AM Subject: Emails are getting stuck in the mqueue.in directory I'm running Linux with sendmail v8.12.10, MailScanner v4.40.11, ClamAV and McAfee command line scanner. The problem we have is that emails get stuck in the mqueue.in folder. When there is new messages, we can see that there is some getting stuck . In the log below we can see that it only gets 4 messages out but there is still 34 left, but after it is done scanning, it doesn't go to grab the 34 messages left. The content of the mqueue.in folder is listed after the mailscanner log. I was using flock as the lock type before, but the same problem occurs. There is also nothing in the incoming folders. I am not sure if it is a setting that is causing this or it is a bug. Thanks!! Apr 11 11:04:24 hound2 MailScanner[13081]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13628]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13349]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13185]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13532]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[12896]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13745]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13869]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[12930]: MailScanner child caught a SIGHUP Apr 11 11:04:24 hound2 MailScanner[13044]: MailScanner child caught a SIGHUP Apr 11 11:04:30 hound2 MailScanner[14192]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:04:30 hound2 MailScanner[14192]: Read 0 hostnames from the phishing whitelist Apr 11 11:04:31 hound2 MailScanner[14192]: Using locktype = posix Apr 11 11:04:31 hound2 MailScanner[14192]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:04:31 hound2 MailScanner[14192]: New Batch: Found 34 messages waiting Apr 11 11:04:31 hound2 MailScanner[14192]: New Batch: Scanning 4 messages, 26463 bytes Apr 11 11:04:31 hound2 MailScanner[14192]: Spam Checks: Starting Apr 11 11:04:32 hound2 MailScanner[14192]: Message j3BF4No5014108 from 142.195.251.129 (julie.meloche@desjardins.com) to pch.gc.ca is not spam, SpamAssassin (score=-1.49, required 3.8, AWL 0.01, BAYES_00 -2.60, NO_REAL_NAME 0.01, PRIORITY_NO_NAME 1.10) Apr 11 11:04:34 hound2 MailScanner[14192]: Message j3BF4Oo4014130 from 24.201.245.36 (stephane.01@videotron.ca) to pc.gc.cais not spam, SpamAssassin (score=-2.514, required 3.8, autolearn=not spam, AWL 0.09, BAYES_00 -2.60) Apr 11 11:04:35 hound2 MailScanner[14192]: Message j3BF4Mo4014096 from 129.33.92.44 (christine@thedavisfamily.ca) to pch.gc.ca is not spam, SpamAssassin (score=-2.292, required 3.8, BAYES_00 -2.60, NO_REAL_NAME 0.01, SARE_WEOFFER 0.30) Apr 11 11:04:35 hound2 MailScanner[14192]: Message j3BF4Mo4014099 from 64.254.157.135 (louise.danjou@cossette.com) to pch.gc.ca is not spam, SpamAssassin (score=-2.461, required 3.8, AWL 0.02, BAYES_00 -2.60, HTML_MESSAGE 0.00, HTML_TAG_EXIST_TBODY 0.11) Apr 11 11:04:36 hound2 MailScanner[14192]: Virus and Content Scanning: Starting Apr 11 11:04:37 hound2 MailScanner[14192]: tag found in message j3BF4Mo4014099 from louise.danjou@cossette.com Apr 11 11:04:37 hound2 MailScanner[14192]: Uninfected: Delivered 4 messages Apr 11 11:04:41 hound2 MailScanner[14219]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:04:41 hound2 MailScanner[14219]: Read 0 hostnames from the phishing whitelist Apr 11 11:04:42 hound2 MailScanner[14219]: Using locktype = posix Apr 11 11:04:42 hound2 MailScanner[14219]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:04:52 hound2 MailScanner[14220]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:04:52 hound2 MailScanner[14220]: Read 0 hostnames from the phishing whitelist Apr 11 11:04:53 hound2 MailScanner[14220]: Using locktype = posix Apr 11 11:04:53 hound2 MailScanner[14220]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:03 hound2 MailScanner[14221]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:03 hound2 MailScanner[14221]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:04 hound2 MailScanner[14221]: Using locktype = posix Apr 11 11:05:04 hound2 MailScanner[14221]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:14 hound2 MailScanner[14224]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:14 hound2 MailScanner[14224]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:15 hound2 MailScanner[14224]: Using locktype = posix Apr 11 11:05:15 hound2 MailScanner[14224]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:25 hound2 MailScanner[14227]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:25 hound2 MailScanner[14227]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:27 hound2 MailScanner[14227]: Using locktype = posix Apr 11 11:05:27 hound2 MailScanner[14227]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:36 hound2 MailScanner[14231]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:36 hound2 MailScanner[14231]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:37 hound2 MailScanner[14231]: Using locktype = posix Apr 11 11:05:37 hound2 MailScanner[14231]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:47 hound2 MailScanner[14232]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:47 hound2 MailScanner[14232]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:49 hound2 MailScanner[14232]: Using locktype = posix Apr 11 11:05:49 hound2 MailScanner[14232]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:05:58 hound2 MailScanner[14235]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:05:58 hound2 MailScanner[14235]: Read 0 hostnames from the phishing whitelist Apr 11 11:05:59 hound2 MailScanner[14235]: Using locktype = posix Apr 11 11:05:59 hound2 MailScanner[14235]: Creating hardcoded struct_flock subroutine for linux (Linux-type) Apr 11 11:06:09 hound2 MailScanner[14236]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 11 11:06:09 hound2 MailScanner[14236]: Read 0 hostnames from the phishing whitelist Apr 11 11:06:10 hound2 MailScanner[14236]: Using locktype = posix Apr 11 11:06:10 hound2 MailScanner[14236]: Creating hardcoded struct_flock subroutine for linux (Linux-type) hound2:/var/spool/mqueue.in # date Mon Apr 11 11:09:24 EDT 2005 hound2:/var/spool/mqueue.in # ls -la total 8847 drwx------ 3 root root 2448 Apr 11 11:04 . drwxr-xr-x 14 root root 392 Mar 7 07:08 .. drwx------ 2 root root 48 Apr 1 11:37 .hoststat -rw------- 1 root mail 0 Mar 23 11:18 dfj2NEI6xL013577 -rw------- 1 root mail 28672 Mar 23 10:00 dfj2NEiZxL000663 -rw------- 1 root mail 49152 Mar 23 10:30 dfj2NFNDxL027390 -rw------- 1 root mail 8192 Mar 23 10:27 dfj2NFNRxL027535 -rw------- 1 root mail 933888 Mar 23 11:27 dfj2NGR3xL009916 -rw------- 1 root mail 45056 Mar 23 11:38 dfj2NGZbhN013223 -rw------- 1 root mail 36864 Mar 23 11:52 dfj2NGiFhN018441 -rw------- 1 root mail 16384 Mar 23 11:54 dfj2NGnNhN021755 -rw------- 1 root mail 12288 Mar 23 12:19 dfj2NHG4hN005200 -rw------- 1 root mail 36864 Mar 23 12:33 dfj2NHRChN011805 -rw------- 1 root mail 32768 Mar 23 12:34 dfj2NHTAhN012967 -rw------- 1 root mail 12288 Mar 23 12:37 dfj2NHY3hN016085 -rw------- 1 root mail 20480 Mar 23 12:45 dfj2NHiPhN022029 -rw------- 1 root mail 28672 Mar 23 12:55 dfj2NHpkhN026568 -rw------- 1 root mail 49152 Mar 23 13:10 dfj2NHsnhN028287 -rw------- 1 root mail 1294336 Mar 23 13:11 dfj2NHv6hN029541 -rw------- 1 root mail 2375680 Mar 23 13:11 dfj2NHv6hN029542 -rw------- 1 root mail 24576 Mar 23 13:10 dfj2NI1vhN032534 -rw------- 1 root mail 368640 Mar 23 13:47 dfj2NIlL9h026163 -rw------- 1 root mail 8192 Mar 24 10:55 dfj2OFsFmq028118 -rw------- 1 root mail 16384 Mar 24 10:55 dfj2OFslmq028381 -rw------- 1 root mail 28672 Mar 24 10:56 dfj2OFtpmq028984 -rw------- 1 root mail 139264 Mar 24 10:56 dfj2OFummq029645 -rw------- 1 root mail 541 Apr 1 11:35 dfj31EZ1q7006497 -rw------- 1 root mail 16384 Apr 1 10:19 dfj31FIwq7010985 -rw------- 1 root mail 20480 Apr 1 10:24 dfj31FM9q7013458 -rw------- 1 root mail 16384 Apr 1 11:44 dfj31Gikq7017302 -rw------- 1 root mail 872 Apr 4 10:08 dfj34C8nOj011677 -rw------- 1 root mail 61440 Apr 4 08:53 dfj34ClhOj026253 -rw------- 1 root mail 16384 Apr 4 09:08 dfj34D6YOj020610 -rw------- 1 root mail 155648 Apr 4 09:53 dfj34DaiOj000798 -rw------- 1 root mail 421888 Apr 4 09:44 dfj34Dd0Oj004396 -rw------- 1 root mail 368640 Apr 4 10:05 dfj34E2pOj009876 -rw------- 1 root mail 708608 Apr 4 10:14 dfj34E8UOj017604 -rw------- 1 root mail 28672 Apr 11 09:12 dfj3BDAsWg029242 -rw------- 1 root mail 32768 Apr 11 09:26 dfj3BDJiWg003720 -rw------- 1 root mail 49152 Apr 11 09:33 dfj3BDVOWh011659 -rw------- 1 root mail 61440 Apr 11 09:33 dfj3BDVPWh011695 -rw------- 1 root mail 8192 Apr 11 09:33 dfj3BDVWWh011768 -rw------- 1 root mail 20480 Apr 11 09:34 dfj3BDVXWh011771 -rw------- 1 root mail 32768 Apr 11 09:43 dfj3BDduWg017597 -rw------- 1 root mail 32768 Apr 11 09:48 dfj3BDjOWg021883 -rw------- 1 root mail 831488 Apr 11 10:41 dfj3BEdFWg027932 -rw------- 1 root mail 638976 Apr 11 10:52 dfj3BElWWg001619 -rw------- 1 root mail 923 Apr 5 00:56 qfj352riWh022594 -rw------- 1 root mail 967 Apr 5 09:28 qfj35BSMWh013958 -rw------- 1 root mail 925 Apr 5 14:18 qfj35GHhWh004468 -rw------- 1 root mail 949 Apr 5 16:05 qfj35I5kWh013983 -rw------- 1 root mail 977 Apr 5 16:09 qfj35I60Wh014078 -rw------- 1 root mail 940 Apr 5 19:08 qfj35L7sWh004843 -rw------- 1 root mail 953 Apr 6 01:40 qfj363aaWh008242 -rw------- 1 root mail 1711 Apr 6 00:20 qfj364J3Wo022047 -rw------- 1 root mail 1001 Apr 6 04:52 qfj366q0Wh003389 -rw------- 1 root mail 1046 Apr 6 23:23 qfj371NVWh010276 -rw------- 1 root mail 961 Apr 7 00:54 qfj372qWWh006615 -rw------- 1 root mail 928 Apr 7 02:15 qfj374CoWi031202 -rw------- 1 root mail 971 Apr 7 17:01 qfj37IwpWh004066 -rw------- 1 root mail 924 Apr 8 03:00 qfj38404Wh003283 -rw------- 1 root mail 924 Apr 8 03:35 qfj384YMWh013402 -rw------- 1 root mail 925 Apr 8 04:05 qfj3863tWh006263 -rw------- 1 root mail 916 Apr 8 10:20 qfj38CHnWh000714 -rw------- 1 root mail 965 Apr 8 15:57 qfj38HsLWh004420 -rw------- 1 root mail 915 Apr 8 20:13 qfj38MC0Wh007466 -rw------- 1 root mail 944 Apr 8 23:42 qfj391dvWh009561 -rw------- 1 root mail 915 Apr 9 01:07 qfj39260Wh016687 -rw------- 1 root mail 914 Apr 9 21:58 qfj39MvdWh023748 -rw------- 1 root mail 916 Apr 10 04:46 qfj3A6ebWh030427 -rw------- 1 root mail 916 Apr 10 09:43 qfj3ABWdWh030461 -rw------- 1 root mail 996 Apr 10 11:40 qfj3ADduWh027873 -rw------- 1 root mail 1008 Apr 10 16:23 qfj3AILcWh007512 -rw------- 1 root mail 950 Apr 10 23:05 qfj3B0vZWo005462 -rw------- 1 root mail 1007 Apr 11 00:19 qfj3B4JMWg020843 -rw------- 1 root mail 920 Apr 11 03:50 qfj3B5n2Wh013589 -rw------- 1 root mail 950 Apr 11 10:14 qfj3BCDgWh028342 hound2:/var/spool/mqueue.in # ls -1|wc -l 77 hound2:/var/spool/mqueue.in # ... hound2:/var/spool/MailScanner/incoming # ls * 14192: . .. 14219: . .. 14220: . .. 14221: . .. 14224: . .. 14227: . .. 14231: . .. 14232: . .. 14235: . .. 14236: . .. hound2:/var/spool/MailScanner/incoming # cd ../quarantine/ hound2:/var/spool/MailScanner/quarantine # ls . .. Danny Béland ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ ( http://www.mailscanner.biz/maq/ ) and the archives ( http://www.jiscmail.ac.uk/lists/mailscanner.html ). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Mon Apr 11 21:23:31 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:18 2006 Subject: Emails are getting stuck in the mqueue.in directory Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Danny Beland wrote: > I'm running Linux with sendmail v8.12.10, MailScanner v4.40.11, ClamAV > and McAfee command line scanner. The problem we have is that emails > get stuck in the mqueue.in folder. When there is new messages, we can > see that there is some getting stuck . In the log below we can see > that it only gets 4 messages out but there is still 34 left, but after > it is done scanning, it doesn't go to grab the 34 messages left. The > content of the mqueue.in folder is listed after the mailscanner log. I > was using flock as the lock type before, but the same problem occurs. > There is also nothing in the incoming folders. I am not sure if it is > a setting that is causing this or it is a bug. Thanks!! > > ... > hound2:/var/spool/mqueue.in # date > Mon Apr 11 11:09:24 EDT 2005 > hound2:/var/spool/mqueue.in # ls -la > total 8847 > drwx------ 3 root root 2448 Apr 11 11:04 . > drwxr-xr-x 14 root root 392 Mar 7 07:08 .. > drwx------ 2 root root 48 Apr 1 11:37 .hoststat > -rw------- 1 root mail 0 Mar 23 11:18 dfj2NEI6xL013577 > -rw------- 1 root mail 28672 Mar 23 10:00 dfj2NEiZxL000663 > -rw------- 1 root mail 49152 Mar 23 10:30 dfj2NFNDxL027390 > -rw------- 1 root mail 8192 Mar 23 10:27 dfj2NFNRxL027535 > -rw------- 1 root mail 933888 Mar 23 11:27 dfj2NGR3xL009916 > -rw------- 1 root mail 45056 Mar 23 11:38 dfj2NGZbhN013223 > -rw------- 1 root mail 36864 Mar 23 11:52 dfj2NGiFhN018441 > -rw------- 1 root mail 16384 Mar 23 11:54 dfj2NGnNhN021755 > -rw------- 1 root mail 12288 Mar 23 12:19 dfj2NHG4hN005200 > -rw------- 1 root mail 36864 Mar 23 12:33 dfj2NHRChN011805 > -rw------- 1 root mail 32768 Mar 23 12:34 dfj2NHTAhN012967 > -rw------- 1 root mail 12288 Mar 23 12:37 dfj2NHY3hN016085 > -rw------- 1 root mail 20480 Mar 23 12:45 dfj2NHiPhN022029 > -rw------- 1 root mail 28672 Mar 23 12:55 dfj2NHpkhN026568 > -rw------- 1 root mail 49152 Mar 23 13:10 dfj2NHsnhN028287 > -rw------- 1 root mail 1294336 Mar 23 13:11 dfj2NHv6hN029541 > -rw------- 1 root mail 2375680 Mar 23 13:11 dfj2NHv6hN029542 > -rw------- 1 root mail 24576 Mar 23 13:10 dfj2NI1vhN032534 > -rw------- 1 root mail 368640 Mar 23 13:47 dfj2NIlL9h026163 > -rw------- 1 root mail 8192 Mar 24 10:55 dfj2OFsFmq028118 > -rw------- 1 root mail 16384 Mar 24 10:55 dfj2OFslmq028381 > -rw------- 1 root mail 28672 Mar 24 10:56 dfj2OFtpmq028984 > -rw------- 1 root mail 139264 Mar 24 10:56 dfj2OFummq029645 > -rw------- 1 root mail 541 Apr 1 11:35 dfj31EZ1q7006497 > -rw------- 1 root mail 16384 Apr 1 10:19 dfj31FIwq7010985 > -rw------- 1 root mail 20480 Apr 1 10:24 dfj31FM9q7013458 > -rw------- 1 root mail 16384 Apr 1 11:44 dfj31Gikq7017302 > -rw------- 1 root mail 872 Apr 4 10:08 dfj34C8nOj011677 > -rw------- 1 root mail 61440 Apr 4 08:53 dfj34ClhOj026253 > -rw------- 1 root mail 16384 Apr 4 09:08 dfj34D6YOj020610 > -rw------- 1 root mail 155648 Apr 4 09:53 dfj34DaiOj000798 > -rw------- 1 root mail 421888 Apr 4 09:44 dfj34Dd0Oj004396 > -rw------- 1 root mail 368640 Apr 4 10:05 dfj34E2pOj009876 > -rw------- 1 root mail 708608 Apr 4 10:14 dfj34E8UOj017604 > -rw------- 1 root mail 28672 Apr 11 09:12 dfj3BDAsWg029242 > -rw------- 1 root mail 32768 Apr 11 09:26 dfj3BDJiWg003720 > -rw------- 1 root mail 49152 Apr 11 09:33 dfj3BDVOWh011659 > -rw------- 1 root mail 61440 Apr 11 09:33 dfj3BDVPWh011695 > -rw------- 1 root mail 8192 Apr 11 09:33 dfj3BDVWWh011768 > -rw------- 1 root mail 20480 Apr 11 09:34 dfj3BDVXWh011771 > -rw------- 1 root mail 32768 Apr 11 09:43 dfj3BDduWg017597 > -rw------- 1 root mail 32768 Apr 11 09:48 dfj3BDjOWg021883 > -rw------- 1 root mail 831488 Apr 11 10:41 dfj3BEdFWg027932 > -rw------- 1 root mail 638976 Apr 11 10:52 dfj3BElWWg001619 > -rw------- 1 root mail 923 Apr 5 00:56 qfj352riWh022594 > -rw------- 1 root mail 967 Apr 5 09:28 qfj35BSMWh013958 > -rw------- 1 root mail 925 Apr 5 14:18 qfj35GHhWh004468 > -rw------- 1 root mail 949 Apr 5 16:05 qfj35I5kWh013983 > -rw------- 1 root mail 977 Apr 5 16:09 qfj35I60Wh014078 > -rw------- 1 root mail 940 Apr 5 19:08 qfj35L7sWh004843 > -rw------- 1 root mail 953 Apr 6 01:40 qfj363aaWh008242 > -rw------- 1 root mail 1711 Apr 6 00:20 qfj364J3Wo022047 > -rw------- 1 root mail 1001 Apr 6 04:52 qfj366q0Wh003389 > -rw------- 1 root mail 1046 Apr 6 23:23 qfj371NVWh010276 > -rw------- 1 root mail 961 Apr 7 00:54 qfj372qWWh006615 > -rw------- 1 root mail 928 Apr 7 02:15 qfj374CoWi031202 > -rw------- 1 root mail 971 Apr 7 17:01 qfj37IwpWh004066 > -rw------- 1 root mail 924 Apr 8 03:00 qfj38404Wh003283 > -rw------- 1 root mail 924 Apr 8 03:35 qfj384YMWh013402 > -rw------- 1 root mail 925 Apr 8 04:05 qfj3863tWh006263 > -rw------- 1 root mail 916 Apr 8 10:20 qfj38CHnWh000714 > -rw------- 1 root mail 965 Apr 8 15:57 qfj38HsLWh004420 > -rw------- 1 root mail 915 Apr 8 20:13 qfj38MC0Wh007466 > -rw------- 1 root mail 944 Apr 8 23:42 qfj391dvWh009561 > -rw------- 1 root mail 915 Apr 9 01:07 qfj39260Wh016687 > -rw------- 1 root mail 914 Apr 9 21:58 qfj39MvdWh023748 > -rw------- 1 root mail 916 Apr 10 04:46 qfj3A6ebWh030427 > -rw------- 1 root mail 916 Apr 10 09:43 qfj3ABWdWh030461 > -rw------- 1 root mail 996 Apr 10 11:40 qfj3ADduWh027873 > -rw------- 1 root mail 1008 Apr 10 16:23 qfj3AILcWh007512 > -rw------- 1 root mail 950 Apr 10 23:05 qfj3B0vZWo005462 > -rw------- 1 root mail 1007 Apr 11 00:19 qfj3B4JMWg020843 > -rw------- 1 root mail 920 Apr 11 03:50 qfj3B5n2Wh013589 > -rw------- 1 root mail 950 Apr 11 10:14 qfj3BCDgWh028342 > hound2:/var/spool/mqueue.in # ls -1|wc -l > 77 Danny, All those files are leftovers (probably from MS restarts). They have been processed but were partially left behind because of the restarts. You can see they are not complete emails because you don't have q* and d* files for the same email. I've ran your listing through "cat -|awk '{print substr($NF,2)}'|sort|uniq -c" and all filenames were unique (count=1). I use the following command when I want to clean up those files: cd /var/spool/mqueue.in; rm -f $(ls -l|grep -v "$(date '+%b %e')"|awk '$1 ~ /^-/{print $NF}') It removes all files that don't have the current date. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From diego.fabara at ALEGROPCS.COM Mon Apr 11 23:25:09 2005 From: diego.fabara at ALEGROPCS.COM (Diego Fabara) Date: Thu Jan 12 21:29:18 2006 Subject: No subject Message-ID: I’ve a Server AntiSpam in MailRelay format. (mailertable to redirect emails for my domain) But, I need autoresponse a lot of mails arrived to user1@mydomain.com with a message like “Thanks for your email. We will contact to you !” Without this email arrived to my internal Email Server. In what file I need a rule ?? ________________________________________________________________________________ INFORMACION CONFIDENCIAL: SE PROHIBE LA DIFUSION O PUBLICACION DE ESTA INFORMACION A TERCEROS SIN LA AUTORIZACION EXPRESA Y POR ESCRITO DE TELECSA. ESTA INFORMACION DEBE SER GUARDADA CON SEGURIDADES CUANDO NO SE LA ESTE UTILIZANDO. SI USTED NO ES EL DESTINATARIO DE ESTE EMAIL, USTED DEBERA DEVOLVERLO AL EMISOR Y NO PODRA LEER, COPIAR O DISTRIBUIR SUS ANEXOS. CUALQUIER OPINION EXPRESADA EN ESTE MENSAJE, CORRESPONDE A SU AUTOR Y NO NECESARIAMENTE A TELECSA - ALEGRO PCS. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikes at HARTWELLCORP.COM Tue Apr 12 00:24:35 2005 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: Hello, I'm having trouble with (a very, very few) truncated emails. Currently we're using 4.40.11 but noticed this same problem with the previous stable release as well. Is there a known issue with this or am I reporting something new? -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Tue Apr 12 06:19:37 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:18 2006 Subject: Cannot allocate memory Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martins Smilga wrote: > Hello, > >> What is your "Restart Every" setting? > > Restart Every = 14400 > >> How much RAM do you have? > > 776856k > >> What did you set "Max Children" to be? > > Max Children = 5 > >> What else is the machine running apart from MailScanner? > > Exim and Mailscanner-mrtg > > Thanks in advance. > > Best Regards, > Martins First check 'free -m' (linux specific) to check if your system is swapping.. Next you might want to try using valgrind (http://valgrind.org/, again linux x86 specific) to find memory leaks (if any). When last used i found a couple of memory leaks with the perl core libraries (libperl.so v5.8.4, centos 3.3), quite minor though.. and the MailScanner 'Restart Every' seems to do the trick of resolving these leaks. valgrind --tool=memcheck --trace-children=yes --leak-check=yes /path/to/check_mailscanner - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 12 08:59:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Let's start by asking what MTA you are running? And what does "MailScanner -v" produce? Michael St. Laurent wrote: >Hello, > >I'm having trouble with (a very, very few) truncated emails. Currently >we're using 4.40.11 but noticed this same problem with the previous stable >release as well. > >Is there a known issue with this or am I reporting something new? > >-- >Michael St. Laurent >Hartwell Corporation > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikes at HARTWELLCORP.COM Tue Apr 12 18:58:34 2005 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: Hi Julian! Thanks for the reply. ;-D The MTA is sendmail. [root@guardian root]# MailScanner -v Running on Linux guardian.hartwellcorp.com 2.4.20-31.9 #1 Tue Apr 13 18:04:23 EDT 2004 i686 i686 i386 GNU/Linux This is Red Hat Linux release 9 (Shrike) This is Perl version 5.008000 (5.8.0) This is MailScanner version 4.40.11 Module versions are: 1.00 AnyDBM_File 1.09 Archive::Zip 1.01 Carp 1.119 Convert::BinHex 1.00 DirHandle 1.04 Fcntl 2.71 File::Basename 2.05 File::Copy 2.01 FileHandle 1.05 File::Path 1.29 HTML::Entities 3.45 HTML::Parser 2.30 HTML::TokeParser 1.20 IO 1.09 IO::File 1.122 IO::Pipe 1.58 Mail::Header 3.05 MIME::Base64 5.417 MIME::Decoder 5.417 MIME::Decoder::UU 5.417 MIME::Head 5.417 MIME::Parser 3.03 MIME::QuotedPrint 5.417 MIME::Tools 0.10 Net::CIDR 1.05 POSIX 1.75 Socket 0.03 Sys::Syslog 1.02 Time::localtime Optional module versions are: 1.808 DB_File 1.05 Digest 1.01 Digest::HMAC 2.33 Digest::MD5 2.01 Digest::SHA1 0.44 Inline 0.13 Mail::ClamAV 2.63 Mail::SpamAssassin missing Mail::SPF::Query missing Net::CIDR::Lite 0.31 Net::DNS missing Net::LDAP 1.94 Parse::RecDescent missing SAVI missing Sys::Hostname::Long 2.26 Test::Harness 0.47 Test::Simple 1.89 Text::Balanced 1.35 URI Julian Field <> wrote: > Let's start by asking what MTA you are running? And what does > "MailScanner -v" produce? > > Michael St. Laurent wrote: > >> Hello, >> >> I'm having trouble with (a very, very few) truncated emails. >> Currently we're using 4.40.11 but noticed this same problem with the >> previous stable release as well. >> >> Is there a known issue with this or am I reporting something new? -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 12 19:09:56 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In which case my bet is that you are using sendmail 8.13, in which case you need to set "Lock Type = posix" in MailScanner.conf. Michael St. Laurent wrote: >Hi Julian! Thanks for the reply. ;-D > >The MTA is sendmail. > >[root@guardian root]# MailScanner -v >Running on >Linux guardian.hartwellcorp.com 2.4.20-31.9 #1 Tue Apr 13 18:04:23 EDT 2004 >i686 > i686 i386 GNU/Linux >This is Red Hat Linux release 9 (Shrike) >This is Perl version 5.008000 (5.8.0) > >This is MailScanner version 4.40.11 >Module versions are: >1.00 AnyDBM_File >1.09 Archive::Zip >1.01 Carp >1.119 Convert::BinHex >1.00 DirHandle >1.04 Fcntl >2.71 File::Basename >2.05 File::Copy >2.01 FileHandle >1.05 File::Path >1.29 HTML::Entities >3.45 HTML::Parser >2.30 HTML::TokeParser >1.20 IO >1.09 IO::File >1.122 IO::Pipe >1.58 Mail::Header >3.05 MIME::Base64 >5.417 MIME::Decoder >5.417 MIME::Decoder::UU >5.417 MIME::Head >5.417 MIME::Parser >3.03 MIME::QuotedPrint >5.417 MIME::Tools >0.10 Net::CIDR >1.05 POSIX >1.75 Socket >0.03 Sys::Syslog >1.02 Time::localtime > >Optional module versions are: >1.808 DB_File >1.05 Digest >1.01 Digest::HMAC >2.33 Digest::MD5 >2.01 Digest::SHA1 >0.44 Inline >0.13 Mail::ClamAV >2.63 Mail::SpamAssassin >missing Mail::SPF::Query >missing Net::CIDR::Lite >0.31 Net::DNS >missing Net::LDAP >1.94 Parse::RecDescent >missing SAVI >missing Sys::Hostname::Long >2.26 Test::Harness >0.47 Test::Simple >1.89 Text::Balanced >1.35 URI > >Julian Field <> wrote: > > >>Let's start by asking what MTA you are running? And what does >>"MailScanner -v" produce? >> >>Michael St. Laurent wrote: >> >> >> >>>Hello, >>> >>>I'm having trouble with (a very, very few) truncated emails. >>>Currently we're using 4.40.11 but noticed this same problem with the >>>previous stable release as well. >>> >>>Is there a known issue with this or am I reporting something new? >>> >>> > >-- >Michael St. Laurent >Hartwell Corporation > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikes at HARTWELLCORP.COM Tue Apr 12 20:53:36 2005 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: [root@guardian Bastille]# rpm -q sendmail sendmail-8.12.8-9.90 [root@guardian Bastille]# Same thing? Julian Field <> wrote: > In which case my bet is that you are using sendmail 8.13, in which > case you need to set "Lock Type = posix" in MailScanner.conf. > > Michael St. Laurent wrote: > >> Hi Julian! Thanks for the reply. ;-D >> >> The MTA is sendmail. -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 12 21:00:20 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] No usually, no. But give it a try anyway. It could depend on which Linux distro you are using and where your sendmail rpm came from. Michael St. Laurent wrote: >[root@guardian Bastille]# rpm -q sendmail >sendmail-8.12.8-9.90 >[root@guardian Bastille]# > >Same thing? > >Julian Field <> wrote: > > >>In which case my bet is that you are using sendmail 8.13, in which >>case you need to set "Lock Type = posix" in MailScanner.conf. >> >>Michael St. Laurent wrote: >> >> >> >>>Hi Julian! Thanks for the reply. ;-D >>> >>>The MTA is sendmail. >>> >>> > > >-- >Michael St. Laurent >Hartwell Corporation > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From satya at BAINSDIGITAL.COM Tue Apr 12 21:18:13 2005 From: satya at BAINSDIGITAL.COM (SatyaDev) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, I am using MailScanner with postfix-2.0.18 with single instance, storing quarantine as Queue files => Quarantine Whole Messages As Queue Files = yes But when I try to release files from queue by postdrop, it gives error... --------- #/usr/sbin/postdrop < 436A07F4B8 queue_id49F8B7F70Dpostdrop: fatal: uid=0: unexpected record type: 67 -------- I checked sendmail and posfix versions also, both are right and belong to same build. I also tried with postfix version 2.0.16, but got same status. Can any one help me ? -Satya www.bainsdigital.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Tue Apr 12 21:28:47 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] SatyaDev wrote: Hello, I am using MailScanner with postfix-2.0.18 with single instance, storing quarantine as Queue files => Quarantine Whole Messages As Queue Files = yes But when I try to release files from queue by postdrop, it gives error... --------- #/usr/sbin/postdrop < 436A07F4B8 queue_id49F8B7F70Dpostdrop: fatal: uid=0: unexpected record type: 67 -------- I checked sendmail and posfix versions also, both are right and belong to same build. I also tried with postfix version 2.0.16, but got same status. Can any one help me ? -Satya www.bainsdigital.com Try this from Joshua Hirsh last year: When I release a file into quarantine, I copy it directly into the incoming folder for the sending process of Postfix (make sure it's executable). So for example: [root B710F4D00F4]# chmod +x B710F4D00F4 [root B710F4D00F4]# cp -p B710F4D00F4 /var/spool/postfix/incoming/B/ Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From TristanRhodes at WEBER.EDU Tue Apr 12 23:44:09 2005 From: TristanRhodes at WEBER.EDU (Tristan RHODES) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: I have gotten Mailscanner to work on Ubuntu, but I am getting an error message. root@ubuntu:/home/tristan # tail /var/log/mail.log Apr 12 08:13:40 localhost MailScanner[25367]: Messages found but no hashed queue directories. Please enable hashed queues for incoming and deferred with a depth of 1 or 2. See the Postfix documentation for hash_queue_names and hash_queue_depth Also this error when I restart postfix. root@ubuntu:/home/tristan # /etc/init.d/postfix restart * Stopping Postfix Mail Transport Agent... [ ok ] * Starting Postfix Mail Transport Agent... postsuper: warning: bogus file name: hold/razor-agent.log [ ok ] root@ubuntu:/home/tristan # Does "/etc/init.d/mailscanner restart" also restart Postfix? Should I use that instead? Thanks, Tristan Rhodes Weber State University ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Wed Apr 13 01:12:54 2005 From: pete at ENITECH.COM.AU (Peter Russell) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You need to install razor properly. Its a buggar. But temporarily make your postfix account so you can log in with it, switch to it and then create razor, then change the conf file to log to dev/null I am sure there is an easier way but i dont know it :) Tristan RHODES wrote: > I have gotten Mailscanner to work on Ubuntu, but I am getting an error > message. > > root@ubuntu:/home/tristan # tail /var/log/mail.log > > Apr 12 08:13:40 localhost MailScanner[25367]: Messages found but no > hashed queue directories. Please enable hashed queues for incoming and > deferred with a depth of 1 or 2. See the Postfix documentation for > hash_queue_names and hash_queue_depth > > Also this error when I restart postfix. > > root@ubuntu:/home/tristan # /etc/init.d/postfix restart > * Stopping Postfix Mail Transport Agent... [ ok ] > * Starting Postfix Mail Transport Agent... > postsuper: warning: bogus file name: hold/razor-agent.log [ ok ] > root@ubuntu:/home/tristan # > > Does "/etc/init.d/mailscanner restart" also restart Postfix? Should I > use that instead? > > Thanks, > > Tristan Rhodes > Weber State University > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Apr 13 07:29:07 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Peter Russell wrote: > You need to install razor properly. Its a buggar. > > But temporarily make your postfix account so you can log in with it, > switch to it and then create razor, then change the conf file to log to > dev/null > > I am sure there is an easier way but i dont know it :) In spam.assassin.prefs.conf just add razor_config /var/spool/MailScanner/spamassassin and that will set razor to log to .razor in that directory (Or indeed where ever you wish it to set it's home directory to). It's only because MS runs as the user postfix, who happens to have it's home directory as /var/spool/postfix so drops it's log file in the queue directory, which Postfix doesn't like. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From danielk at AVALONPUB.COM Wed Apr 13 07:47:42 2005 From: danielk at AVALONPUB.COM (Daniel Kleinsinger) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Do the truncated emails have an html part with few/no tags and a fully intact plain text part? If so, there's been an issue like this reported before, possibly having to do with the phishing net. Daniel Michael St. Laurent wrote: >Hello, > >I'm having trouble with (a very, very few) truncated emails. Currently >we're using 4.40.11 but noticed this same problem with the previous stable >release as well. > >Is there a known issue with this or am I reporting something new? > >-- >Michael St. Laurent >Hartwell Corporation > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Wed Apr 13 08:30:55 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:18 2006 Subject: Building a Server from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have built a SUSE 9.2 system and want to start installing MailScanner. What is the recommended order? I want to start with MailScanner and test to see if it works Then add SpamAssassin and test Then DCC Rayzor Pyzor. Would you agree with this? Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 13 08:42:02 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:18 2006 Subject: Building a Server from scratch Message-ID: Lance Spamassassin first along with DCC etc. then MailScanner once everything else is OK. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Lance Haig wrote: > I have built a SUSE 9.2 system and want to start installing MailScanner. > > What is the recommended order? > > I want to start with MailScanner and test to see if it works > Then add SpamAssassin and test > Then DCC > Rayzor > Pyzor. > > Would you agree with this? > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Wed Apr 13 08:45:52 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:29:18 2006 Subject: Building a Server from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Yeah, make sure everything is running before installing MS. Including bitdefender and clam, Dcc etc, MTA. Pete Martin Hepworth wrote: > Lance > > Spamassassin first along with DCC etc. > > then MailScanner once everything else is OK. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Lance Haig wrote: > >> I have built a SUSE 9.2 system and want to start installing MailScanner. >> >> What is the recommended order? >> >> I want to start with MailScanner and test to see if it works >> Then add SpamAssassin and test >> Then DCC >> Rayzor >> Pyzor. >> >> Would you agree with this? >> >> Lance >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 10:14:11 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Everyone else has taken the others, I'll take the first problem. Tristan RHODES wrote: >I have gotten Mailscanner to work on Ubuntu, but I am getting an error >message. > >root@ubuntu:/home/tristan # tail /var/log/mail.log > >Apr 12 08:13:40 localhost MailScanner[25367]: Messages found but no >hashed queue directories. Please enable hashed queues for incoming and >deferred with a depth of 1 or 2. See the Postfix documentation for >hash_queue_names and hash_queue_depth > >Also this error when I restart postfix. > > Upgrade to MailScanner-4.40. This has Postfix 2.2(?) support. >root@ubuntu:/home/tristan # /etc/init.d/postfix restart > * Stopping Postfix Mail Transport Agent... [ ok ] > * Starting Postfix Mail Transport Agent... >postsuper: warning: bogus file name: hold/razor-agent.log [ ok ] >root@ubuntu:/home/tristan # > >Does "/etc/init.d/mailscanner restart" also restart Postfix? Should I >use that instead? > > Yes it does, and yes you should. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Apr 13 11:44:25 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field said: > Everyone else has taken the others, I'll take the first problem. > > Tristan RHODES wrote: > >>I have gotten Mailscanner to work on Ubuntu, but I am getting an error >>message. >> >>root@ubuntu:/home/tristan # tail /var/log/mail.log >> >>Apr 12 08:13:40 localhost MailScanner[25367]: Messages found but no >>hashed queue directories. Please enable hashed queues for incoming and >>deferred with a depth of 1 or 2. See the Postfix documentation for >>hash_queue_names and hash_queue_depth >> >>Also this error when I restart postfix. >> >> > Upgrade to MailScanner-4.40. This has Postfix 2.2(?) support. Except I think this is Razor logging related not Postfix 2.2.x related from this line >>postsuper: warning: bogus file name: hold/razor-agent.log [ ok ] which I have seen upset MS when it's looked for hashed queues (However that's not an excuse for not upgrading :-) ). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rabie at CT.DDSECURITY.CO.ZA Wed Apr 13 13:16:26 2005 From: rabie at CT.DDSECURITY.CO.ZA (Rabie van der Merwe) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: I had the same issue, for whatever reason postdrop just doesn't seem to work, either look at using something like MailWatch (nice frontend) or use sendmail (I went for both :) ) Regards Rabie -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of SatyaDev Sent: 12 April 2005 22:18 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: postfix question ! Hello, I am using MailScanner with postfix-2.0.18 with single instance, storing quarantine as Queue files => Quarantine Whole Messages As Queue Files = yes But when I try to release files from queue by postdrop, it gives error... --------- #/usr/sbin/postdrop < 436A07F4B8 queue_id49F8B7F70Dpostdrop: fatal: uid=0: unexpected record type: 67 -------- I checked sendmail and posfix versions also, both are right and belong to same build. I also tried with postfix version 2.0.16, but got same status. Can any one help me ? -Satya www.bainsdigital.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joshua.hirsh at PARTNERSOLUTIONS.CA Wed Apr 13 13:57:12 2005 From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You guys are both overlooking one important fact. The files are raw queue files. Postdrop isn't meant to work with raw queue files. To release the messages, you have to make them executable (and owned by the postfix user) and copy them into the outgoing postfix queue. In both of these examples, I use the split postfix queue structure, so my "/var/spool/postfix/incoming/" is the outgoing queue. You'll have to adjust as necessary to use the right queue directory. Example 1: [root@pslinmf01 1E2711377DC]# pwd /var/spool/MailScanner/quarantine/20050413/1E2711377DC [root@pslinmf01 1E2711377DC]# ls -lra total 5640 -rw-r----- 1 postfix root 2425165 Apr 13 07:33 GetOutofMyCar.wmv -rw-r----- 1 postfix root 3326421 Apr 13 07:33 1E2711377DC drwxr-x--- 7 postfix root 4096 Apr 13 08:38 .. drwxr-x--- 2 postfix root 4096 Apr 13 07:33 . [root@pslinmf01 1E2711377DC]# chmod +x 1E2711377DC [root@pslinmf01 1E2711377DC]# cp -p 1E2711377DC /var/spool/postfix/incoming/1/ Example 2: [root@pslinmf01 6CB9C1377DB]# pwd /var/spool/MailScanner/quarantine/20050413/6CB9C1377DB [root@pslinmf01 6CB9C1377DB]# ls -lra total 3292 -rw-r----- 1 postfix root 1413222 Apr 13 07:28 Short and Curly_1.wmv -rw-r----- 1 postfix root 1936897 Apr 13 07:28 6CB9C1377DB drwxr-x--- 7 postfix root 4096 Apr 13 08:38 .. drwxr-x--- 2 postfix root 4096 Apr 13 07:28 . [root@pslinmf01 6CB9C1377DB]# chmod +x 6CB9C1377DB [root@pslinmf01 6CB9C1377DB]# cp -p 6CB9C1377DB /var/spool/postfix/incoming/6/ Regards, -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joshua.hirsh at PARTNERSOLUTIONS.CA Wed Apr 13 13:59:11 2005 From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Try this from Joshua Hirsh last year: > > When I release a file into quarantine, I copy it directly into the incoming folder for the sending process of Postfix (make > sure it's executable). > So for example: > > [root B710F4D00F4]# chmod +x B710F4D00F4 > [root B710F4D00F4]# cp -p B710F4D00F4 /var/spool/postfix/incoming/B/ > Drew heh. I missed this post before I replied... How fitting that it's my own quote! ;-) -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Wed Apr 13 14:16:51 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: This is a popular question. I've added a procedure onto the faq-o-matic. Stef > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of SatyaDev > Sent: 12 April 2005 21:18 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: postfix question ! > > Hello, > > I am using MailScanner with postfix-2.0.18 with single > instance, storing quarantine as Queue files => Quarantine > Whole Messages As Queue Files = yes But when I try to release > files from queue by postdrop, it gives error... > --------- > #/usr/sbin/postdrop < 436A07F4B8 > queue_id49F8B7F70Dpostdrop: fatal: uid=0: unexpected record type: 67 > -------- > I checked sendmail and posfix versions also, both are right > and belong to same build. > I also tried with postfix version 2.0.16, but got same status. > > Can any one help me ? > > -Satya > www.bainsdigital.com > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This email has been scanned by the Level 5 Internet > MailCrusader for viruses, spam and dangerous content. > For more information please visit http://www.l5net.net > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Apr 13 14:54:18 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:18 2006 Subject: Building a Server from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Lance > > Spamassassin first along with DCC etc. > > then MailScanner once everything else is OK. Personally, I'd favor installing MailScanner first, and get it up and running the mail queue with no virus or spam scanning. However, I would suggest testing spamassassin with DCC, pyzor, etc. before enabling "Use SpamAssassin" in mailscanner.conf. Really, I suppose you could do the install order whatever way you want, whether you install SA first, or last is probably not very important. What is important is testing your tools with their command-line interfaces before you tell MS to start using them and get a whole pile of mail mismarked as spam because the SA configuration is confused, etc.. Same concept goes for adding virus scanners. Test them with the CLI before telling MS to use them. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Apr 13 15:07:20 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Stef Morrell > Sent: den 13 april 2005 15:17 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: postfix question ! > > > This is a popular question. I've added a procedure onto the > faq-o-matic. Consider putting it in the dokuwiki too (since the faq-o-matic is to be replaced by that). I'd do it, but I don't have time (today ... might have tomorrow). -- Glenn > > Stef > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of SatyaDev > > Sent: 12 April 2005 21:18 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: postfix question ! > > > > Hello, > > > > I am using MailScanner with postfix-2.0.18 with single > > instance, storing quarantine as Queue files => Quarantine > > Whole Messages As Queue Files = yes But when I try to release > > files from queue by postdrop, it gives error... > > --------- > > #/usr/sbin/postdrop < 436A07F4B8 > > queue_id49F8B7F70Dpostdrop: fatal: uid=0: unexpected record type: 67 > > -------- > > I checked sendmail and posfix versions also, both are right > > and belong to same build. > > I also tried with postfix version 2.0.16, but got same status. > > > > Can any one help me ? > > > > -Satya > > www.bainsdigital.com > > > > ------------------------ MailScanner list > > ------------------------ To unsubscribe, email > > jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the MAQ > > (http://www.mailscanner.biz/maq/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > > This email has been scanned by the Level 5 Internet > > MailCrusader for viruses, spam and dangerous content. > > For more information please visit http://www.l5net.net > > > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jhiggins at KENNESAW.EDU Wed Apr 13 15:24:43 2005 From: jhiggins at KENNESAW.EDU (Jonathan Higgins) Date: Thu Jan 12 21:29:18 2006 Subject: adding renattach to MailScanner+Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I need to implement renaming extensions instead of just modifying the subject, or blocking certain extensions(filenames) or filetypes. software build: RHEL AS 3.0 postfix-2.0.16-14.RHEL3 MailScanner 4.39.5 spamassassin-3.0.2-1 clamav-0.83-1.1.el3.rf renattach-1.2.2 First thing I did was disable filename and filetype checking in MailScanner.conf by adding a "#" infront of the rules. #Filename Rules = %etc-dir%/filename.rules.conf #Filetype Rules = %etc-dir%/filetype.rules.conf Second thing, I installed renattach using the instructions for Postfix Integration at http://www.pc-tools.net/unix/renattach/INSTALL which, in short tells you to modify the master.cf postfix config file. add: filter unix - n n - - pipe flags=q user=filter argv=renattach -p sendmail -i -f ${sender} -- ${recipient} modify: smtp inet n - n - - smtpd -o content_filter=filter This works for the most part, but here is where the problem starts to creep up. The postfix+MailScanner instructions at http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml tell me to add header_checks = regexp:/etc/postfix/header_checks to /etc/postfix/main.cf and create the file /etc/postfix/header_checks with the following contents: /^Received:/ HOLD Here is the problem: When I send an email: 1. Postfix puts the email into HOLD. 2. MailScanner picks it up and does its thing. 3. The content filter sends the email to renattach 4. Renattach finishes with the email and reinjects it 5. Reinjected email goes into HOLD. 6. MailScanner picks it up and does its thing. 7. Message is delivered. Ok, if you don't see it, The email message is processed through MailScanner 2x. I took a look at http://www.postfix.org/FILTER_README.html#simple_filter which shows how email moves around between all the processes that make up postfix. There is a nice pretty picture that shows the content filter after the qmgr. I guess that's why they call it "After-Queue Content Filter" The point being that after the queue, and after the content filter, the email is reinjected using pickup and then eventually passed to cleanup, which does another "header_check" and stuffs the email into the HOLD queue again. Some things I tried to fix this. First fix attempt: I tried to tell postfix to knock it off by modifying the master.cf as follows: smtp inet n - n - - smtpd -o content_filter=filter -o receive_override_options=no_header_body_checks This didn't solve the problem, and to be honest, im not sure if its effecting anything. I did some more research under the advanced filter options for postfix, with no help there. Second fix attempt: I had the thought that I could just modify the generic virus scanner and fit renattach into MailScanner. After creating a renattach-wrapper, modifying MailScanner.conf, and SweepViruses.pm, I started running into weird errors, including the debug message "can't find EOCD signature". I had chopped up a few too many files, because after I cleaned out what I thought I had just done, it was still fairly broken. Im sure that was my fault, so I cleaned everything out and rebuilt my MailScanner install fresh, and got back to square one. Ok, so what Im looking for is a solution to this problem. It would be beneficial to have the solution be part of MailScanner. Im not married to renattach, but it was one of the first programs out there that does what I need. Thanks Jonathan Higgins IT R&D Project Manager Kennesaw State University jhiggins@kennesaw.edu ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Apr 13 15:53:18 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn said: >> This is a popular question. I've added a procedure onto the >> faq-o-matic. > Consider putting it in the dokuwiki too (since the faq-o-matic is > to be replaced by that). I'd do it, but I don't have time (today ... > might have tomorrow). I'll see if I can drop it in a bit later. Looks like a nice sub-section on one of my pages anyway (That I should have included...) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Wed Apr 13 15:57:28 2005 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Greets all, I downloaded and installed the latest versions of MailScanner and install-ClamAV-SA as I've done in the past and used the install scripts as usual (thanks Julian!). I didn't notice any major errors in the output. After all was done MailScanner -V reports the correct MailScanner version but for some reason only reports V3.00000 for spamassassin. Also I notice that clamAV is not used. I re-ran the ClamAV-SA install (INSTALL-tar.sh) and it reports at the end, Oh good Spamassassin V3.02 is already installed. However when I run spamassassin -D --lint it also shows version 3.0.0 and produces no errors. which clamav returns: /usr/bin/which: no clamav in (/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin :/root/bin) Seems like the install put SA and ClamAV in different paths than last time. I'm a novice at *nix and would appreciate any clues as to how I can make things right. I don't mind removing all traces of everything and reinstalling if that would be the easiest route but I haven't got a clue how to start. Running RH 9.0 TIA Ken Goods Network Administrator AIA Insurance, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Apr 13 15:46:47 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:18 2006 Subject: Building a Server from scratch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > I have built a SUSE 9.2 system and want to start installing MailScanner. > > What is the recommended order? > See the MAQ page for my recommendation. > I want to start with MailScanner and test to see if it works > Then add SpamAssassin and test > Then DCC > Rayzor > Pyzor. > > Would you agree with this? > > Lance > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jhiggins at KENNESAW.EDU Wed Apr 13 16:08:05 2005 From: jhiggins at KENNESAW.EDU (Jonathan Higgins) Date: Thu Jan 12 21:29:18 2006 Subject: adding renattach to MailScanner+Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It figures I would stumble across a solution after I took the time to put together this email.. So I will provide the solution. It is all postfix based.. so sorta off topic, but just to complete the thought... modify master.cf to: smtp inet n - n - - smtpd -o content_filter=filter -o cleanup_service_name=cleanup2 #from here down is different cleanup2 unix n - n - 0 cleanup #add a separate cleanup -o body_checks= -o mime_header_checks= -o nested_header_checks= -o header_checks=pcre:/etc/postfix/header_checks2 #this file is empty enjoy Jonathan Higgins IT R&D Project Manager Kennesaw State University jhiggins@kennesaw.edu >>> jhiggins@KENNESAW.EDU 4/13/2005 10:24:43 AM >>> I need to implement renaming extensions instead of just modifying the subject, or blocking certain extensions(filenames) or filetypes. software build: RHEL AS 3.0 postfix-2.0.16-14.RHEL3 MailScanner 4.39.5 spamassassin-3.0.2-1 clamav-0.83-1.1.el3.rf renattach-1.2.2 First thing I did was disable filename and filetype checking in MailScanner.conf by adding a "#" infront of the rules. #Filename Rules = %etc-dir%/filename.rules.conf #Filetype Rules = %etc-dir%/filetype.rules.conf Second thing, I installed renattach using the instructions for Postfix Integration at http://www.pc-tools.net/unix/renattach/INSTALL which, in short tells you to modify the master.cf postfix config file. add: filter unix - n n - - pipe flags=q user=filter argv=renattach -p sendmail -i -f ${sender} -- ${recipient} modify: smtp inet n - n - - smtpd -o content_filter=filter This works for the most part, but here is where the problem starts to creep up. The postfix+MailScanner instructions at http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml tell me to add header_checks = regexp:/etc/postfix/header_checks to /etc/postfix/main.cf and create the file /etc/postfix/header_checks with the following contents: /^Received:/ HOLD Here is the problem: When I send an email: 1. Postfix puts the email into HOLD. 2. MailScanner picks it up and does its thing. 3. The content filter sends the email to renattach 4. Renattach finishes with the email and reinjects it 5. Reinjected email goes into HOLD. 6. MailScanner picks it up and does its thing. 7. Message is delivered. Ok, if you don't see it, The email message is processed through MailScanner 2x. I took a look at http://www.postfix.org/FILTER_README.html#simple_filter which shows how email moves around between all the processes that make up postfix. There is a nice pretty picture that shows the content filter after the qmgr. I guess that's why they call it "After-Queue Content Filter" The point being that after the queue, and after the content filter, the email is reinjected using pickup and then eventually passed to cleanup, which does another "header_check" and stuffs the email into the HOLD queue again. Some things I tried to fix this. First fix attempt: I tried to tell postfix to knock it off by modifying the master.cf as follows: smtp inet n - n - - smtpd -o content_filter=filter -o receive_override_options=no_header_body_checks This didn't solve the problem, and to be honest, im not sure if its effecting anything. I did some more research under the advanced filter options for postfix, with no help there. Second fix attempt: I had the thought that I could just modify the generic virus scanner and fit renattach into MailScanner. After creating a renattach-wrapper, modifying MailScanner.conf, and SweepViruses.pm, I started running into weird errors, including the debug message "can't find EOCD signature". I had chopped up a few too many files, because after I cleaned out what I thought I had just done, it was still fairly broken. Im sure that was my fault, so I cleaned everything out and rebuilt my MailScanner install fresh, and got back to square one. Ok, so what Im looking for is a solution to this problem. It would be beneficial to have the solution be part of MailScanner. Im not married to renattach, but it was one of the first programs out there that does what I need. Thanks Jonathan Higgins IT R&D Project Manager Kennesaw State University jhiggins@kennesaw.edu ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Wed Apr 13 16:19:33 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:18 2006 Subject: postfix question ! Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hirsh, Joshua said: >> Try this from Joshua Hirsh last year: >> >> When I release a file into quarantine, I copy it directly into the > incoming folder for the sending process of Postfix (make > sure it's > executable). >> So for example: >> >> [root B710F4D00F4]# chmod +x B710F4D00F4 >> [root B710F4D00F4]# cp -p B710F4D00F4 /var/spool/postfix/incoming/B/ >> Drew > > > > heh. I missed this post before I replied... How fitting that it's my own > quote! ;-) Made me smile though. :-) Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Wed Apr 13 17:54:18 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:18 2006 Subject: Building a Server from scratch Message-ID: Lance Haig wrote: > I have built a SUSE 9.2 system and want to start installing > MailScanner. > > What is the recommended order? > > I want to start with MailScanner and test to see if it works > Then add SpamAssassin and test > Then DCC > Rayzor > Pyzor. > > Would you agree with this? > > Lance Per Martin's response on Dec 10, 2004: > 2. a better order is... > sendmail > clamav > bitdefender > razor2 > dcc > pyzor > spamassassin > mailscanner > mailwatch HTH... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 18:19:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: adding renattach to MailScanner+Postfix Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Don't worry about the EOCD signature warnings. They are just the Zip unpacker failing to find a zip archive in an executable. Totally harmless. Jonathan Higgins wrote: > It figures I would stumble across a solution after I took the time to > put together this email.. > So I will provide the solution. It is all postfix based.. so sorta > off topic, but just to complete the thought... > modify master.cf to: > smtp inet n - n - - smtpd > -o content_filter=filter > -o cleanup_service_name=cleanup2 #from here down is > different > cleanup2 unix n - n - 0 cleanup #add a separate > cleanup > -o body_checks= > -o mime_header_checks= > -o nested_header_checks= > -o header_checks=pcre:/etc/postfix/header_checks2 #this file is empty > enjoy > > > Jonathan Higgins > IT R&D Project Manager > Kennesaw State University > jhiggins@kennesaw.edu > > >>> jhiggins@KENNESAW.EDU 4/13/2005 10:24:43 AM >>> > I need to implement renaming extensions instead of just modifying the > subject, or blocking certain extensions(filenames) or filetypes. > > software build: > RHEL AS 3.0 > postfix-2.0.16-14.RHEL3 > MailScanner 4.39.5 > spamassassin-3.0.2-1 > clamav-0.83-1.1.el3.rf > renattach-1.2.2 > > First thing I did was disable filename and filetype checking in > MailScanner.conf by adding a "#" infront of the rules. > #Filename Rules = %etc-dir%/filename.rules.conf > #Filetype Rules = %etc-dir%/filetype.rules.conf > > Second thing, I installed renattach using the instructions for Postfix > Integration at http://www.pc-tools.net/unix/renattach/INSTALL > which, in short tells you to modify the master.cf postfix config file. > add: > filter unix - n n - - pipe > flags=q user=filter argv=renattach -p sendmail -i -f ${sender} > -- ${recipient} > modify: > smtp inet n - n - - smtpd > -o content_filter=filter > > This works for the most part, but here is where the problem starts to > creep up. > > The postfix+MailScanner instructions at > http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml > tell me to add > header_checks = regexp:/etc/postfix/header_checks > to /etc/postfix/main.cf > and create the file /etc/postfix/header_checks with the following > contents: > /^Received:/ HOLD > Here is the problem: > When I send an email: > 1. Postfix puts the email into HOLD. > 2. MailScanner picks it up and does its thing. > 3. The content filter sends the email to renattach > 4. Renattach finishes with the email and reinjects it > 5. Reinjected email goes into HOLD. > 6. MailScanner picks it up and does its thing. > 7. Message is delivered. > > Ok, if you don't see it, The email message is processed through > MailScanner 2x. > > I took a look at http://www.postfix.org/FILTER_README.html#simple_filter > which shows how email moves around between all the processes that make > up postfix. > There is a nice pretty picture that shows the content filter after the > qmgr. I guess that's why they call it "After-Queue Content Filter" > > The point being that after the queue, and after the content filter, > the email is reinjected using pickup and then eventually passed to > cleanup, which does another "header_check" and stuffs the email into > the HOLD queue again. > > Some things I tried to fix this. > First fix attempt: > I tried to tell postfix to knock it off by modifying the master.cf as > follows: > smtp inet n - n - - smtpd > -o content_filter=filter > -o receive_override_options=no_header_body_checks > > This didn't solve the problem, and to be honest, im not sure if its > effecting anything. > I did some more research under the advanced filter options for > postfix, with no help there. > > Second fix attempt: > I had the thought that I could just modify the generic virus scanner > and fit renattach into MailScanner. > After creating a renattach-wrapper, modifying MailScanner.conf, and > SweepViruses.pm, I started running into weird errors, including the > debug message "can't find EOCD signature". > > I had chopped up a few too many files, because after I cleaned out > what I thought I had just done, it was still fairly broken. Im sure > that was my fault, so I cleaned everything out and rebuilt my > MailScanner install fresh, and got back to square one. > > Ok, so what Im looking for is a solution to this problem. It would be > beneficial to have the solution be part of MailScanner. Im not > married to renattach, but it was one of the first programs out there > that does what I need. > > Thanks > > > > > > > > > > > > > Jonathan Higgins > IT R&D Project Manager > Kennesaw State University > jhiggins@kennesaw.edu > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 18:23:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ken Goods wrote: >Greets all, >I downloaded and installed the latest versions of MailScanner and >install-ClamAV-SA as I've done in the past and used the install scripts as >usual (thanks Julian!). I didn't notice any major errors in the output. >After all was done MailScanner -V reports the correct MailScanner version >but for some reason only reports V3.00000 for spamassassin. Also I notice >that clamAV is not used. I re-ran the ClamAV-SA install (INSTALL-tar.sh) and >it reports at the end, Oh good Spamassassin V3.02 is already installed. >However when I run spamassassin -D --lint it also shows version 3.0.0 and >produces no errors. > > Look for the file SpamAssassin.pm in your /usr/lib/perl5 directories, find /usr/lib/perl5 -name SpamAssassin.pm -print as it's possible that MailScanner is finding a different version of SpamAssassin from where other scripts find it. Do you have an RPM of SpamAssassin installed? If so, then remove it with "rpm -e spamassassin". >which clamav returns: /usr/bin/which: no clamav in >(/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin >:/root/bin) > > You want "which clamscan". >Seems like the install put SA and ClamAV in different paths than last time. > >I'm a novice at *nix and would appreciate any clues as to how I can make >things right. I don't mind removing all traces of everything and >reinstalling if that would be the easiest route but I haven't got a clue how >to start. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From diego.fabara at ALEGROPCS.COM Wed Apr 13 18:35:22 2005 From: diego.fabara at ALEGROPCS.COM (Diego Fabara) Date: Thu Jan 12 21:29:18 2006 Subject: An Autoresponse Message-ID: I’ve a Server AntiSpam in MailRelay format. (mailertable to redirect emails for my domain) But, I need autoresponse a lot of mails arrived to user1@mydomain.com with a message like “Thanks for your email. We will contact to you !” Without this email arrived to my internal Email Server. In what file I need a rule ?? ________________________________________________________________________________ INFORMACION CONFIDENCIAL: SE PROHIBE LA DIFUSION O PUBLICACION DE ESTA INFORMACION A TERCEROS SIN LA AUTORIZACION EXPRESA Y POR ESCRITO DE TELECSA. ESTA INFORMACION DEBE SER GUARDADA CON SEGURIDADES CUANDO NO SE LA ESTE UTILIZANDO. SI USTED NO ES EL DESTINATARIO DE ESTE EMAIL, USTED DEBERA DEVOLVERLO AL EMISOR Y NO PODRA LEER, COPIAR O DISTRIBUIR SUS ANEXOS. CUALQUIER OPINION EXPRESADA EN ESTE MENSAJE, CORRESPONDE A SU AUTOR Y NO NECESARIAMENTE A TELECSA - ALEGRO PCS. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikes at HARTWELLCORP.COM Wed Apr 13 18:38:08 2005 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: Yes, I think this is the case. I will try turning off phishing detection to see if the behavior changes. Thank you. Daniel Kleinsinger <> wrote: > Do the truncated emails have an html part with few/no tags and a fully > intact plain text part? If so, there's been an issue like this > reported before, possibly having to do with the phishing net. > > Daniel > > Michael St. Laurent wrote: > >> Hello, >> >> I'm having trouble with (a very, very few) truncated emails. >> Currently we're using 4.40.11 but noticed this same problem with the >> previous stable release as well. >> >> Is there a known issue with this or am I reporting something new? -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 18:46:59 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Truncated emails with 4.40.11 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] And I've already fixed this one, or so I thought. Let us know how you get on. Michael St. Laurent wrote: >Yes, I think this is the case. I will try turning off phishing detection to >see if the behavior changes. > >Thank you. > >Daniel Kleinsinger <> wrote: > > >>Do the truncated emails have an html part with few/no tags and a fully >>intact plain text part? If so, there's been an issue like this >>reported before, possibly having to do with the phishing net. >> >>Daniel >> >>Michael St. Laurent wrote: >> >> >> >>>Hello, >>> >>>I'm having trouble with (a very, very few) truncated emails. >>>Currently we're using 4.40.11 but noticed this same problem with the >>>previous stable release as well. >>> >>>Is there a known issue with this or am I reporting something new? >>> >>> > >-- >Michael St. Laurent >Hartwell Corporation > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From William.Burns at AEROFLEX.COM Wed Apr 13 19:03:01 2005 From: William.Burns at AEROFLEX.COM (William Burns) Date: Thu Jan 12 21:29:18 2006 Subject: netiquette on "wiki" website Message-ID: What is proper netiquette for this site? For example, is it ok to do this? http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:rbls:infinite_monkeys Would it be appropriate to add another page for questions that we feel are not answered by the FAQ/MAQ? How 'bout a "desired features" list? I noticed that the "upgrade" section is blank. What kind of info belongs here? Should there be a list of MailScanner.conf variables that got added at each version, so that people can see what new configs they might have to deal with when they upgrade through multiple new versions? Should there be a procedure for archiving/removing all old mailscanner files in preparation for a new mailscanner version? Both? -Bill Julian Field wrote: > Currently it is in need of some more content, so I would really > appreciate it if you could take a look around and fill in the gaps > wherever you have something useful to contribute. > ... > *** The Wiki is at http://wiki.mailscanner.info/ > > Many thanks to Ugo in particular for making this happen. > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 19:14:24 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I see the wiki as somewhere to answer questions, not to ask them. Feel free to add a "desired features" list page. If there is a section that is blank, that is because no-one has volunteered to write content to fill it. As I said in the announcement, please contribute information which would be useful to others. It is not a replacement for the mailing list. Don't expect to pose questions there and have them answered, that's what the list is for. However, if you get a useful response to a good question from the list, please add the response to the wiki in a helpful place where others can find it. The "upgrade_MailScanner_conf" script tells you what has been added since you last upgraded. You should read the relevant comments in the MailScanner.conf file for each of these new settings. Why would you want to archive or delete an old MailScanner version when installing a new one? William Burns wrote: > What is proper netiquette for this site? > > For example, is it ok to do this? > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:rbls:infinite_monkeys > > > Would it be appropriate to add another page for questions that we feel > are not answered by the FAQ/MAQ? > How 'bout a "desired features" list? > > I noticed that the "upgrade" section is blank. > What kind of info belongs here? > > Should there be a list of MailScanner.conf variables that got added at > each version, so that people can see what new configs they might have to > deal with when they upgrade through multiple new versions? > Should there be a procedure for archiving/removing all old mailscanner > files in preparation for a new mailscanner version? > Both? > > -Bill > > Julian Field wrote: > >> Currently it is in need of some more content, so I would really >> appreciate it if you could take a look around and fill in the gaps >> wherever you have something useful to contribute. >> > ... > >> *** The Wiki is at http://wiki.mailscanner.info/ >> >> Many thanks to Ugo in particular for making this happen. >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wright at CYBERVALE.COM Wed Apr 13 18:16:12 2005 From: wright at CYBERVALE.COM (Terran Wright) Date: Thu Jan 12 21:29:18 2006 Subject: OT: Bitdefender on CentOS4 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Guys, Pardon the off topic post however, I tried installing Bitdefender today however I get errors the following errors after the install: #bdc --update BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35) Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved. Error: can't find update dll # bdc --info BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35) Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved. Error: core initialization failed: Libfn initialization failed I'm using CentOS 4, BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586, I read in the Wiki "Since it is a binary distribution, you might be needing some compatibility libraries (ex: FC3/RHEL4 need a compatibility-libstd++ package to run bdc)." Can anybody tell where I can get this? as anybody seen and resolved this issue? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From cgibbons at TAHC.STATE.TX.US Wed Apr 13 19:00:25 2005 From: cgibbons at TAHC.STATE.TX.US (Carol Gibbons) Date: Thu Jan 12 21:29:18 2006 Subject: Sendmail not moving files to mqueue.in Message-ID: Hi there, We've been running mailscanner with sendmail on a Mac OS X 10.2.8 server for quite awhile. I had to rebuild the server using an image this past week. But, now mailscanner won't interact with sendmail. I reset the permissions and owner for various directories that sendmail needs root as owner. I made sure mqueue.in has same perms as mqueue. But, ever since the rebuild, sendmail will not place incoming mail into the mqueue.in directory. I checked the sendmail.cf file (/System/Library/StartupItems/Sendmail/sendmail) and the mailscanner settings are there to correctly route to mqueue.in. And, mailscanner is running and sendmail is running. Any ideas? Any help is appreciated. Carol ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Wed Apr 13 19:26:03 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:18 2006 Subject: An Autoresponse Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Diego Fabara > Sent: Wednesday, April 13, 2005 1:35 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: An Autoresponse > > I've a Server AntiSpam in MailRelay format. (mailertable to redirect > emails for my domain) > > > > But, I need autoresponse a lot of mails arrived to user1@mydomain.com with > a message like "Thanks for your email. We will contact to you !" > > Without this email arrived to my internal Email Server. > > > > In what file I need a rule ?? This is not a job for MailScanner. You want to install (if needed) and configure procmail. General information: http://laku19.adsl.netsonic.fi/era/procmail/links.html Some autoresponder examples: http://gunnar.cc/hosting/procmail.html Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Apr 13 19:15:48 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:18 2006 Subject: MailScanner ANNOUNCE: Documentation "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > > *** The Wiki is at http://wiki.mailscanner.info/ > > Many thanks to Ugo in particular for making this happen. :). If you want to know how to proceed to help, you can go to http://wiki.mailscanner.info/doku.php?id=documentation:volunteers If you have any question on the wiki, please feel free to write me directly. What is needed now is to make sure all the content from the old FAQ is migrated to the wiki and if you just feel like proofreading, that is fine as well. The goal is to shut down the old FAQ quickly. Many thanks to all of you. Regards, Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Apr 13 19:31:06 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:18 2006 Subject: OT: Bitdefender on CentOS4 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Terran Wright wrote: > Guys, > > Pardon the off topic post however, I tried installing Bitdefender today > however I get errors the following errors after the install: > > #bdc --update > BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35) > Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved. > > Error: can't find update dll > > # bdc --info > BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35) > Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved. > > Error: core initialization failed: Libfn initialization failed > > > I'm using CentOS 4, BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586, > I read in the Wiki "Since it is a binary distribution, you might be needing > some compatibility libraries (ex: FC3/RHEL4 need a compatibility-libstd++ > package to run bdc)." Can anybody tell where I can get this? > > as anybody seen and resolved this issue? > yum -y install compat-libstdc++-296.i386 compat-libstdc++-33.i386 you use yum (or apt) to update your servers.. right? - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 19:38:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Sendmail not moving files to mqueue.in Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Check to see there aren't any sendmail -bd -q15m processes running. I suspect sendmail/Exim/Postfix are running outside of MailScanner, processing incoming messages directly avoiding MailScanner. Carol Gibbons wrote: > Hi there, > > We've been running mailscanner with sendmail on a Mac OS X 10.2.8 server > for quite awhile. I had to rebuild the server using an image this past > week. But, now mailscanner won't interact with sendmail. I reset the > permissions and owner for various directories that sendmail needs root as > owner. I made sure mqueue.in has same perms as mqueue. But, ever since > the > rebuild, sendmail will not place incoming mail into the mqueue.in > directory. I checked the sendmail.cf file > (/System/Library/StartupItems/Sendmail/sendmail) and the mailscanner > settings are there to correctly route to mqueue.in. And, mailscanner is > running and sendmail is running. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Wed Apr 13 19:39:55 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:18 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I got the same problem. This was scored 9.4 AWL thru my system also. Why? William Burns wrote: > Our MailScanner believes that the attachment to this message sent to you > > From: owner-mailscanner@jiscmail.ac.uk > Subject: netiquette on "wiki" website > > is Unsolicited Commercial Email (spam). Unless you are sure that this > message > is incorrectly thought to be spam, please delete this message without > opening > it. Opening spam messages might allow the spammer to verify your email > address. > > If you believe that this message has been incorrectly marked as spam, > please > forward this email to postmaster@webshowhost.com > > pts rule name description > ---- ---------------------- > -------------------------------------------------- > -0.0 SPF_HELO_PASS SPF: HELO matches SPF record > -0.0 SPF_PASS SPF: sender matches SPF record > -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% > [score: 0.0005] > 9.4 AWL AWL: From: address is in the auto white-list > > > > > -- > This message has been scanned for viruses and > dangerous content by Secure Resource, and is > believed to be clean. > MailScanner thanks transtec Computers for their support. > -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 20:13:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Take a look in your ~root/.spamassassin directory. Remove any files with whitelist in their name. And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the auto-whitelist functionality. "man Mail::SpamAssassin::Conf" for more help on what the setting is called. Ed Bruce wrote: > I got the same problem. This was scored 9.4 AWL thru my system also. Why? > > William Burns wrote: > >> Our MailScanner believes that the attachment to this message sent to you >> >> From: owner-mailscanner@jiscmail.ac.uk >> Subject: netiquette on "wiki" website >> >> is Unsolicited Commercial Email (spam). Unless you are sure that this >> message >> is incorrectly thought to be spam, please delete this message without >> opening >> it. Opening spam messages might allow the spammer to verify your email >> address. >> >> If you believe that this message has been incorrectly marked as spam, >> please >> forward this email to postmaster@webshowhost.com >> >> pts rule name description >> ---- ---------------------- >> -------------------------------------------------- >> -0.0 SPF_HELO_PASS SPF: HELO matches SPF record >> -0.0 SPF_PASS SPF: sender matches SPF record >> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% >> [score: 0.0005] >> 9.4 AWL AWL: From: address is in the auto white-list >> >> >> >> >> -- >> This message has been scanned for viruses and >> dangerous content by Secure Resource, and is >> believed to be clean. >> MailScanner thanks transtec Computers for their support. >> > > > -- > This message has been scanned for viruses and > dangerous content by Secure Resource, and is > believed to be clean. > MailScanner thanks transtec Computers for their support. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From TristanRhodes at WEBER.EDU Wed Apr 13 20:22:52 2005 From: TristanRhodes at WEBER.EDU (Tristan RHODES) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix Message-ID: Thank you Peter, Drew, and Julian for your help. As Drew said, this was caused by Razor placing a file in the queue directory. I needed to edit the "/etc/MailScanner/spam.assassin.prefs.conf" file and add a line that says... razor_config /var/lib/Mailscanner (Ubuntu 5.04 does not have a "/var/spool/MailScanner/spamassassin" directory, but it does have "/var/lib/Mailscanner" directory that contains the Bayes database.) Everything appears to be working correctly without any errors. Great to have such a talented and friendly mailing list. Tristan Rhodes P.S. Installing Razor is as easy as typing "apt-get install razor". No sweat. >>> drew@THEMARSHALLS.CO.UK 04/13/05 12:29 AM >>> Peter Russell wrote: > You need to install razor properly. Its a buggar. > > But temporarily make your postfix account so you can log in with it, > switch to it and then create razor, then change the conf file to log to > dev/null > > I am sure there is an easier way but i dont know it :) In spam.assassin.prefs.conf just add razor_config /var/spool/MailScanner/spamassassin and that will set razor to log to .razor in that directory (Or indeed where ever you wish it to set it's home directory to). It's only because MS runs as the user postfix, who happens to have it's home directory as /var/spool/postfix so drops it's log file in the queue directory, which Postfix doesn't like. Drew ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From TristanRhodes at WEBER.EDU Wed Apr 13 20:59:19 2005 From: TristanRhodes at WEBER.EDU (Tristan RHODES) Date: Thu Jan 12 21:29:18 2006 Subject: Ubuntu (debian-unstable) + Mailscanner + Postfix (fixed typo) Message-ID: (I have updated the name of the setting below. "/var/lib/Mailscanner" should be "/var/lib/MailScanner" ) >>> TristanRhodes@WEBER.EDU 04/13/05 1:22 PM >>> Thank you Peter, Drew, and Julian for your help. As Drew said, this was caused by Razor placing a file in the queue directory. I needed to edit the "/etc/MailScanner/spam.assassin.prefs.conf" file and add a line that says... razor_config /var/lib/MailScanner (Ubuntu 5.04 does not have a "/var/spool/MailScanner/spamassassin" directory, but it does have "/var/lib/MailScanner" directory that contains the Bayes database.) Everything appears to be working correctly without any errors. Great to have such a talented and friendly mailing list. Tristan Rhodes P.S. Installing Razor is as easy as typing "apt-get install razor". No sweat. >>> drew@THEMARSHALLS.CO.UK 04/13/05 12:29 AM >>> Peter Russell wrote: > You need to install razor properly. Its a buggar. > > But temporarily make your postfix account so you can log in with it, > switch to it and then create razor, then change the conf file to log to > dev/null > > I am sure there is an easier way but i dont know it :) In spam.assassin.prefs.conf just add razor_config /var/spool/MailScanner/spamassassin and that will set razor to log to .razor in that directory (Or indeed where ever you wish it to set it's home directory to). It's only because MS runs as the user postfix, who happens to have it's home directory as /var/spool/postfix so drops it's log file in the queue directory, which Postfix doesn't like. Drew ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Wed Apr 13 21:41:41 2005 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Ken Goods wrote: > >>.... However when I run >> spamassassin -D --lint it also shows version 3.0.0 and produces no >> errors. >> >> > Look for the file SpamAssassin.pm in your /usr/lib/perl5 directories, > find /usr/lib/perl5 -name SpamAssassin.pm -print > as it's possible that MailScanner is finding a different version of > SpamAssassin from where other scripts find it. Do you have an RPM of > SpamAssassin installed? If so, then remove it with "rpm -e > spamassassin". > Julian... I've always thought you were a genius but now I know for sure. ;) I did have an errant old V2.63 rpm out there. Don't understand why it waited until now to rear it's ugly head. shrug... Fixed that, now it seems to be calling the correct (and only, as far as I can tell) spamassassin. Now I have a new problem. Spams that were normally caught are not. Looking at the headers it doesn't even appear that most rules are being checked. i.e. X-AIAInsurance-MailScanner-Information: Please contact MIS for more information X-AIAInsurance-MailScanner: Found to be clean X-AIAInsurance-MailScanner-SpamCheck: not spam, SpamAssassin (score=0, required 5, autolearn=not spam) but to confuse things a little more it does appear that the SPF rule is working... X-AIAInsurance-MailScanner-Information: Please contact MIS for more information X-AIAInsurance-MailScanner: Found to be clean X-AIAInsurance-MailScanner-SpamCheck: not spam, SpamAssassin (score=0.001, required 5, SPF_HELO_FAIL 0.00) and X-AIAInsurance-MailScanner-Information: Please contact MIS for more information X-AIAInsurance-MailScanner: Found to be clean X-AIAInsurance-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.14, required 5, SPF_HELO_SOFTFAIL 3.14) These are all definitely spam/male enhancement type emails and should have hit on several rules including SURBL's. DNS is fine. I went through MailScanner.conf with a fine toothed comb and looked at spam.assassin.prefs.cf, local.cf, etc... etc.. and don't see anything out of the ordinary. Running spamassassin -D --lint shows the correct version and the rules being loaded. It finishes with no errors. Is there something else I can do to troubleshoot this? I also sent myself a GTUBE from another domain and it slipped right through.... could really use a couple ideas before the masses come down here to the dungeon with torches and wooden pitchforks... :) >> which clamav returns: /usr/bin/which: no clamav in >> (/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin >> :/root/bin) >> >> > You want "which clamscan". > That also got me going in the right direction and fixed me up, Thanks! I'm learning... :) I ended up installing it from YUM using Dag's site... worked like a champ I may stick to rpms as they have not hurt anything (so far). Thanks for all your help, you're a Saint! Ken Goods Network Administrator AIA Insurance, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 21:52:13 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ken Goods wrote: >Julian Field wrote: > > >>Ken Goods wrote: >> >> >> >>>.... However when I run >>>spamassassin -D --lint it also shows version 3.0.0 and produces no >>>errors. >>> >>> >>> >>> >>Look for the file SpamAssassin.pm in your /usr/lib/perl5 directories, >>find /usr/lib/perl5 -name SpamAssassin.pm -print >>as it's possible that MailScanner is finding a different version of >>SpamAssassin from where other scripts find it. Do you have an RPM of >>SpamAssassin installed? If so, then remove it with "rpm -e >>spamassassin". >> >> >> > >Julian... I've always thought you were a genius but now I know for sure. ;) >I did have an errant old V2.63 rpm out there. Don't understand why it waited >until now to rear it's ugly head. shrug... Fixed that, now it seems to be >calling the correct (and only, as far as I can tell) spamassassin. Now I >have a new problem. Spams that were normally caught are not. Looking at the >headers it doesn't even appear that most rules are being checked. i.e. > >X-AIAInsurance-MailScanner-Information: Please contact MIS for more >information >X-AIAInsurance-MailScanner: Found to be clean >X-AIAInsurance-MailScanner-SpamCheck: not spam, SpamAssassin (score=0, > required 5, autolearn=not spam) > >but to confuse things a little more it does appear that the SPF rule is >working... > >X-AIAInsurance-MailScanner-Information: Please contact MIS for more >information >X-AIAInsurance-MailScanner: Found to be clean >X-AIAInsurance-MailScanner-SpamCheck: not spam, SpamAssassin (score=0.001, > required 5, SPF_HELO_FAIL 0.00) > >and > >X-AIAInsurance-MailScanner-Information: Please contact MIS for more >information >X-AIAInsurance-MailScanner: Found to be clean >X-AIAInsurance-MailScanner-SpamCheck: not spam, SpamAssassin (score=3.14, > required 5, SPF_HELO_SOFTFAIL 3.14) > >These are all definitely spam/male enhancement type emails and should have >hit on several rules including SURBL's. DNS is fine. I went through >MailScanner.conf with a fine toothed comb and looked at >spam.assassin.prefs.cf, local.cf, etc... etc.. and don't see anything out of >the ordinary. Running spamassassin -D --lint shows the correct version and >the rules being loaded. It finishes with no errors. Is there something else >I can do to troubleshoot this? I also sent myself a GTUBE from another >domain and it slipped right through.... could really use a couple ideas >before the masses come down here to the dungeon with torches and wooden >pitchforks... :) > > In MailScanner.conf set "Debug = yes" and "Debug SpamAssassin = yes" then stop MailScanner, then run check_MailScanner. It will spew out a load of stuff from SpamAssassin. Page back up it (Shift+PageUp) and go through the output carefully to make sure it is searching the directories where all your SpamAssassin *.cf files are stored. You should be able to find "50_scores.cf" for example in one of the directories it is searching. Also do a "MailScanner -v" and check it is finding all the modules (and their versions) that you think it should be finding, paying particular attention to things like MIME-Base64 version 3.something and your SpamAssassin version. > > >>>which clamav returns: /usr/bin/which: no clamav in >>> >>> >>> >(/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin > > >>>:/root/bin) >>> >>> >>You want "which clamscan". >> >> > >That also got me going in the right direction and fixed me up, Thanks! I'm >learning... :) I ended up installing it from YUM using Dag's site... worked >like a champ I may stick to rpms as they have not hurt anything (so far). > > Just whichever place you start using these RPMs from (Dag's is just fine) make sure you stick to it. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From P.G.M.Peters at UTWENTE.NL Wed Apr 13 22:09:36 2005 From: P.G.M.Peters at UTWENTE.NL (Peter Peters) Date: Thu Jan 12 21:29:18 2006 Subject: Version 4.40.11-1 not honoring rules? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Since the upgrade to 4.40.11-1 MS seems to scan everything for virusses and spam. Default in rules-files is no. Only some domains are scanned according to the rules. After upgrading MS scans all e-mail. Before the upgrade the log contained lines showing "unscanned" messages. After the upgrade no more "unscanned" messages are logged and users are complaining about their messages beeing scanned. -- Peter Peters, senior beheerder (Security) Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 22:23:00 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Version 4.40.11-1 not honoring rules? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] There was a bug in previous versions where it would do a "first matches" rule check on the ruleset for "Virus Scanning", which meant it would scan the message if the "first" recipient in the message requested scanning. It now scans a message if any of the recipients asked for it to be scanned. Well that's what I intended to happen... Peter Peters wrote: > Since the upgrade to 4.40.11-1 MS seems to scan everything for virusses > and spam. Default in rules-files is no. Only some domains are scanned > according to the rules. After upgrading MS scans all e-mail. > > Before the upgrade the log contained lines showing "unscanned" messages. > After the upgrade no more "unscanned" messages are logged and users are > complaining about their messages beeing scanned. > > -- > Peter Peters, senior beheerder (Security) > Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) > Universiteit Twente, Postbus 217, 7500 AE Enschede > telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Wed Apr 13 22:26:35 2005 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >> > In MailScanner.conf set "Debug = yes" and "Debug SpamAssassin = yes" > then stop MailScanner, then run check_MailScanner. It will spew out a > load of stuff from SpamAssassin. Page back up it (Shift+PageUp) and go > through the output carefully to make sure it is searching the > directories where all your SpamAssassin *.cf files are stored. You > should be able to find "50_scores.cf" for example in one of the > directories it is searching. > > Also do a "MailScanner -v" and check it is finding all the modules > (and their versions) that you think it should be finding, paying > particular attention to things like MIME-Base64 version 3.something > and your SpamAssassin version. > It looks as though MailScanner is still thinking I have SA V3.0? From cgibbons at TAHC.STATE.TX.US Wed Apr 13 22:27:42 2005 From: cgibbons at TAHC.STATE.TX.US (Carol Gibbons) Date: Thu Jan 12 21:29:18 2006 Subject: Sendmail not moving files to mqueue.in Message-ID: You're absolutely right. I need to remove the "-bd" part in the sendmail config file and see how it goes. Thanks, Carol At 01:38 PM 4/13/05, you wrote: >Check to see there aren't any > sendmail -bd -q15m >processes running. I suspect sendmail/Exim/Postfix are running outside >of MailScanner, processing incoming messages directly avoiding MailScanner. > >Carol Gibbons wrote: > >>Hi there, >> >>We've been running mailscanner with sendmail on a Mac OS X 10.2.8 server >>for quite awhile. I had to rebuild the server using an image this past >>week. But, now mailscanner won't interact with sendmail. I reset the >>permissions and owner for various directories that sendmail needs root as >>owner. I made sure mqueue.in has same perms as mqueue. But, ever since >>the >>rebuild, sendmail will not place incoming mail into the mqueue.in >>directory. I checked the sendmail.cf file >>(/System/Library/StartupItems/Sendmail/sendmail) and the mailscanner >>settings are there to correctly route to mqueue.in. And, mailscanner is >>running and sendmail is running. > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 13 22:43:32 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ken Goods wrote: >Julian Field wrote: > > >>In MailScanner.conf set "Debug = yes" and "Debug SpamAssassin = yes" >>then stop MailScanner, then run check_MailScanner. It will spew out a >>load of stuff from SpamAssassin. Page back up it (Shift+PageUp) and go >>through the output carefully to make sure it is searching the >>directories where all your SpamAssassin *.cf files are stored. You >>should be able to find "50_scores.cf" for example in one of the >>directories it is searching. >> >>Also do a "MailScanner -v" and check it is finding all the modules >>(and their versions) that you think it should be finding, paying >>particular attention to things like MIME-Base64 version 3.something >>and your SpamAssassin version. >> >> >> > >It looks as though MailScanner is still thinking I have SA V3.0? > >From Debug: > >configuration file "/usr/share/spamassassin/20_body_tests.cf" requires >version 3.000002 of SpamAssassin, but this is code version 3.000000. Maybe >you need to use the -C switch, or remove the old config files? Skipping this >file at /usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin/Conf/Parser.pm line >329. > >(several of those) > >Then later I see several of these... > >debug: config: SpamAssassin failed to parse line, skipping: >uridnsbl_skip_domain yahoo.com w3.org msn.com com.com yimg.com >debug: config: SpamAssassin failed to parse line, skipping: >uridnsbl_skip_domain hotmail.com doubleclick.net flowgo.com ebaystatic.com >aol.com > >If I do a which spamassassin I get... > >/usr/bin/spamassassin > >If I find /usr/lib/perl5 -name SpamAssassin.pm -print, I get... > >/usr/lib/perl5/site_perl/5.8.0/Mail/SpamAssassin.pm >/usr/lib/perl5/vendor_perl/5.8.0/Mail/SpamAssassin.pm > >So there still are two? I guess I don't understand... help please? > > rpm -e spamassassin (or whatever name is required to make it remove DAG's rpm). Then search /usr/lib/perl5 for any files called *.cf with find /usr/lib/perl5 -name '*.cf' -print then delete them all. And then find /usr/lib/perl5 -name 'SpamAssassin.pm' -print and delete it, and any files in subdirectories of it that look like they are SpamAssassin-related (e.g. called "SpamAssassin" :-) Then reinstall the rpm again. Now you should only have 1 version installed, hopefully. >>Just whichever place you start using these RPMs from (Dag's is just >>fine) make sure you stick to it. >> >> > >Good tip... I'll add it to my notes. > >I know you're busy, but if you could maybe give me a short explanation of >how I screwed this up I'd appreciate it. I've upgraded 2-3 times using your >scripts before without any problems and followed my notes this time with >less then successful results. If I knew why/how this happened maybe I keep >from doing it again in the future. I do and have read everything I can get >my hands on including the list everyday and all the FAQ's MAQ's and now >wiki's. But I still seem to get myself into a mess every now and again. :) > >Many thanks again. > >k > >Output from MailScanner -v (just in case) > >[root@gw-mail /]# MailScanner -v >Running on >Linux gw-mail.aiainsurance.com 2.4.20-30.9 #1 Wed Feb 4 20:44:26 EST 2004 >i686 i686 i386 GNU/Linux >This is Red Hat Linux release 9 (Shrike) >This is Perl version 5.008000 (5.8.0) > >This is MailScanner version 4.40.11 >Module versions are: >1.00 AnyDBM_File >1.14 Archive::Zip >1.01 Carp >1.119 Convert::BinHex >1.00 DirHandle >1.04 Fcntl >2.71 File::Basename >2.05 File::Copy >2.01 FileHandle >1.05 File::Path >0.13 File::Temp >1.29 HTML::Entities >3.45 HTML::Parser >2.30 HTML::TokeParser >1.20 IO >1.09 IO::File >1.122 IO::Pipe >1.50 Mail::Header >3.05 MIME::Base64 >5.417 MIME::Decoder >5.417 MIME::Decoder::UU >5.417 MIME::Head >5.417 MIME::Parser >3.03 MIME::QuotedPrint >5.417 MIME::Tools >0.10 Net::CIDR >1.05 POSIX >1.75 Socket >0.03 Sys::Syslog >1.02 Time::localtime > >Optional module versions are: >1.806 DB_File >1.08 Digest >1.01 Digest::HMAC >2.33 Digest::MD5 >2.10 Digest::SHA1 >0.44 Inline >0.13 Mail::ClamAV >3.000000 Mail::SpamAssassin >1.997 Mail::SPF::Query >0.15 Net::CIDR::Lite >0.48 Net::DNS >missing Net::LDAP >1.94 Parse::RecDescent >missing SAVI >1.2 Sys::Hostname::Long >2.42 Test::Harness >0.47 Test::Simple >1.89 Text::Balanced >1.35 URI > > > >Ken Goods >Network Administrator >AIA Insurance, Inc. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From KGoods at AIAINSURANCE.COM Wed Apr 13 23:14:19 2005 From: KGoods at AIAINSURANCE.COM (Ken Goods) Date: Thu Jan 12 21:29:18 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: >> > rpm -e spamassassin > (or whatever name is required to make it remove DAG's rpm). > Then search /usr/lib/perl5 for any files called *.cf with > find /usr/lib/perl5 -name '*.cf' -print > then delete them all. > And then > find /usr/lib/perl5 -name 'SpamAssassin.pm' -print > and delete it, and any files in subdirectories of it that look like > they are SpamAssassin-related (e.g. called "SpamAssassin" :-) > > Then reinstall the rpm again. > > Now you should only have 1 version installed, hopefully. > Got it! Thanks a million Julian. I took notes and think I have my head half way around what happened. Kind regards... Ken Goods Network Administrator AIA Insurance, Inc. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ml at NETGROUPES.CA Thu Apr 14 01:41:23 2005 From: ml at NETGROUPES.CA (Mailing List) Date: Thu Jan 12 21:29:19 2006 Subject: Possible BUG with the Script FileType Message-ID: Tested against: MailScaner 4.38.10 and MailScanner 4.40.11 Sending an EPS file thru when the filetype check denies script files blocks the file. My rough guess is that MailScanner parses the output of the file command and finds the letters "script" and interprets it as such. # file Friends\ Fr.eps Friends Fr.eps: DOS EPS Binary File Postscript starts at byte 32 length 73761 TIFF starts at byte 73793 length 10437 Can anyone reproduce this problem? Thanks Guy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Apr 14 01:46:06 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] William Burns wrote: > What is proper netiquette for this site? > > For example, is it ok to do this? > http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:rbls:infinite_monkeys > Bear in mind that the wiki is still a work in progress. If you feel you can improve the page either in apperance or content, feel free to do so :). > > Would it be appropriate to add another page for questions that we feel > are not answered by the FAQ/MAQ? You can send them to the list, or to me if you feel it should be added to the MAQ. While the MAQ page of the wiki can be edited by anyone, I'd appreciate if I could keep the control over it. > How 'bout a "desired features" list? Julian won't read all the wiki pages, so better to send them to the list. > > I noticed that the "upgrade" section is blank. > What kind of info belongs here? > This is one of my unfinished part :(. What kind of info? Something in line with the 'install' part. > Should there be a list of MailScanner.conf variables that got added at > each version, so that people can see what new configs they might have to > deal with when they upgrade through multiple new versions? See Julian's post. > Should there be a procedure for archiving/removing all old mailscanner > files in preparation for a new mailscanner version? There is something on this on the MAQ page. > Both? > > -Bill > > Julian Field wrote: > >> Currently it is in need of some more content, so I would really >> appreciate it if you could take a look around and fill in the gaps >> wherever you have something useful to contribute. >> > ... > >> *** The Wiki is at http://wiki.mailscanner.info/ >> >> Many thanks to Ugo in particular for making this happen. >> > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Apr 14 01:54:57 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Feel free to add a "desired features" list page. Oups... just said the opposite on another post. Please disregard my comment. > > If there is a section that is blank, that is because no-one has > volunteered to write content to fill it. > Or I didn't have time to work on it... It will eventually be more complete, but I don't have much spare time. However, if you feel like helping, drop me a line and I'll gladly guide you. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From William.Burns at AEROFLEX.COM Thu Apr 14 03:01:19 2005 From: William.Burns at AEROFLEX.COM (William Burns) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ugo Bellavance wrote: > William Burns wrote: > >> What is proper netiquette for this site? >> >> For example, is it ok to do this? >> http://wiki.mailscanner.info/doku.php?id=documentation:anti_spam:rbls:infinite_monkeys >> >> > > Bear in mind that the wiki is still a work in progress. If you feel you > can improve the page either in apperance or content, feel free to do > so :). Hmm... I already did the "bad" thing, by posting a question there, but someone already corrected/answered it. >> >> Would it be appropriate to add another page for questions that we feel >> are not answered by the FAQ/MAQ? > > > You can send them to the list, or to me if you feel it should be added > to the MAQ. While the MAQ page of the wiki can be edited by anyone, I'd > appreciate if I could keep the control over it. > Ok... Would you prefer a separate "staging" page w/ suggestions for the MAQ? That way you could move them over to the official "blessed" MAQ page when you were comfortable w/ them. >> I noticed that the "upgrade" section is blank. >> What kind of info belongs here? >> > > This is one of my unfinished part :(. What kind of info? Something in > line with the 'install' part. Note: I dropped in a link to what looked like the appropriate section of the MAQ, and one external link. > >> Should there be a procedure for archiving/removing all old mailscanner >> files in preparation for a new mailscanner version? > > > There is something on this on the MAQ page. As opposed to what's on the MAQ page (possibly due to paranoia) I did this: > tar --no-recursion -cvf mailscanner.old.tar `rpm -ql mailscanner` I figured that this would preserve any weird tweaks that I made to files under the "report" directory. In a pinch, I could recover any old file quickly and easily. I also did a pre-install/upgrade "diff" on my current "MailScanner.conf" vs. a "MailScanner.conf.orig" I'm not sure that has a place in an upgrade procedure... -Bill ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Thu Apr 14 03:11:36 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:19 2006 Subject: Bayes & MySQL Message-ID: I've got my bayes running with mysql on a few machines and seems to be working great. MY question is does the bayes rebuild still need to be done or is it even effective with bayes residing in mysql? TIA Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From satya at BAINSDIGITAL.COM Thu Apr 14 06:50:55 2005 From: satya at BAINSDIGITAL.COM (SatyaDev) Date: Thu Jan 12 21:29:19 2006 Subject: postfix question ! Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanx Drew and Joshua, Its working for me. I found one more tricky way to use "postdrop". I tried with "postdrop" from many different versions of postfix and "postdrop" from postfix-1.1.7-2 is working fine. Now i m using postfix-2.0.18 as SMTP and "postdrop" from postfix-1.1.7-2. (It shows that threre is problem in postdrop, in new postfix releases ! is it ? ) - SatyaDev www.bainsdigital.com Drew Marshall wrote: Hirsh, Joshua said: Try this from Joshua Hirsh last year: When I release a file into quarantine, I copy it directly into the incoming folder for the sending process of Postfix (make > sure it's executable). So for example: [root B710F4D00F4]# chmod +x B710F4D00F4 [root B710F4D00F4]# cp -p B710F4D00F4 /var/spool/postfix/incoming/B/ Drew heh. I missed this post before I replied... How fitting that it's my own quote! ;-) Made me smile though. :-) Drew ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Thu Apr 14 07:20:51 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:19 2006 Subject: Postfix problems? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, During our opensource evaluation project on of the issues with MailScanner that was raised by someone else is that it does not play well with postfix. Is this the case? I am not sure if Julian has fixed the problems completely yet I just want to know if this is the case. I did suggest sendmail as an alternative but was shot down due to sendmail's "security issues" not sure what those are. Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pete at ENITECH.COM.AU Thu Apr 14 07:33:27 2005 From: pete at ENITECH.COM.AU (Pete Russell) Date: Thu Jan 12 21:29:19 2006 Subject: Postfix problems? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Using postfix without any postfix related problems, for years. Currently MailScanner using postfix's own built in features, which was the point of contention from the POstfix devs, Julian improvised whihc they didnt approve of, even though it worked perfectly. Now that Postfix is used by MailScanner using the Postfix recommended methods, without issue, there si no reason for any of the postfix folks to complain, that i can see. I think there maybe be a faq entry on this? Pete Lance Haig wrote: > Hi, > > During our opensource evaluation project on of the issues with > MailScanner that was raised by someone else is that it does not play > well with postfix. > > Is this the case? I am not sure if Julian has fixed the problems > completely yet I just want to know if this is the case. I did suggest > sendmail as an alternative but was shot down due to sendmail's "security > issues" not sure what those are. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Thu Apr 14 08:10:46 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:19 2006 Subject: Postfix problems? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Pete, Thanks for this I will make them aware Lance Pete Russell wrote: > Using postfix without any postfix related problems, for years. > > Currently MailScanner using postfix's own built in features, which was > the point of contention from the POstfix devs, Julian improvised whihc > they didnt approve of, even though it worked perfectly. > > Now that Postfix is used by MailScanner using the Postfix recommended > methods, without issue, there si no reason for any of the postfix folks > to complain, that i can see. > > I think there maybe be a faq entry on this? > > Pete > > Lance Haig wrote: > >> Hi, >> >> During our opensource evaluation project on of the issues with >> MailScanner that was raised by someone else is that it does not play >> well with postfix. >> >> Is this the case? I am not sure if Julian has fixed the problems >> completely yet I just want to know if this is the case. I did suggest >> sendmail as an alternative but was shot down due to sendmail's "security >> issues" not sure what those are. >> >> Thanks >> >> Lance >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rakesh at NETCORE.CO.IN Thu Apr 14 08:44:47 2005 From: rakesh at NETCORE.CO.IN (Rakesh) Date: Thu Jan 12 21:29:19 2006 Subject: Postfix problems? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Hi, > > During our opensource evaluation project on of the issues with > MailScanner that was raised by someone else is that it does not play > well with postfix. > > Is this the case? I am not sure if Julian has fixed the problems > completely yet I just want to know if this is the case. I did suggest > sendmail as an alternative but was shot down due to sendmail's "security > issues" not sure what those are. My company would simply run out of business if the problems projected by postfix maintainers regarding using MailScanner with Postfix was that serious. We have been happily using the combination without any issues since a long time. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Apr 14 09:15:32 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:19 2006 Subject: Postfix problems? Message-ID: Lance There is a 'difference of ideas' between how Weitse and Julian want thingsto work. Weitse objects to MS's major design of simply moving messages from one queue to another. Other than that Julian keeps well up to date with Postfixs changes and MS works very nicely with Postfix AS for Sendmail - quote me security issue in last 3 years with modern versions. I'm no fan of sendmail myself (yucky 1980's config file syntax mainly) so I'm not particulary defending it, just trying to dispell myths when taling about old and new versions of sendmail. If you want an alternative to sendmail/Postfix, have a look at exim. Plays very well with MailScanner and support from the two maintainers at Cambridge Uni is excellant. (like Julian's support of MS is ) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Lance Haig wrote: > Hi, > > During our opensource evaluation project on of the issues with > MailScanner that was raised by someone else is that it does not play > well with postfix. > > Is this the case? I am not sure if Julian has fixed the problems > completely yet I just want to know if this is the case. I did suggest > sendmail as an alternative but was shot down due to sendmail's "security > issues" not sure what those are. > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dh at UPTIME.AT Thu Apr 14 09:28:14 2005 From: dh at UPTIME.AT (David H.) Date: Thu Jan 12 21:29:19 2006 Subject: Postfix problems? Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Martin Hepworth wrote: > Lance > AS for Sendmail - quote me security issue in last 3 years with modern > versions. I'm no fan of sendmail myself (yucky 1980's config file syntax > mainly) so I'm not particulary defending it, just trying to dispell > myths when taling about old and new versions of sendmail. > > If you want an alternative to sendmail/Postfix, have a look at exim. > Plays very well with MailScanner and support from the two maintainers at > Cambridge Uni is excellant. (like Julian's support of MS is ) As someone who is a Sendmail fan, I can agree as well. Exim is an excellent choice when you do not wish to use Sendmail. Personally i _hate_ postfix and I do not understand why it has become to be so popular. But that is a personal preference. The Versions of Sendmail starting from 8.12.8 up are pretty clean and rather secure. Of course there are always tiny issues found since the codebase is simply huge. Sendmail X seems to show that there will be a paradigm change, as it will be more modular and m4 as configuration language will probably die. - -d -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.3.6 (Darwin) iD8DBQFCXimePMoaMn4kKR4RApZ6AJsGspXlJa2r+R+NFrG1B2caJjXtcQCdGHIT W+uSzLR+ye5fLBAGKLVSFts= =bvpG -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 14 09:30:57 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Ugo Bellavance > Sent: den 14 april 2005 02:46 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: netiquette on "wiki" website > > > William Burns wrote: > > What is proper netiquette for this site? > > > > For example, is it ok to do this? > > > http://wiki.mailscanner.info/doku.php?id=documentation:anti_sp > am:rbls:infinite_monkeys > > > > Bear in mind that the wiki is still a work in progress. If > you feel you > can improve the page either in apperance or content, feel > free to do so :). > > > > > Would it be appropriate to add another page for questions > that we feel > > are not answered by the FAQ/MAQ? > > You can send them to the list, or to me if you feel it should be added > to the MAQ. While the MAQ page of the wiki can be edited by > anyone, I'd > appreciate if I could keep the control over it. Couldn't that be done by Jules in the acl.conf file? Shouldn't be too difficult, by the looks of it:-). Rgrds -- Glenn > > How 'bout a "desired features" list? > > Julian won't read all the wiki pages, so better to send them > to the list. > > > > > I noticed that the "upgrade" section is blank. > > What kind of info belongs here? > > > > This is one of my unfinished part :(. What kind of info? > Something in > line with the 'install' part. > > > Should there be a list of MailScanner.conf variables that > got added at > > each version, so that people can see what new configs they > might have to > > deal with when they upgrade through multiple new versions? > > See Julian's post. > > > Should there be a procedure for archiving/removing all old > mailscanner > > files in preparation for a new mailscanner version? > > There is something on this on the MAQ page. > > > Both? > > > > -Bill > > > > Julian Field wrote: > > > >> Currently it is in need of some more content, so I would really > >> appreciate it if you could take a look around and fill in the gaps > >> wherever you have something useful to contribute. > >> > > ... > > > >> *** The Wiki is at http://wiki.mailscanner.info/ > >> > >> Many thanks to Ugo in particular for making this happen. > >> > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 09:42:42 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Upgrade Problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In which case, please can you write it up in the wiki? Clearing out old SpamAssassin installations is definitely useful to other people. Ken Goods wrote: >Julian Field wrote: > > > >>rpm -e spamassassin >>(or whatever name is required to make it remove DAG's rpm). >>Then search /usr/lib/perl5 for any files called *.cf with >>find /usr/lib/perl5 -name '*.cf' -print >>then delete them all. >>And then >>find /usr/lib/perl5 -name 'SpamAssassin.pm' -print >>and delete it, and any files in subdirectories of it that look like >>they are SpamAssassin-related (e.g. called "SpamAssassin" :-) >> >>Then reinstall the rpm again. >> >>Now you should only have 1 version installed, hopefully. >> >> >> > >Got it! Thanks a million Julian. I took notes and think I have my head half >way around what happened. > >Kind regards... > > >Ken Goods >Network Administrator >AIA Insurance, Inc. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 09:43:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Possible BUG with the Script FileType Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please feel free to edit filetype.rules.conf to say whatever you want. Mailing List wrote: >Tested against: >MailScaner 4.38.10 and MailScanner 4.40.11 > >Sending an EPS file thru when the filetype check denies script files >blocks the file. > >My rough guess is that MailScanner parses the output of the file command >and finds the letters "script" and interprets it as such. > ># file Friends\ Fr.eps Friends Fr.eps: DOS EPS Binary File Postscript >starts at byte 32 length 73761 TIFF starts at byte 73793 length 10437 > >Can anyone reproduce this problem? > >Thanks >Guy > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 09:45:51 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Bayes & MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The expiry will still need to be done, it's to do with clearing out old expired tokens that haven't been used in a long time, it's not to do with database implementation. Mike Kercher wrote: >I've got my bayes running with mysql on a few machines and seems to be >working great. MY question is does the bayes rebuild still need to be done >or is it even effective with bayes residing in mysql? > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 14 10:22:32 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: OT: Bitdefender on CentOS4 Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > Sent: den 13 april 2005 20:31 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: OT: Bitdefender on CentOS4 > > > Terran Wright wrote: > > Guys, > > > > Pardon the off topic post however, I tried installing > Bitdefender today > > however I get errors the following errors after the install: > > > > #bdc --update > > BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35) > > Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved. > > > > Error: can't find update dll > > > > # bdc --info > > BDC/Linux-Console v7.0 (build 2490) (i386) (Dec 10 2003 16:11:35) > > Copyright (C) 1996-2003 SOFTWIN SRL. All rights reserved. > > > > Error: core initialization failed: Libfn initialization failed > > > > > > I'm using CentOS 4, > BitDefender-Console-Antivirus-7.0.1-3.linux-gcc3x.i586, > > I read in the Wiki "Since it is a binary distribution, you > might be needing > > some compatibility libraries (ex: FC3/RHEL4 need a > compatibility-libstd++ > > package to run bdc)." Can anybody tell where I can get this? > > > > as anybody seen and resolved this issue? > > > > yum -y install compat-libstdc++-296.i386 compat-libstdc++-33.i386 > > you use yum (or apt) to update your servers.. right? > > - dhawal I've clarified the wiki a bit and added a link to the bdc knowledgebase article (for FC3). Also fixed the bum link to the kb:-). -- Glenn > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ml at NETGROUPES.CA Thu Apr 14 11:35:50 2005 From: ml at NETGROUPES.CA (Mailing List) Date: Thu Jan 12 21:29:19 2006 Subject: Possible BUG with the Script FileType Message-ID: Thanks Julian, I taught you were doing more magic than simply parsing the output, so I added allow postscript - - before the deny script - - and all I now fine Kind regards Guy -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: April 14, 2005 04:43 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Possible BUG with the Script FileType Please feel free to edit filetype.rules.conf to say whatever you want. Mailing List wrote: >Tested against: >MailScaner 4.38.10 and MailScanner 4.40.11 > >Sending an EPS file thru when the filetype check denies script files >blocks the file. > >My rough guess is that MailScanner parses the output of the file command >and finds the letters "script" and interprets it as such. > ># file Friends\ Fr.eps Friends Fr.eps: DOS EPS Binary File Postscript >starts at byte 32 length 73761 TIFF starts at byte 73793 length 10437 > >Can anyone reproduce this problem? > >Thanks >Guy > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 11:48:35 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Possible BUG with the Script FileType Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Good idea. I have added this to the distribution. Thanks for the contribution! (Have you considered buying the book yet?) Mailing List wrote: >Thanks Julian, > >I taught you were doing more magic than simply parsing the output, so I >added >allow postscript - - >before the >deny script - - > >and all I now fine > >Kind regards >Guy > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: April 14, 2005 04:43 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Possible BUG with the Script FileType > >Please feel free to edit filetype.rules.conf to say whatever you want. > >Mailing List wrote: > > > >>Tested against: >>MailScaner 4.38.10 and MailScanner 4.40.11 >> >>Sending an EPS file thru when the filetype check denies script files >>blocks the file. >> >>My rough guess is that MailScanner parses the output of the file >> >> >command > > >>and finds the letters "script" and interprets it as such. >> >># file Friends\ Fr.eps Friends Fr.eps: DOS EPS Binary File Postscript >>starts at byte 32 length 73761 TIFF starts at byte 73793 length 10437 >> >>Can anyone reproduce this problem? >> >>Thanks >>Guy >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From marcel-ml at IRC-ADDICTS.DE Thu Apr 14 12:43:52 2005 From: marcel-ml at IRC-ADDICTS.DE (Marcel Blenkers) Date: Thu Jan 12 21:29:19 2006 Subject: Question regarding Blocked Content Message-ID: Hi there, upgraded yesterday to the latest version. But, i do have the following settings for Virus Scanning: Virus Scanning = %rules-dir%/virus.scanner.rules and within this ruleset, there is a setting for mails to one person with no marcel:/etc/MailScanner # cat rules/virus.scanner.rules # This is where you can build a Spam WhiteList # Addresses matching in here, with the value # "yes" will never be marked as spam. #From: 152.78. yes #From: 130.246. yes To: someuser@someuser.de no FromOrTo: default yes but..suddently the mails to the user got there with blocked content: At Thu Apr 14 12:34:53 2005 the content filters said: MailScanner: Found a form in HTML message how could i stop this behaviour?? The user would like to receive those mails.. Thanks in advance Marcel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joshua.hirsh at PARTNERSOLUTIONS.CA Thu Apr 14 13:07:09 2005 From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Here's a very good wiki netiquette to follow: Comment your changes! ;-) I've noticed that not too many people have commented changes that they've made (these comments show up if you look at previous revisions of the page). Happy editing.. -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 14 13:17:34 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Hirsh, Joshua > Sent: den 14 april 2005 14:07 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: netiquette on "wiki" website > > > Here's a very good wiki netiquette to follow: Comment your > changes! ;-) > > I've noticed that not too many people have commented changes > that they've > made (these comments show up if you look at previous > revisions of the page). On a tangent note Joshue: In the postfix install where you've added a note, could you either make that a footnote or a separate notes section at the end? And your note looks like it'd endorse the old deferred method for a dual postfix setup... That's perhaps not so good. Could you change that or note the possible downside with that approach? I think it'd be best to have this type of thing as a separate section with a bullet list at the bottom. -- Glenn > > > Happy editing.. > > -Joshua > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 13:47:01 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Question regarding Blocked Content Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The Found a Form message is from the dangerous content filtering, not the virus scanning. Marcel Blenkers wrote: >Hi there, > >upgraded yesterday to the latest version. > >But, i do have the following settings for Virus Scanning: > >Virus Scanning = %rules-dir%/virus.scanner.rules > >and within this ruleset, there is a setting for mails to one person with >no > >marcel:/etc/MailScanner # cat rules/virus.scanner.rules ># This is where you can build a Spam WhiteList ># Addresses matching in here, with the value ># "yes" will never be marked as spam. >#From: 152.78. yes >#From: 130.246. yes >To: someuser@someuser.de no >FromOrTo: default yes > > >but..suddently the mails to the user got there with blocked content: > >At Thu Apr 14 12:34:53 2005 the content filters said: > MailScanner: Found a form in HTML message > > >how could i stop this behaviour?? > >The user would like to receive those mails.. > >Thanks in advance > >Marcel > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From joshua.hirsh at PARTNERSOLUTIONS.CA Thu Apr 14 13:54:28 2005 From: joshua.hirsh at PARTNERSOLUTIONS.CA (Hirsh, Joshua) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > On a tangent note Joshue: > In the postfix install where you've added a note, could you either > make that a footnote or a separate notes section at the end? > And your note looks like it'd endorse the old deferred method for > a dual postfix setup... That's perhaps not so good. Could you change > that or note the possible downside with that approach? > > I think it'd be best to have this type of thing as a separate section > with a bullet list at the bottom. > > -- Glenn I never really liked the old deferred method, but rather a hybrid of a dual postfix using the hold method =p I'm moving it now. ;-) -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ggiants81 at gmail.com Thu Apr 14 13:50:58 2005 From: ggiants81 at gmail.com (Joel Andersson) Date: Thu Jan 12 21:29:19 2006 Subject: Newbie Mailscanner / Spamassassin question. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi there. I recently got Mailscanner and Mailwatch running on my freebsd box. It works fairly well but I have two issues. 1. I have the mailq.php script in cron running every 5 minutes. I recevice a php.core everytime I run the script but in mailwatch the mailq is correct , what can I do to fix this.??? 2. The other thing is that I get this message when running the Spamassassin test from mailwatch (or the comman prompt) "lint: 9 issues detected. please rerun with debug enabled for more information." Where can I find information about what's going wrong ???? Oh, I'm running Mailcanner 4.38 spamassassin 3.02 dcc pyzor razor agent 2.61 Tell me what more info you need and i'll provide it. //Regards Joel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 14:12:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Newbie Mailscanner / Spamassassin question. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joel Andersson wrote: >Hi there. >I recently got Mailscanner and Mailwatch running on my freebsd box. >It works fairly well but I have two issues. > >1. I have the mailq.php script in cron running every 5 minutes. I >recevice a php.core everytime I run the script but in mailwatch the >mailq is correct , what can I do to fix this.??? > > This is a MailWatch issue, please ask on the MailWatch list. >2. The other thing is that I get this message when running the >Spamassassin test from mailwatch (or the comman prompt) >"lint: 9 issues detected. please rerun with debug enabled for more information." >Where can I find information about what's going wrong ???? > > When you do the lint, add a "-D" to the command line and it will produce loads of debug output. Check through that to see what's wrong. >Oh, I'm running Mailcanner 4.38 >spamassassin 3.02 >dcc >pyzor >razor agent 2.61 > >Tell me what more info you need and i'll provide it. > >//Regards Joel > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 14:16:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Wiki request: spam bounces Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Can someone please put a page on the Wiki about why bouncing spam is a bad idea and is not the solution to their problem when they are getting a few false alarms from the spam filters. What are the better solutions to this problem, when they think a few of their customers' emails are being flagged as spam? Thanks folks. I've got a particularly awkward case at the moment, and I really don't have the energy to go through the whole thing yet again. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From nlauver at AS.ARIZONA.EDU Thu Apr 14 17:26:47 2005 From: nlauver at AS.ARIZONA.EDU (Neal Lauver) Date: Thu Jan 12 21:29:19 2006 Subject: userpref and white/blacklists in sql database Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello all, I just read the excellent wiki article about using MailScanner and mysql to store the SpamAssassin bayes database. From previous mailing list discussions I was under the (mis?)impression that this required running spamd. Since this is evidently not the case, does this mean that it's also possible to specify something like: user_scores_dsn DBI:mysql:spamassassin:localhost in the /etc/MailScanner/spam.assassin.prefs.conf file to allow per-user spamassassin preferences? If so, is anyone doing this already? Thanks very much, Neal Lauver ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Thu Apr 14 18:26:29 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Take a look in your ~root/.spamassassin directory. Remove any files with > whitelist in their name. > And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the > auto-whitelist functionality. > "man Mail::SpamAssassin::Conf" for more help on what the setting is > called. > When I did the last upgrade seems my spam.assassin.prefs.conf was changed more then I thought. First the path I used for bayes was changed (and lots of spam started getting through, CEO was pissed) and also AWL functionality was turned on. I need to slow down a little when upgrading and really notice the differences. -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 18:35:03 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ed Bruce wrote: > Julian Field wrote: > >> Take a look in your ~root/.spamassassin directory. Remove any files with >> whitelist in their name. >> And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the >> auto-whitelist functionality. >> "man Mail::SpamAssassin::Conf" for more help on what the setting is >> called. >> > When I did the last upgrade seems my spam.assassin.prefs.conf was > changed more then I thought. First the path I used for bayes was changed > (and lots of spam started getting through, CEO was pissed) and also AWL > functionality was turned on. I need to slow down a little when upgrading > and really notice the differences. Something is wrong in that case. The spam.assassin.prefs.conf file should not be overwritten if you have modified it, you should just get a .rpmnew version of it as well. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Thu Apr 14 18:45:48 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Ed Bruce wrote: > > > Julian Field wrote: > > > >> Take a look in your ~root/.spamassassin directory. Remove any files > with > >> whitelist in their name. > >> And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the > >> auto-whitelist functionality. > >> "man Mail::SpamAssassin::Conf" for more help on what the setting is > >> called. > >> > > When I did the last upgrade seems my spam.assassin.prefs.conf was > > changed more then I thought. First the path I used for bayes was changed > > (and lots of spam started getting through, CEO was pissed) and also AWL > > functionality was turned on. I need to slow down a little when upgrading > > and really notice the differences. > > Something is wrong in that case. The spam.assassin.prefs.conf file > should not be overwritten if you have modified it, you should just get a > .rpmnew version of it as well. > I did get the .rpmnew and did a quick diff between it and my file. I didn't notice any great difference, because I was in a hurry, so used the rpmnew, my mistake. Like I said, I need to slow down a little when changing my files. Somewhat offtopic, there was a great gui diff tool with SGI IRIX. Does anybody know of a good GUI based diff for Linux. What I liked about the IRIX one was I could go through the differences and choose from which file to keep. Then when I was done it would save out a new file with all my choices. I tried to get the IRIX version working once, but it didn't use OpenGL. -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Apr 14 18:54:16 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:19 2006 Subject: Wiki request: spam bounces Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Can someone please put a page on the Wiki about why bouncing spam is a > bad idea and is not the solution to their problem when they are getting > a few false alarms from the spam filters. What are the better solutions > to this problem, when they think a few of their customers' emails are > being flagged as spam? > > Thanks folks. I've got a particularly awkward case at the moment, and I > really don't have the energy to go through the whole thing yet again. Julian, ordinarily I'd jump right on this, being a vocal advocate against the bounce feature. However, I'm currently a bit busy with work matters, and I don't expect that to clear up until next week. Some of the information on this page may be of value: http://kmself.home.netcom.com/Rants/avspam.html Most arguments in favor of bouncing spam stem from some idea about "reliable mail". These arguments are of the same sort that argue the need for an open relay because it's necessary so they can mail through their server while traveling, and thus a "reliable mail" necessity. While post-delivery bouncing of spam does offer a reliable recovery from FP, it turns your mailserver into malware that anyone in the world can use as a DDoS client. Just like a wide open mail relay may allow you to send mail while you're traveling, but also allows every spammer in the world to abuse it. Most sensible network admins regard post-delivery bounces of spam, viruses, etc. as a network attack. I personally take this stance, and I handle it the same way I would handle any network attack or intrusion attempt incident. First, try to advise the admin of the problem. If it continues, I blacklist the server and/or domain. If it continues gets bad enough to noticeably effect service here despite the blockade, I've got no reason to ever hesitate to pick up the phone and file a network abuse complaint with the upstream provider. Intentional misconfiguration despite warnings gets handled as an intentional malicious attack, and malicious attacks that degrade service cause incident reports. Thus far I've never had to do that for spam bouncing, however a few domains that are permanently in my 550 list due to spewing malformed bounce garbage on a persistent but small volume basis. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 14 18:55:10 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: netiquette on "wiki" website Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] See your point (actually thought about doing something like that, but... I'm to lazy to change it now:-). Very much better looking now... Thanks. -- Glenn -----Original Message----- From: MailScanner mailing list on behalf of Hirsh, Joshua Sent: to 2005-04-14 14:54 To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: netiquette on "wiki" website > On a tangent note Joshue: > In the postfix install where you've added a note, could you either > make that a footnote or a separate notes section at the end? > And your note looks like it'd endorse the old deferred method for > a dual postfix setup... That's perhaps not so good. Could you change > that or note the possible downside with that approach? > > I think it'd be best to have this type of thing as a separate section > with a bullet list at the bottom. > > -- Glenn I never really liked the old deferred method, but rather a hybrid of a dual postfix using the hold method =p I'm moving it now. ;-) -Joshua ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 18:57:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: Wiki request: spam bounces Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Matt, Many thanks for that. I have cc-ed Steve Swaney on this who may be prepared to write some docs for me about this problem. Matt Kettler wrote: >Julian Field wrote: > > > >>Can someone please put a page on the Wiki about why bouncing spam is a >>bad idea and is not the solution to their problem when they are getting >>a few false alarms from the spam filters. What are the better solutions >>to this problem, when they think a few of their customers' emails are >>being flagged as spam? >> >>Thanks folks. I've got a particularly awkward case at the moment, and I >>really don't have the energy to go through the whole thing yet again. >> >> > > >Julian, ordinarily I'd jump right on this, being a vocal advocate >against the bounce feature. > >However, I'm currently a bit busy with work matters, and I don't expect >that to clear up until next week. > >Some of the information on this page may be of value: >http://kmself.home.netcom.com/Rants/avspam.html > >Most arguments in favor of bouncing spam stem from some idea about >"reliable mail". These arguments are of the same sort that argue the >need for an open relay because it's necessary so they can mail through >their server while traveling, and thus a "reliable mail" necessity. > >While post-delivery bouncing of spam does offer a reliable recovery from >FP, it turns your mailserver into malware that anyone in the world can >use as a DDoS client. Just like a wide open mail relay may allow you to >send mail while you're traveling, but also allows every spammer in the >world to abuse it. > >Most sensible network admins regard post-delivery bounces of spam, >viruses, etc. as a network attack. I personally take this stance, and I >handle it the same way I would handle any network attack or intrusion >attempt incident. First, try to advise the admin of the problem. If it >continues, I blacklist the server and/or domain. If it continues gets >bad enough to noticeably effect service here despite the blockade, I've >got no reason to ever hesitate to pick up the phone and file a network >abuse complaint with the upstream provider. Intentional misconfiguration >despite warnings gets handled as an intentional malicious attack, and >malicious attacks that degrade service cause incident reports. > >Thus far I've never had to do that for spam bouncing, however a few >domains that are permanently in my 550 list due to spewing malformed >bounce garbage on a persistent but small volume basis. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 14 19:15:49 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mandrake... er.... Mandriva (Oh how silly that feels to type) has/had some tool like that specifically for fixing up rpmnew/rpmold files... Seems to be a part of MandrakeUpdate (gtkperl script... perhaps one can borrow:-). Nah. Better look at kdiff3 or xxdiff. At least kdiff3 seems to do what you want. -- Glenn (who oc course don't use these.... The terminal is my first love:-) -----Original Message----- From: MailScanner mailing list on behalf of Ed Bruce Sent: to 2005-04-14 19:45 To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: {Spam?} netiquette on "wiki" website Julian Field wrote: > Ed Bruce wrote: > > > Julian Field wrote: > > > >> Take a look in your ~root/.spamassassin directory. Remove any files > with > >> whitelist in their name. > >> And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the > >> auto-whitelist functionality. > >> "man Mail::SpamAssassin::Conf" for more help on what the setting is > >> called. > >> > > When I did the last upgrade seems my spam.assassin.prefs.conf was > > changed more then I thought. First the path I used for bayes was changed > > (and lots of spam started getting through, CEO was pissed) and also AWL > > functionality was turned on. I need to slow down a little when upgrading > > and really notice the differences. > > Something is wrong in that case. The spam.assassin.prefs.conf file > should not be overwritten if you have modified it, you should just get a > .rpmnew version of it as well. > I did get the .rpmnew and did a quick diff between it and my file. I didn't notice any great difference, because I was in a hurry, so used the rpmnew, my mistake. Like I said, I need to slow down a little when changing my files. Somewhat offtopic, there was a great gui diff tool with SGI IRIX. Does anybody know of a good GUI based diff for Linux. What I liked about the IRIX one was I could go through the differences and choose from which file to keep. Then when I was done it would save out a new file with all my choices. I tried to get the IRIX version working once, but it didn't use OpenGL. -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From TGFurnish at HERFFJONES.COM Thu Apr 14 19:21:28 2005 From: TGFurnish at HERFFJONES.COM (Furnish, Trever G) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] vimdiff? > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Steen, Glenn > Sent: Thursday, April 14, 2005 1:16 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: {Spam?} netiquette on "wiki" website > > > Mandrake... er.... Mandriva (Oh how silly that feels to type) > has/had some tool like that specifically for fixing up > rpmnew/rpmold files... Seems to be a part of MandrakeUpdate > (gtkperl script... perhaps one can borrow:-). Nah. > > Better look at kdiff3 or xxdiff. At least kdiff3 seems to do > what you want. > > -- Glenn (who oc course don't use these.... The terminal is > my first love:-) > > > -----Original Message----- > From: MailScanner mailing list on behalf of Ed Bruce > Sent: to 2005-04-14 19:45 > To: MAILSCANNER@JISCMAIL.AC.UK > Cc: > Subject: Re: {Spam?} netiquette on "wiki" website > Julian Field wrote: > > > Ed Bruce wrote: > > > > > Julian Field wrote: > > > > > >> Take a look in your ~root/.spamassassin directory. > Remove any files > > with > > >> whitelist in their name. > > >> And go into /etc/MailScanner/spam.assassin.prefs.conf > and disable the > > >> auto-whitelist functionality. > > >> "man Mail::SpamAssassin::Conf" for more help on what the > setting is > > >> called. > > >> > > > When I did the last upgrade seems my spam.assassin.prefs.conf was > > > changed more then I thought. First the path I used for > bayes was changed > > > (and lots of spam started getting through, CEO was > pissed) and also AWL > > > functionality was turned on. I need to slow down a little > when upgrading > > > and really notice the differences. > > > > Something is wrong in that case. The spam.assassin.prefs.conf file > > should not be overwritten if you have modified it, you > should just get a > > .rpmnew version of it as well. > > > I did get the .rpmnew and did a quick diff between it and my file. I > didn't notice any great difference, because I was in a hurry, so used > the rpmnew, my mistake. Like I said, I need to slow down a little when > changing my files. > > Somewhat offtopic, there was a great gui diff tool with SGI IRIX. Does > anybody know of a good GUI based diff for Linux. What I liked > about the > IRIX one was I could go through the differences and choose from which > file to keep. Then when I was done it would save out a new > file with all > my choices. I tried to get the IRIX version working once, but > it didn't > use OpenGL. > > -- > This message has been scanned for viruses and > dangerous content by Secure Resource, and is > believed to be clean. > MailScanner thanks transtec Computers for their support. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 19:23:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ah, give me a nice IRIX box any day. Finding all the new versions of configuration files for the packages you have just installed by just typing versions and it lists them all. No hunting .rpmnew files all over the place. No problems with silly little filesystems that have list-based directory structures instead of adaptive tree-based systems. Dynamic relinking so you rarely need to reboot even after library upgrades. Now there's a decent OS. Oh, and you remember the program they used in Jurassic Park where they flew through the filesystem with lots of pillars representing files and directories on different planes and all that? Well it was real, we used to run it. It wasn't fake at all. Ah, now *there's* an OS that rocks. Steen, Glenn wrote: >Mandrake... er.... Mandriva (Oh how silly that feels to type) has/had some tool like that specifically for fixing up rpmnew/rpmold files... Seems to be a part of MandrakeUpdate (gtkperl script... perhaps one can borrow:-). Nah. > >Better look at kdiff3 or xxdiff. At least kdiff3 seems to do what you want. > >-- Glenn (who oc course don't use these.... The terminal is my first love:-) > > >-----Original Message----- >From: MailScanner mailing list on behalf of Ed Bruce >Sent: to 2005-04-14 19:45 >To: MAILSCANNER@JISCMAIL.AC.UK >Cc: >Subject: Re: {Spam?} netiquette on "wiki" website >Julian Field wrote: > > > >>Ed Bruce wrote: >> >> >> >>>Julian Field wrote: >>> >>> >>> >>>>Take a look in your ~root/.spamassassin directory. Remove any files >>>> >>>> >>with >> >> >>>>whitelist in their name. >>>>And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the >>>>auto-whitelist functionality. >>>>"man Mail::SpamAssassin::Conf" for more help on what the setting is >>>>called. >>>> >>>> >>>> >>>When I did the last upgrade seems my spam.assassin.prefs.conf was >>>changed more then I thought. First the path I used for bayes was changed >>>(and lots of spam started getting through, CEO was pissed) and also AWL >>>functionality was turned on. I need to slow down a little when upgrading >>>and really notice the differences. >>> >>> >>Something is wrong in that case. The spam.assassin.prefs.conf file >>should not be overwritten if you have modified it, you should just get a >>.rpmnew version of it as well. >> >> >> >I did get the .rpmnew and did a quick diff between it and my file. I >didn't notice any great difference, because I was in a hurry, so used >the rpmnew, my mistake. Like I said, I need to slow down a little when >changing my files. > >Somewhat offtopic, there was a great gui diff tool with SGI IRIX. Does >anybody know of a good GUI based diff for Linux. What I liked about the >IRIX one was I could go through the differences and choose from which >file to keep. Then when I was done it would save out a new file with all >my choices. I tried to get the IRIX version working once, but it didn't >use OpenGL. > >-- >This message has been scanned for viruses and >dangerous content by Secure Resource, and is >believed to be clean. >MailScanner thanks transtec Computers for their support. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Apr 14 19:30:36 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:19 2006 Subject: Possible BUG with the Script FileType Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mailing List wrote: >Tested against: >MailScaner 4.38.10 and MailScanner 4.40.11 > >Sending an EPS file thru when the filetype check denies script files >blocks the file. > >My rough guess is that MailScanner parses the output of the file command >and finds the letters "script" and interprets it as such. > Since the second field in filetypes.rules.conf is a regular expression "script" will definitely match "Postscript". Regular expressions are by nature a substring search, not an exact match. Ditto applies to filename.rules.conf, which is why you see ^ and $ in most of the rules there, to force it to be a whole-line match on the filename. If you want to avoid the problem in filetypes you can't use the ^ and $ trick, as there's other text on the line. Instead you could change it to \bscript\b, which will require word boundaries. However, you won't match any other all-one-word script names. Another option would be adding an allow word for postscript before the deny rule for script. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sconway at WLNET.COM Thu Apr 14 19:35:27 2005 From: sconway at WLNET.COM (Stephen Conway) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner Scan Subject Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello: Is there a way for MailScanner to automatically tag something as spam based on the subject ? I.e. if subject is : blah blah , then it is spam . If so where do I set this up? Thanks, Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 14 19:49:05 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner Scan Subject Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You need to create a SpamAssassin rule that adds to the spam score of the message. You then use the spam scoring required scores in MailScanner.conf to make your target messages get treated as spam. As an example of a rule, try this: In /etc/MailScanner/spam.assassin.prefs.conf add this: header MYRULE_1 Subject =~ /blah blah/i describe MYRULE_1 The Subject: contains blah blah score MYRULE_1 10.0 Then restart (not just reload) MailScanner service MailScanner restart After that if you get a message whose Subject: header contains "blah blah" in any combination of upper/lower case, 10 points will be added to the spam score of the message. Decide what you want to do with it by using the Spam settings in /etc/MailScanner.conf. For more info about the SpamAssassin rule structure, read "man Mail::SpamAssassin::Conf" and look in the *.cf files which will be in your SpamAssassin installation somewhere, often under /usr/lib/perl5 which you could search with find /usr/lib/perl5 -name '*.cf' -print If you find this helpful, please take a couple of minutes to add it to the wiki documentation website at wiki.mailscanner.info. Stephen Conway wrote: >Is there a way for MailScanner to automatically tag something as spam based >on the subject ? I.e. if subject is : blah blah , then it is spam . If so >where do I set this up? > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 14 20:42:43 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: {Spam?} netiquette on "wiki" website Message-ID: [ The following text is in the "Windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] My pet OS that is actually dead, not just ailing badly, is DG/UX.... gave you true HA solutions without having to buy any extra packages (cf IBM, Sun, ...) and a truly flexible virtual disk manager (LVM-ish thing)... Some might not agree with me (Brandon S Allberry has been known to call it "the DG abomination":-), but I really think the whole industry lost something valuable there. Oh well. Linux does have some mitigating facts... like the price:-). -- Glenn -----Original Message----- From: MailScanner mailing list on behalf of Julian Field Sent: to 2005-04-14 20:23 To: MAILSCANNER@JISCMAIL.AC.UK Cc: Subject: Re: {Spam?} netiquette on "wiki" website Ah, give me a nice IRIX box any day. Finding all the new versions of configuration files for the packages you have just installed by just typing versions and it lists them all. No hunting .rpmnew files all over the place. No problems with silly little filesystems that have list-based directory structures instead of adaptive tree-based systems. Dynamic relinking so you rarely need to reboot even after library upgrades. Now there's a decent OS. Oh, and you remember the program they used in Jurassic Park where they flew through the filesystem with lots of pillars representing files and directories on different planes and all that? Well it was real, we used to run it. It wasn't fake at all. Ah, now *there's* an OS that rocks. Steen, Glenn wrote: >Mandrake... er.... Mandriva (Oh how silly that feels to type) has/had some tool like that specifically for fixing up rpmnew/rpmold files... Seems to be a part of MandrakeUpdate (gtkperl script... perhaps one can borrow:-). Nah. > >Better look at kdiff3 or xxdiff. At least kdiff3 seems to do what you want. > >-- Glenn (who oc course don't use these.... The terminal is my first love:-) > > >-----Original Message----- >From: MailScanner mailing list on behalf of Ed Bruce >Sent: to 2005-04-14 19:45 >To: MAILSCANNER@JISCMAIL.AC.UK >Cc: >Subject: Re: {Spam?} netiquette on "wiki" website >Julian Field wrote: > > > >>Ed Bruce wrote: >> >> >> >>>Julian Field wrote: >>> >>> >>> >>>>Take a look in your ~root/.spamassassin directory. Remove any files >>>> >>>> >>with >> >> >>>>whitelist in their name. >>>>And go into /etc/MailScanner/spam.assassin.prefs.conf and disable the >>>>auto-whitelist functionality. >>>>"man Mail::SpamAssassin::Conf" for more help on what the setting is >>>>called. >>>> >>>> >>>> >>>When I did the last upgrade seems my spam.assassin.prefs.conf was >>>changed more then I thought. First the path I used for bayes was changed >>>(and lots of spam started getting through, CEO was pissed) and also AWL >>>functionality was turned on. I need to slow down a little when upgrading >>>and really notice the differences. >>> >>> >>Something is wrong in that case. The spam.assassin.prefs.conf file >>should not be overwritten if you have modified it, you should just get a >>.rpmnew version of it as well. >> >> >> >I did get the .rpmnew and did a quick diff between it and my file. I >didn't notice any great difference, because I was in a hurry, so used >the rpmnew, my mistake. Like I said, I need to slow down a little when >changing my files. > >Somewhat offtopic, there was a great gui diff tool with SGI IRIX. Does >anybody know of a good GUI based diff for Linux. What I liked about the >IRIX one was I could go through the differences and choose from which >file to keep. Then when I was done it would save out a new file with all >my choices. I tried to get the IRIX version working once, but it didn't >use OpenGL. > >-- >This message has been scanned for viruses and >dangerous content by Secure Resource, and is >believed to be clean. >MailScanner thanks transtec Computers for their support. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 15 08:00:37 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:19 2006 Subject: How do I allow relay through my sendmail? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I cant remember where to add the IP address Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From josephb at gmail.com Fri Apr 15 08:05:34 2005 From: josephb at gmail.com (Joseph Burford) Date: Thu Jan 12 21:29:19 2006 Subject: How do I allow relay through my sendmail? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > I cant remember where to add the IP address /etc/mail/access Remember to: makemap hash /etc/mail/access.db < /etc/mail/access and also restart sendmail. Regards, Joseph ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 15 09:22:55 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:19 2006 Subject: SV: [MAILSCANNER] Newbie Mailscanner / Spamassassin question. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Joel Ok first things first - these are MailWatch issues to do with persmissions on the files in question. Remember the user Apache runs as isn't nescessarily the same that MailScanners runs as.... As for my original request. do the "spamassassin -c etc etc" from the command line and post the FULL output, thatway we can fix any probs before we start worrying about Mailwatch -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Joel Andersson wrote: > Hi there and thanks for your reply. > The things that confuses me are that when I do the Spamassassin Lint from > Mailwatch I get some red and yellow responses... I put the output below. > > This line almost always turns red in mailwatch > "debug: bayes: 46799 tie-ing to DB file R/O > /etc/MailScanner/bayes/bayes_toks 12.49181" > > Of course with different times, but 12-30-60 seconds isn't unusual.. > > These two lines also turns red often ? Why, and what can I do to fix them ? > > debug: running uri tests; score so far=0.126 1.95992 > debug: bayes corpus size: nspam = 2421, nham = 912 8.84662 > > And Razor also takes long time very often : > > debug: Using results from Razor v2.61 3.07085 > > > > -----Ursprungligt meddelande----- > Från: Martin Hepworth [mailto:martinh@solid-state-logic.com] > Skickat: den 14 april 2005 15:17 > Till: Joel Andersson > Ämne: Re: [MAILSCANNER] Newbie Mailscanner / Spamassassin question. > > Joel > > ahh another FreeBSD user - welcome ;-) > > 1. dunno - ask on the MailWatch users list, the main developer and other > s with more php than me hang out there.. > > 2. do a > spamassassin -p /usr/local/etc/MailScanner/spam.assassin.prefs.conf \\ > -D --lint > > (adjust path to spam.assassin.prefs.conf file as required) > > and it will tell the problems - drop the output here if anything confues > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Joel Andersson wrote: > >>Hi there. >>I recently got Mailscanner and Mailwatch running on my freebsd box. >>It works fairly well but I have two issues. >> >>1. I have the mailq.php script in cron running every 5 minutes. I >>recevice a php.core everytime I run the script but in mailwatch the >>mailq is correct , what can I do to fix this.??? >> >>2. The other thing is that I get this message when running the >>Spamassassin test from mailwatch (or the comman prompt) >>"lint: 9 issues detected. please rerun with debug enabled for more > > information." > >>Where can I find information about what's going wrong ???? >> >>Oh, I'm running Mailcanner 4.38 >>spamassassin 3.02 >>dcc >>pyzor >>razor agent 2.61 >> >>Tell me what more info you need and i'll provide it. >> >>//Regards Joel >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From sven at FRAGNET.ORG Fri Apr 15 10:19:32 2005 From: sven at FRAGNET.ORG (Sven) Date: Thu Jan 12 21:29:19 2006 Subject: Problem with MailScanner and ClamAV Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, i got a problem with my MailScanner and ClamAV. I used F-Prot normaly to Scan my Emails. After i noticed that F-Prot doesent detect a special Virus called "HTML.Phishing.Bank-107" i looked for another Scanner and found ClamAV. Now my Problem. ClamAV detects the Virus now. MailScanner also detects this but the Attachment doesent get filtered. If i use Eicar.com in a zipped archive there is no problem,.. I have disabled the File checks so Eicar gets filtered because its a virus and not a executable File or some File ending up with .com Some Entries from my Configfile: MailScanner.conf Silent Viruses = HTML-IFrame All-Viruses Still Deliver Silent Viruses = no and the infos from logfile: Apr 14 08:25:42 linux MailScanner[26476]: New Batch: Scanning 1 messages, 8661 bytes Apr 14 08:25:47 linux MailScanner[26476]: Virus and Content Scanning: Starting Apr 14 08:25:50 linux MailScanner[26476]: /tmp/clamav.26492/clamav-944d9e5c16ead0f4/Phish/OA0_1112672959_NT_MAIL_1/message.txt: HTML.Phishing.Bank-107 FOUND Apr 14 08:25:50 linux MailScanner[26476]: /tmp/clamav.26492/clamav-944d9e5c16ead0f4/Phish/OA1_1112672961_NT_MAIL_1/message.txt: HTML.Phishing.Bank-107 FOUND Apr 14 08:25:50 linux MailScanner[26476]: Virus Scanning: ClamAV found 2 infections Apr 14 08:25:50 linux MailScanner[26476]: Virus Scanning: Found 2 viruses Apr 14 08:25:50 linux MailScanner[26476]: Requeue: 0755CA143.7CF31 to 763B114149 Apr 14 08:25:50 linux MailScanner[26476]: Uninfected: Delivered 1 messages My Versions are: MailScanner: Running on Linux mscan 2.4.21-144-default #1 Fri Nov 14 00:01:36 UTC 2003 i686 i686 i386 GNU/Linux This is SuSE Linux 9.0 (i586) This is Perl version 5.008001 (5.8.1) This is MailScanner version 4.40.11 ClamAV: ClamAV 0.83/830/Thu Apr 14 22:44:31 2005 Im using clamscan and removed clamscand from the System. Hope someone can help me. Regards, Sven ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 12:33:43 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, using portupgrade and the port made by J. Koopman. Before I was running 4.39.6 without any problems, but after the upgrade, MailScanner seems to restart every time it completes a batch, without any errors or calling any Csutom End Functions. I also have MailWatch 0.5.1 installed with the custom MailWatch.pm module in the CustomFunctions directory. Here's a snip from the maillog Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning 1 messages, 4207 bytes Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content Scanning: Starting Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: Delivered 1 messages Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: to=, delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling custom init function MailWatchLogging Apr 15 13:25:26 bsd MailScanner[27513]: Enabling SpamAssassin auto-whitelist functionality... Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 (engine 2.28) recognizing 102051 viruses Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using 180 IDE files Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner using unrar command /usr/local/bin/unrar Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock Otherwise MailScanner is working ok, all ail gets scanned and delivered. Any ideas what might be causing this? Thanks, Adri. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 15 12:47:11 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: Adri you sure this isn't just MS starting all it's children? How many Children should it be starting? have you looked ove the last 30 minutes or so and made sure the processed ID's are being reused in the logs. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > Hi, > > I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, using portupgrade > and the port made by J. Koopman. > Before I was running 4.39.6 without any problems, but after the upgrade, > MailScanner seems to restart every time it completes a batch, without any > errors or calling any Csutom End Functions. > I also have MailWatch 0.5.1 installed with the custom MailWatch.pm module in > the CustomFunctions directory. > Here's a snip from the maillog > > Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning 1 messages, 4207 > bytes > Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content Scanning: Starting > Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: Delivered 1 messages > Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: to=, > delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail Virus Scanner > version > 4.40.11 starting... > Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling custom init function > MailWatchLogging > Apr 15 13:25:26 bsd MailScanner[27513]: Enabling SpamAssassin auto-whitelist > functionality... > Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 (engine 2.28) > recognizing 102051 viruses > Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using 180 IDE files > Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner using unrar command > /usr/local/bin/unrar > Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > > Otherwise MailScanner is working ok, all ail gets scanned and delivered. > Any ideas what might be causing this? > Thanks, > > Adri. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 12:59:30 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, I can see MS starting all it's children (3 in my configuration) on the install startup. Then after each batch, MS delivers the messages and I can see it restarting, using a different PID each time. Checking the previous child seems to have died, since I only see 3 mailscanner processes in ps/top. Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 15 April, 2005 13:47 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Adri > > you sure this isn't just MS starting all it's children? How many > Children should it be starting? > > have you looked ove the last 30 minutes or so and made sure the > processed ID's are being reused in the logs. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > Hi, > > > > I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > using portupgrade > > and the port made by J. Koopman. > > Before I was running 4.39.6 without any problems, but after > the upgrade, > > MailScanner seems to restart every time it completes a > batch, without any > > errors or calling any Csutom End Functions. > > I also have MailWatch 0.5.1 installed with the custom > MailWatch.pm module in > > the CustomFunctions directory. > > Here's a snip from the maillog > > > > Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > 1 messages, 4207 > > bytes > > Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > Scanning: Starting > > Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > Delivered 1 messages > > Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > to=, > > delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > > relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > > Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > Virus Scanner > > version > > 4.40.11 starting... > > Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > custom init function > > MailWatchLogging > > Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > SpamAssassin auto-whitelist > > functionality... > > Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > (engine 2.28) > > recognizing 102051 viruses > > Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > 180 IDE files > > Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > using unrar command > > /usr/local/bin/unrar > > Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > > > > Otherwise MailScanner is working ok, all ail gets scanned > and delivered. > > Any ideas what might be causing this? > > Thanks, > > > > Adri. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 15 13:07:31 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: Adri is logging to the mysql DB for Mailwatch OK?? What happens if you take out the Call to MailWatch.PM in "Always Looked Up Last" -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > Martin, > > I can see MS starting all it's children (3 in my configuration) on the > install startup. > Then after each batch, MS delivers the messages and I can see it restarting, > using a different PID each time. > Checking the previous child seems to have died, since I only see 3 > mailscanner processes in ps/top. > > Adri. > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: 15 April, 2005 13:47 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner 4.40.11 restarting after every batch >> >> >>Adri >> >>you sure this isn't just MS starting all it's children? How many >>Children should it be starting? >> >>have you looked ove the last 30 minutes or so and made sure the >>processed ID's are being reused in the logs. >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Adri Koppes wrote: >> >>>Hi, >>> >>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, >> >>using portupgrade >> >>>and the port made by J. Koopman. >>>Before I was running 4.39.6 without any problems, but after >> >>the upgrade, >> >>>MailScanner seems to restart every time it completes a >> >>batch, without any >> >>>errors or calling any Csutom End Functions. >>>I also have MailWatch 0.5.1 installed with the custom >> >>MailWatch.pm module in >> >>>the CustomFunctions directory. >>>Here's a snip from the maillog >>> >>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning >> >>1 messages, 4207 >> >>>bytes >>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content >> >>Scanning: Starting >> >>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: >> >>Delivered 1 messages >> >>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: >> >>to=, >> >>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, >>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) >>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail >> >>Virus Scanner >> >>>version >>> 4.40.11 starting... >>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling >> >>custom init function >> >>>MailWatchLogging >>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling >> >>SpamAssassin auto-whitelist >> >>>functionality... >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 >> >>(engine 2.28) >> >>>recognizing 102051 viruses >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using >> >>180 IDE files >> >>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner >> >>using unrar command >> >>>/usr/local/bin/unrar >>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock >>> >>>Otherwise MailScanner is working ok, all ail gets scanned >> >>and delivered. >> >>>Any ideas what might be causing this? >>>Thanks, >>> >>>Adri. >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 15 13:17:11 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > Sent: den 15 april 2005 14:08 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Adri > > is logging to the mysql DB for Mailwatch OK?? > > What happens if you take out the Call to MailWatch.PM in > "Always Looked > Up Last" I'm a bit confused... Do you use Walkers modified MailWatch.pm Adri? -- Glenn > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > Martin, > > > > I can see MS starting all it's children (3 in my > configuration) on the > > install startup. > > Then after each batch, MS delivers the messages and I can > see it restarting, > > using a different PID each time. > > Checking the previous child seems to have died, since I only see 3 > > mailscanner processes in ps/top. > > > > Adri. > > > > > >>-----Original Message----- > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>Sent: 15 April, 2005 13:47 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Adri > >> > >>you sure this isn't just MS starting all it's children? How many > >>Children should it be starting? > >> > >>have you looked ove the last 30 minutes or so and made sure the > >>processed ID's are being reused in the logs. > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Adri Koppes wrote: > >> > >>>Hi, > >>> > >>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >> > >>using portupgrade > >> > >>>and the port made by J. Koopman. > >>>Before I was running 4.39.6 without any problems, but after > >> > >>the upgrade, > >> > >>>MailScanner seems to restart every time it completes a > >> > >>batch, without any > >> > >>>errors or calling any Csutom End Functions. > >>>I also have MailWatch 0.5.1 installed with the custom > >> > >>MailWatch.pm module in > >> > >>>the CustomFunctions directory. > >>>Here's a snip from the maillog > >>> > >>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >> > >>1 messages, 4207 > >> > >>>bytes > >>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >> > >>Scanning: Starting > >> > >>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >> > >>Delivered 1 messages > >> > >>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >> > >>to=, > >> > >>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > >>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > >>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >> > >>Virus Scanner > >> > >>>version > >>> 4.40.11 starting... > >>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >> > >>custom init function > >> > >>>MailWatchLogging > >>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >> > >>SpamAssassin auto-whitelist > >> > >>>functionality... > >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >> > >>(engine 2.28) > >> > >>>recognizing 102051 viruses > >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >> > >>180 IDE files > >> > >>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >> > >>using unrar command > >> > >>>/usr/local/bin/unrar > >>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > >>> > >>>Otherwise MailScanner is working ok, all ail gets scanned > >> > >>and delivered. > >> > >>>Any ideas what might be causing this? > >>>Thanks, > >>> > >>>Adri. > >>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been swept > >>for the presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > > > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ggiants81 at GMAIL.COM Fri Apr 15 13:21:51 2005 From: ggiants81 at GMAIL.COM (Joel Andersson) Date: Thu Jan 12 21:29:19 2006 Subject: SV: SV: [MAILSCANNER] Newbie Mailscanner / Spamassassin question. Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ok, sorry for beeing inpatient.. Here's what I get. When I do : spamassassin -D --lint -p /usr/local/etc/MailScanner/spam.assassin.prefs.conf I get this output . I don't really know what's wrong ? debug: SpamAssassin version 3.0.2 debug: Score set 0 chosen. debug: running in taint mode? yes debug: Running in taint mode, removing unsafe env vars, and resetting PATH debug: PATH included '/sbin', keeping. debug: PATH included '/bin', keeping. debug: PATH included '/usr/sbin', keeping. debug: PATH included '/usr/bin', keeping. debug: PATH included '/usr/games', keeping. debug: PATH included '/usr/local/sbin', keeping. debug: PATH included '/usr/local/bin', keeping. debug: PATH included '/usr/X11R6/bin', keeping. debug: PATH included '/root/bin', which doesn't exist, dropping. debug: Final PATH set to: /sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr /X11R6/bin debug: diag: module installed: DBI, version 1.42 debug: diag: module installed: DB_File, version 1.809 debug: diag: module installed: Digest::SHA1, version 2.10 debug: diag: module installed: IO::Socket::UNIX, version 1.21 debug: diag: module installed: MIME::Base64, version 3.03 debug: diag: module installed: Net::DNS, version 0.48 debug: diag: module not installed: Net::LDAP ('require' failed) debug: diag: module installed: Razor2::Client::Agent, version 2.61 debug: diag: module installed: Storable, version 2.13 debug: diag: module installed: URI, version 1.31 debug: ignore: using a test message to lint rules debug: using "/usr/local/share/spamassassin" for default rules dir debug: config: read file /usr/local/share/spamassassin/10_misc.cf debug: config: read file /usr/local/share/spamassassin/20_anti_ratware.cf debug: config: read file /usr/local/share/spamassassin/20_body_tests.cf debug: config: read file /usr/local/share/spamassassin/20_compensate.cf debug: config: read file /usr/local/share/spamassassin/20_dnsbl_tests.cf debug: config: read file /usr/local/share/spamassassin/20_drugs.cf debug: config: read file /usr/local/share/spamassassin/20_fake_helo_tests.cf debug: config: read file /usr/local/share/spamassassin/20_head_tests.cf debug: config: read file /usr/local/share/spamassassin/20_html_tests.cf debug: config: read file /usr/local/share/spamassassin/20_meta_tests.cf debug: config: read file /usr/local/share/spamassassin/20_phrases.cf debug: config: read file /usr/local/share/spamassassin/20_porn.cf debug: config: read file /usr/local/share/spamassassin/20_ratware.cf debug: config: read file /usr/local/share/spamassassin/20_uri_tests.cf debug: config: read file /usr/local/share/spamassassin/23_bayes.cf debug: config: read file /usr/local/share/spamassassin/25_body_tests_es.cf debug: config: read file /usr/local/share/spamassassin/25_hashcash.cf debug: config: read file /usr/local/share/spamassassin/25_spf.cf debug: config: read file /usr/local/share/spamassassin/25_uribl.cf debug: config: read file /usr/local/share/spamassassin/30_text_de.cf debug: config: read file /usr/local/share/spamassassin/30_text_fr.cf debug: config: read file /usr/local/share/spamassassin/30_text_nl.cf debug: config: read file /usr/local/share/spamassassin/30_text_pl.cf debug: config: read file /usr/local/share/spamassassin/50_scores.cf debug: config: read file /usr/local/share/spamassassin/60_whitelist.cf debug: using "/usr/local/etc/mail/spamassassin" for site rules dir debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_adult.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_bayes_poison_nxm.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_evilnum0.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_html.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_oem.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_random.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_ratware.cf debug: config: read file /usr/local/etc/mail/spamassassin/70_sare_spoof.cf debug: config: read file /usr/local/etc/mail/spamassassin/72_sare_bml_post25x.cf debug: config: read file /usr/local/etc/mail/spamassassin/99_FVGT_Tripwire.cf debug: config: read file /usr/local/etc/mail/spamassassin/99_sare_fraud_post25x.cf debug: config: read file /usr/local/etc/mail/spamassassin/antidrug.cf debug: config: read file /usr/local/etc/mail/spamassassin/bigevil.cf debug: using "/root/.spamassassin" for user state dir debug: using "/usr/local/etc/MailScanner/spam.assassin.prefs.conf" for user prefs file debug: config: read file /usr/local/etc/MailScanner/spam.assassin.prefs.conf debug: bayes: 65918 tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_toks debug: bayes: 65918 tie-ing to DB file R/O /etc/MailScanner/bayes/bayes_seen debug: bayes: found bayes db version 3 debug: Score set 3 chosen. debug: ---- MIME PARSER START ---- debug: main message type: text/plain debug: parsing normal part debug: added part, type: text/plain debug: ---- MIME PARSER END ---- debug: metadata: X-Spam-Relays-Trusted: debug: metadata: X-Spam-Relays-Untrusted: debug: is Net::DNS::Resolver available? yes debug: Net::DNS version: 0.48 debug: trying (3) sun.com... debug: looking up NS for 'sun.com' debug: NS lookup of sun.com succeeded => Dns available (set dns_available to hardcode) debug: is DNS available? 1 debug: all '*From' addrs: ignore@compiling.spamassassin.taint.org debug: decoding: no encoding detected debug: Running tests for priority: 0 debug: running header regexp tests; score so far=0 debug: all '*To' addrs: debug: running body-text per-line regexp tests; score so far=0.126 debug: running uri tests; score so far=0.126 debug: running uri tests; score so far=0.126 debug: bayes corpus size: nspam = 2423, nham = 935 debug: tokenize: header tokens for *F = "U*ignore D*compiling.spamassassin.taint.org D*spamassassin.taint.org D*taint.org D*org" debug: tokenize: header tokens for *m = " 1113567354 lint_rules " debug: tokenize: header tokens for *RT = " " debug: tokenize: header tokens for *RU = " " debug: bayes token 'H*Ad:D*org' => 0.0742240426747952 debug: bayes: score = 0.176331795012204 debug: bayes: 65918 untie-ing debug: bayes: 65918 untie-ing db_toks debug: bayes: 65918 untie-ing db_seen debug: Razor2 is available debug: entering helper-app run mode Razor-Log: Computed razorhome from env: /root/.razor Razor-Log: No razorhome found, using all defaults Razor-Log: No razor-agent.conf found, using defaults. Apr 15 14:16:24.082185 check[65918]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout Apr 15 14:16:24.083887 check[65918]: [ 5] computed razorhome=, conf=, ident=identity Apr 15 14:16:24.085176 check[65918]: [ 8] Client supported_engines: 4 8 Apr 15 14:16:24.087409 check[65918]: [ 8] prep_mail done: mail 1 headers=93, mime0=1376 Apr 15 14:16:24.088890 check[65918]: [ 7] Can't read file servers.discovery.lst, looking relatve to Apr 15 14:16:24.089852 check[65918]: [ 5] Can't read file /servers.discovery.lst: No such file or directory Apr 15 14:16:24.090716 check[65918]: [ 7] Can't read file servers.nomination.lst, looking relatve to Apr 15 14:16:24.091762 check[65918]: [ 5] Can't read file /servers.nomination.lst: No such file or directory Apr 15 14:16:24.092701 check[65918]: [ 7] Can't read file servers.catalogue.lst, looking relatve to Apr 15 14:16:24.093584 check[65918]: [ 5] Can't read file /servers.catalogue.lst: No such file or directory Apr 15 14:16:24.094897 check[65918]: [ 5] no listfile: servers.catalogue.lst Apr 15 14:16:24.096021 check[65918]: [ 6] no discovery listfile: servers.discovery.lst Apr 15 14:16:24.096793 check[65918]: [ 5] Finding Discovery Servers via DNS in the razor2.cloudmark.com zone Apr 15 14:16:24.124587 check[65918]: [ 6] Found 1 Discovery Servers via DNS in the razor2.cloudmark.com zone Apr 15 14:16:24.125420 check[65918]: [ 8] Checking with Razor Discovery Server 66.151.150.12 Apr 15 14:16:24.126021 check[65918]: [ 6] No port specified, using 2703 Apr 15 14:16:24.126473 check[65918]: [ 5] Connecting to 66.151.150.12 ... Apr 15 14:16:24.486774 check[65918]: [ 8] Connection established Apr 15 14:16:24.487880 check[65918]: [ 4] 66.151.150.12 >> 35 server greeting: sn=D&srl=489&a=l&a=cg&ep4=7542-10 Apr 15 14:16:24.488794 check[65918]: [ 4] 66.151.150.12 << 12 Apr 15 14:16:24.489306 check[65918]: [ 6] a=g&pm=csl Apr 15 14:16:24.670987 check[65918]: [ 4] 66.151.150.12 >> 32 Apr 15 14:16:24.671780 check[65918]: [ 6] response to sent.1 -csl=? shock.cloudmark.com . Apr 15 14:16:24.675861 check[65918]: [ 8] Discovery Server 66.151.150.12 replying with csl=shock.cloudmark.com Apr 15 14:16:24.676651 check[65918]: [ 4] 66.151.150.12 << 12 Apr 15 14:16:24.677153 check[65918]: [ 6] a=g&pm=nsl Apr 15 14:16:24.858939 check[65918]: [ 4] 66.151.150.12 >> 51 Apr 15 14:16:24.859617 check[65918]: [ 6] response to sent.2 -nsl=? folly.cloudmark.com joy.cloudmark.com . Apr 15 14:16:24.860902 check[65918]: [ 8] Discovery Server 66.151.150.12 replying with nsl=folly.cloudmark.com Apr 15 14:16:24.861471 check[65918]: [ 8] Discovery Server 66.151.150.12 replying with nsl=joy.cloudmark.com Apr 15 14:16:24.862529 check[65918]: [ 5] no razorhome, not caching server info to disk Apr 15 14:16:24.863358 check[65918]: [ 6] losing old server connection, 66.151.150.12, for new server, shock.cloudmark.com Apr 15 14:16:24.863906 check[65918]: [ 5] disconnecting from server 66.151.150.12 Apr 15 14:16:24.864711 check[65918]: [ 4] 66.151.150.12 << 5 Apr 15 14:16:24.865195 check[65918]: [ 6] a=q Apr 15 14:16:24.865898 check[65918]: [ 5] Connecting to shock.cloudmark.com ... Apr 15 14:16:25.239527 check[65918]: [ 8] Connection established Apr 15 14:16:25.240395 check[65918]: [ 4] shock.cloudmark.com >> 36 server greeting: sn=C&srl=5069&a=l&a=cg&ep4=7542-10 Apr 15 14:16:25.241679 check[65918]: [ 4] shock.cloudmark.com << 25 Apr 15 14:16:25.242256 check[65918]: [ 6] cn=razor-agents&cv=2.61 Apr 15 14:16:25.243061 check[65918]: [ 4] shock.cloudmark.com << 14 Apr 15 14:16:25.243684 check[65918]: [ 6] a=g&pm=state Apr 15 14:16:25.666670 check[65918]: [ 4] shock.cloudmark.com >> 144 Apr 15 14:16:25.667322 check[65918]: [ 6] response to sent.5 -sv=3.54 sn=C zone=razor2.cloudmark.com ac=6 srl=5069 lm=4 bql=50 bqs=129 dre=4 se=C8 srf=FF ep4=7542-10 ep8=20 ep10=5 crt=90 . Apr 15 14:16:25.672826 check[65918]: [ 5] Updated to new server state srl 5069 for server shock.cloudmark.com Apr 15 14:16:25.673717 check[65918]: [ 6] shock.cloudmark.com is a Catalogue Server srl 5069; computed min_cf=6, Server se: C8 Apr 15 14:16:25.674551 check[65918]: [ 8] Computed supported_engines: 4 8 Apr 15 14:16:25.675102 check[65918]: [ 5] no razorhome, not caching server info to disk Apr 15 14:16:25.675548 check[65918]: [ 5] srl was updated, forcing discovery ... Apr 15 14:16:25.676126 check[65918]: [ 5] no listfile: servers.catalogue.lst Apr 15 14:16:25.676823 check[65918]: [ 8] already have 1 discovery servers Apr 15 14:16:25.677328 check[65918]: [ 8] Checking with Razor Discovery Server 66.151.150.12 Apr 15 14:16:25.678032 check[65918]: [ 6] losing old server connection, shock.cloudmark.com, for new server, 66.151.150.12 Apr 15 14:16:25.678636 check[65918]: [ 5] disconnecting from server shock.cloudmark.com Apr 15 14:16:25.679343 check[65918]: [ 4] shock.cloudmark.com << 5 Apr 15 14:16:25.679823 check[65918]: [ 6] a=q Apr 15 14:16:25.680543 check[65918]: [ 5] Connecting to 66.151.150.12 ... Apr 15 14:16:26.041040 check[65918]: [ 8] Connection established Apr 15 14:16:26.041768 check[65918]: [ 4] 66.151.150.12 >> 35 server greeting: sn=D&srl=489&a=l&a=cg&ep4=7542-10 Apr 15 14:16:26.042574 check[65918]: [ 4] 66.151.150.12 << 12 Apr 15 14:16:26.043071 check[65918]: [ 6] a=g&pm=csl Apr 15 14:16:26.225838 check[65918]: [ 4] 66.151.150.12 >> 32 Apr 15 14:16:26.226451 check[65918]: [ 6] response to sent.7 -csl=? shock.cloudmark.com . Apr 15 14:16:26.227559 check[65918]: [ 8] Discovery Server 66.151.150.12 replying with csl=shock.cloudmark.com Apr 15 14:16:26.228359 check[65918]: [ 4] 66.151.150.12 << 12 Apr 15 14:16:26.229027 check[65918]: [ 6] a=g&pm=nsl Apr 15 14:16:26.411204 check[65918]: [ 4] 66.151.150.12 >> 51 Apr 15 14:16:26.411796 check[65918]: [ 6] response to sent.8 -nsl=? joy.cloudmark.com folly.cloudmark.com . Apr 15 14:16:26.415459 check[65918]: [ 8] Discovery Server 66.151.150.12 replying with nsl=joy.cloudmark.com Apr 15 14:16:26.416014 check[65918]: [ 8] Discovery Server 66.151.150.12 replying with nsl=folly.cloudmark.com Apr 15 14:16:26.416953 check[65918]: [ 5] no razorhome, not caching server info to disk Apr 15 14:16:26.417776 check[65918]: [ 5] no razorhome, not caching server info to disk Apr 15 14:16:26.418434 check[65918]: [ 8] Using next closest server shock.cloudmark.com:2703, cached info srl 5069 Apr 15 14:16:26.419063 check[65918]: [ 8] mail 1 has no subject Apr 15 14:16:26.420126 check[65918]: [ 6] preproc: mail 1.0 went from 1376 bytes to 1339 Apr 15 14:16:26.420936 check[65918]: [ 6] computing sigs for mail 1.0, len 1339 Apr 15 14:16:26.426751 check[65918]: [ 6] Engine (8) didn't produce a signature for mail 1.0 Apr 15 14:16:26.427659 check[65918]: [ 6] skipping whitelist file (empty?): razor-whitelist Apr 15 14:16:26.428260 check[65918]: [ 6] losing old server connection, 66.151.150.12, for new server, shock.cloudmark.com Apr 15 14:16:26.428740 check[65918]: [ 5] disconnecting from server 66.151.150.12 Apr 15 14:16:26.429409 check[65918]: [ 4] 66.151.150.12 << 5 Apr 15 14:16:26.429990 check[65918]: [ 6] a=q Apr 15 14:16:26.430630 check[65918]: [ 5] Connecting to shock.cloudmark.com ... Apr 15 14:16:26.828422 check[65918]: [ 8] Connection established Apr 15 14:16:26.829308 check[65918]: [ 4] shock.cloudmark.com >> 36 server greeting: sn=C&srl=5069&a=l&a=cg&ep4=7542-10 Apr 15 14:16:26.830577 check[65918]: [ 4] shock.cloudmark.com << 25 Apr 15 14:16:26.831104 check[65918]: [ 6] cn=razor-agents&cv=2.61 Apr 15 14:16:26.832069 check[65918]: [ 6] shock.cloudmark.com is a Catalogue Server srl 5069; computed min_cf=6, Server se: C8 Apr 15 14:16:26.832892 check[65918]: [ 8] Computed supported_engines: 4 8 Apr 15 14:16:26.833715 check[65918]: [ 8] mail 1.0 e4 sig: xFaZIZUVHk90OQfARnenjx5BZTMA Apr 15 14:16:26.834410 check[65918]: [ 5] mail 1.0 e8 got no sig Apr 15 14:16:26.835005 check[65918]: [ 8] preparing 1 queries Apr 15 14:16:26.835929 check[65918]: [ 8] sending 1 batches Apr 15 14:16:26.836713 check[65918]: [ 4] shock.cloudmark.com << 52 Apr 15 14:16:26.837342 check[65918]: [ 6] a=c&e=4&ep4=7542-10&s=xFaZIZUVHk90OQfARnenjx5BZTMA Apr 15 14:16:27.361709 check[65918]: [ 4] shock.cloudmark.com >> 5 Apr 15 14:16:27.362375 check[65918]: [ 6] response to sent.11 p=0 Apr 15 14:16:27.363695 check[65918]: [ 6] mail 1.0 e=4 sig=xFaZIZUVHk90OQfARnenjx5BZTMA: sig not found. Apr 15 14:16:27.364325 check[65918]: [ 7] method 4: mail 1.0: no-contention part, spam=0 Apr 15 14:16:27.365070 check[65918]: [ 7] method 4: mail 1: all non-contention parts not spam, mail not spam Apr 15 14:16:27.365565 check[65918]: [ 3] mail 1 is not known spam. Apr 15 14:16:27.366027 check[65918]: [ 5] disconnecting from server shock.cloudmark.com Apr 15 14:16:27.366827 check[65918]: [ 4] shock.cloudmark.com << 5 Apr 15 14:16:27.367322 check[65918]: [ 6] a=q debug: Using results from Razor v2.61 debug: Found Razor2 part: part=0 engine=4 ct=0 cf=0 debug: leaving helper-app run mode debug: Razor2 results: spam? 0 highest cf score: 0 debug: running raw-body-text per-line regexp tests; score so far=-1.825 debug: running full-text regexp tests; score so far=-1.825 debug: Razor2 is available debug: Current PATH is: /sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr /X11R6/bin debug: executable for pyzor was found at /usr/local/bin/pyzor debug: Pyzor is available: /usr/local/bin/pyzor debug: entering helper-app run mode debug: setuid: helper proc 65919: ruid=0 euid=0 debug: Pyzor: got response: 66.250.40.33:24441 (200, 'OK') 0 0 debug: leaving helper-app run mode debug: DCCifd is not available: no r/w dccifd socket found. debug: DCC is available: /usr/local/bin/dccproc debug: entering helper-app run mode debug: setuid: helper proc 65920: ruid=0 euid=0 debug: DCC: got response: X-DCC--Metrics: gatekeeper.advance.se 1074; Body=19195 Fuz1=2951794 Fuz2=2951789 debug: leaving helper-app run mode debug: DCC: Listed! BODY: 19195 of 999999 FUZ1: 2951794 of 999999 FUZ2: 2951789 of 999999 debug: Running tests for priority: 500 debug: RBL: success for 1 of 1 queries debug: running meta tests; score so far=0.344 debug: running header regexp tests; score so far=1.57 debug: running body-text per-line regexp tests; score so far=1.57 debug: running uri tests; score so far=1.57 debug: running raw-body-text per-line regexp tests; score so far=1.57 debug: running full-text regexp tests; score so far=1.57 debug: Running tests for priority: 1000 debug: running meta tests; score so far=1.57 debug: running header regexp tests; score so far=1.57 debug: using "/root/.spamassassin" for user state dir debug: lock: 65918 created /root/.spamassassin/auto-whitelist.mutex debug: lock: 65918 trying to get lock on /root/.spamassassin/auto-whitelist with 30 timeout debug: lock: 65918 link to /root/.spamassassin/auto-whitelist.mutex: link ok debug: Tie-ing to DB file R/W in /root/.spamassassin/auto-whitelist debug: auto-whitelist (db-based): ignore@compiling.spamassassin.taint.org|ip=none scores 0/0 debug: AWL active, pre-score: 1.57, autolearn score: 1.57, mean: undef, IP: undef debug: DB addr list: untie-ing and unlocking. debug: DB addr list: file locked, breaking lock. debug: unlock: 65918 unlocked /root/.spamassassin/auto-whitelist.mutex debug: Post AWL score: 1.57 debug: running body-text per-line regexp tests; score so far=1.57 debug: running uri tests; score so far=1.57 debug: running raw-body-text per-line regexp tests; score so far=1.57 debug: running full-text regexp tests; score so far=1.57 debug: is spam? score=1.57 required=5 debug: tests=BAYES_20,DCC_CHECK,MISSING_HEADERS,MISSING_SUBJECT,NO_REAL_NAME debug: subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__SANE_MSGID,__SARE_H TML_HAS_MSG,__UNUSABLE_MSGID //Joel -----Ursprungligt meddelande----- Från: Martin Hepworth [mailto:martinh@solid-state-logic.com] Skickat: den 15 april 2005 10:23 Till: Joel Andersson; MailScanner mailing list Ämne: Re: SV: [MAILSCANNER] Newbie Mailscanner / Spamassassin question. Joel Ok first things first - these are MailWatch issues to do with persmissions on the files in question. Remember the user Apache runs as isn't nescessarily the same that MailScanners runs as.... As for my original request. do the "spamassassin -c etc etc" from the command line and post the FULL output, thatway we can fix any probs before we start worrying about Mailwatch -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Joel Andersson wrote: > Hi there and thanks for your reply. > The things that confuses me are that when I do the Spamassassin Lint from > Mailwatch I get some red and yellow responses... I put the output below. > > This line almost always turns red in mailwatch > "debug: bayes: 46799 tie-ing to DB file R/O > /etc/MailScanner/bayes/bayes_toks 12.49181" > > Of course with different times, but 12-30-60 seconds isn't unusual.. > > These two lines also turns red often ? Why, and what can I do to fix them ? > > debug: running uri tests; score so far=0.126 1.95992 > debug: bayes corpus size: nspam = 2421, nham = 912 8.84662 > > And Razor also takes long time very often : > > debug: Using results from Razor v2.61 3.07085 > > > > -----Ursprungligt meddelande----- > Från: Martin Hepworth [mailto:martinh@solid-state-logic.com] > Skickat: den 14 april 2005 15:17 > Till: Joel Andersson > Ämne: Re: [MAILSCANNER] Newbie Mailscanner / Spamassassin question. > > Joel > > ahh another FreeBSD user - welcome ;-) > > 1. dunno - ask on the MailWatch users list, the main developer and other > s with more php than me hang out there.. > > 2. do a > spamassassin -p /usr/local/etc/MailScanner/spam.assassin.prefs.conf \\ > -D --lint > > (adjust path to spam.assassin.prefs.conf file as required) > > and it will tell the problems - drop the output here if anything confues > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Joel Andersson wrote: > >>Hi there. >>I recently got Mailscanner and Mailwatch running on my freebsd box. >>It works fairly well but I have two issues. >> >>1. I have the mailq.php script in cron running every 5 minutes. I >>recevice a php.core everytime I run the script but in mailwatch the >>mailq is correct , what can I do to fix this.??? >> >>2. The other thing is that I get this message when running the >>Spamassassin test from mailwatch (or the comman prompt) >>"lint: 9 issues detected. please rerun with debug enabled for more > > information." > >>Where can I find information about what's going wrong ???? >> >>Oh, I'm running Mailcanner 4.38 >>spamassassin 3.02 >>dcc >>pyzor >>razor agent 2.61 >> >>Tell me what more info you need and i'll provide it. >> >>//Regards Joel >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 13:26:44 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Glenn. I am using the original MailWatch.pm from 0.5.1. Still using the old p5-DBD-mysql-2.1026_1 module for connection to mysql 4.1. This was working fine using MS 4.39.6. I have just disabled MailWatch (Always Lookup Last commented out) and now it's working fine without MailWatch! No restarts since the last 10 min. Adri. > -----Original Message----- > From: Steen, Glenn [mailto:Glenn.Steen@AP1.SE] > Sent: 15 April, 2005 14:17 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > > Sent: den 15 april 2005 14:08 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > > > > Adri > > > > is logging to the mysql DB for Mailwatch OK?? > > > > What happens if you take out the Call to MailWatch.PM in > > "Always Looked > > Up Last" > > I'm a bit confused... Do you use Walkers modified MailWatch.pm Adri? > > -- Glenn > > > -- > > Martin Hepworth > > Snr Systems Administrator > > Solid State Logic > > Tel: +44 (0)1865 842300 > > > > > > Adri Koppes wrote: > > > Martin, > > > > > > I can see MS starting all it's children (3 in my > > configuration) on the > > > install startup. > > > Then after each batch, MS delivers the messages and I can > > see it restarting, > > > using a different PID each time. > > > Checking the previous child seems to have died, since I only see 3 > > > mailscanner processes in ps/top. > > > > > > Adri. > > > > > > > > >>-----Original Message----- > > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > > >>Sent: 15 April, 2005 13:47 > > >>To: MAILSCANNER@JISCMAIL.AC.UK > > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > > >> > > >> > > >>Adri > > >> > > >>you sure this isn't just MS starting all it's children? How many > > >>Children should it be starting? > > >> > > >>have you looked ove the last 30 minutes or so and made sure the > > >>processed ID's are being reused in the logs. > > >> > > >>-- > > >>Martin Hepworth > > >>Snr Systems Administrator > > >>Solid State Logic > > >>Tel: +44 (0)1865 842300 > > >> > > >> > > >>Adri Koppes wrote: > > >> > > >>>Hi, > > >>> > > >>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > > >> > > >>using portupgrade > > >> > > >>>and the port made by J. Koopman. > > >>>Before I was running 4.39.6 without any problems, but after > > >> > > >>the upgrade, > > >> > > >>>MailScanner seems to restart every time it completes a > > >> > > >>batch, without any > > >> > > >>>errors or calling any Csutom End Functions. > > >>>I also have MailWatch 0.5.1 installed with the custom > > >> > > >>MailWatch.pm module in > > >> > > >>>the CustomFunctions directory. > > >>>Here's a snip from the maillog > > >>> > > >>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > > >> > > >>1 messages, 4207 > > >> > > >>>bytes > > >>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > > >> > > >>Scanning: Starting > > >> > > >>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > > >> > > >>Delivered 1 messages > > >> > > >>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > > >> > > >>to=, > > >> > > >>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > > >>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > > >>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > > >> > > >>Virus Scanner > > >> > > >>>version > > >>> 4.40.11 starting... > > >>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > > >> > > >>custom init function > > >> > > >>>MailWatchLogging > > >>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > > >> > > >>SpamAssassin auto-whitelist > > >> > > >>>functionality... > > >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > > >> > > >>(engine 2.28) > > >> > > >>>recognizing 102051 viruses > > >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > > >> > > >>180 IDE files > > >> > > >>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > > >> > > >>using unrar command > > >> > > >>>/usr/local/bin/unrar > > >>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > > >>> > > >>>Otherwise MailScanner is working ok, all ail gets scanned > > >> > > >>and delivered. > > >> > > >>>Any ideas what might be causing this? > > >>>Thanks, > > >>> > > >>>Adri. > > >>> > > >>>------------------------ MailScanner list > ------------------------ > > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >>>'leave mailscanner' in the body of the email. > > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > >>> > > >>>Support MailScanner development - buy the book off the website! > > >> > > >>************************************************************ > > ********** > > >> > > >>This email and any files transmitted with it are confidential and > > >>intended solely for the use of the individual or entity > to whom they > > >>are addressed. If you have received this email in error > > please notify > > >>the system manager. > > >> > > >>This footnote confirms that this email message has been swept > > >>for the presence of computer viruses and is believed to be clean. > > >> > > >>************************************************************ > > ********** > > >> > > >>------------------------ MailScanner list ------------------------ > > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >>'leave mailscanner' in the body of the email. > > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > >> > > >>Support MailScanner development - buy the book off the website! > > >> > > > > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > ********************************************************************** > > > > This email and any files transmitted with it are confidential and > > intended solely for the use of the individual or entity to whom they > > are addressed. If you have received this email in error > please notify > > the system manager. > > > > This footnote confirms that this email message has been swept > > for the presence of computer viruses and is believed to be clean. > > > > > ********************************************************************** > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 13:28:06 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, Just commented out the Always Lookup Last to diable MailWatch and no restarts in the last 10 min. Before commenting it out, MailWatch was still logging properly, despite the restarts. Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 15 April, 2005 14:08 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Adri > > is logging to the mysql DB for Mailwatch OK?? > > What happens if you take out the Call to MailWatch.PM in > "Always Looked > Up Last" > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > Martin, > > > > I can see MS starting all it's children (3 in my > configuration) on the > > install startup. > > Then after each batch, MS delivers the messages and I can > see it restarting, > > using a different PID each time. > > Checking the previous child seems to have died, since I only see 3 > > mailscanner processes in ps/top. > > > > Adri. > > > > > >>-----Original Message----- > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>Sent: 15 April, 2005 13:47 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Adri > >> > >>you sure this isn't just MS starting all it's children? How many > >>Children should it be starting? > >> > >>have you looked ove the last 30 minutes or so and made sure the > >>processed ID's are being reused in the logs. > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Adri Koppes wrote: > >> > >>>Hi, > >>> > >>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >> > >>using portupgrade > >> > >>>and the port made by J. Koopman. > >>>Before I was running 4.39.6 without any problems, but after > >> > >>the upgrade, > >> > >>>MailScanner seems to restart every time it completes a > >> > >>batch, without any > >> > >>>errors or calling any Csutom End Functions. > >>>I also have MailWatch 0.5.1 installed with the custom > >> > >>MailWatch.pm module in > >> > >>>the CustomFunctions directory. > >>>Here's a snip from the maillog > >>> > >>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >> > >>1 messages, 4207 > >> > >>>bytes > >>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >> > >>Scanning: Starting > >> > >>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >> > >>Delivered 1 messages > >> > >>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >> > >>to=, > >> > >>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > >>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > >>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >> > >>Virus Scanner > >> > >>>version > >>> 4.40.11 starting... > >>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >> > >>custom init function > >> > >>>MailWatchLogging > >>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >> > >>SpamAssassin auto-whitelist > >> > >>>functionality... > >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >> > >>(engine 2.28) > >> > >>>recognizing 102051 viruses > >>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >> > >>180 IDE files > >> > >>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >> > >>using unrar command > >> > >>>/usr/local/bin/unrar > >>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > >>> > >>>Otherwise MailScanner is working ok, all ail gets scanned > >> > >>and delivered. > >> > >>>Any ideas what might be causing this? > >>>Thanks, > >>> > >>>Adri. > >>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been swept > >>for the presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > > > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 15 13:35:20 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: Adri hmm well looks like that's the problem then, even if it did work with 4.39 try Walker Aumann's modified version of MailWatch.pm and see if you get the same results.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > Martin, > > Just commented out the Always Lookup Last to diable MailWatch and no > restarts in the last 10 min. > Before commenting it out, MailWatch was still logging properly, despite the > restarts. > > Adri. > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: 15 April, 2005 14:08 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner 4.40.11 restarting after every batch >> >> >>Adri >> >>is logging to the mysql DB for Mailwatch OK?? >> >>What happens if you take out the Call to MailWatch.PM in >>"Always Looked >>Up Last" >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Adri Koppes wrote: >> >>>Martin, >>> >>>I can see MS starting all it's children (3 in my >> >>configuration) on the >> >>>install startup. >>>Then after each batch, MS delivers the messages and I can >> >>see it restarting, >> >>>using a different PID each time. >>>Checking the previous child seems to have died, since I only see 3 >>>mailscanner processes in ps/top. >>> >>>Adri. >>> >>> >>> >>>>-----Original Message----- >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>Sent: 15 April, 2005 13:47 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>> >>>> >>>>Adri >>>> >>>>you sure this isn't just MS starting all it's children? How many >>>>Children should it be starting? >>>> >>>>have you looked ove the last 30 minutes or so and made sure the >>>>processed ID's are being reused in the logs. >>>> >>>>-- >>>>Martin Hepworth >>>>Snr Systems Administrator >>>>Solid State Logic >>>>Tel: +44 (0)1865 842300 >>>> >>>> >>>>Adri Koppes wrote: >>>> >>>> >>>>>Hi, >>>>> >>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, >>>> >>>>using portupgrade >>>> >>>> >>>>>and the port made by J. Koopman. >>>>>Before I was running 4.39.6 without any problems, but after >>>> >>>>the upgrade, >>>> >>>> >>>>>MailScanner seems to restart every time it completes a >>>> >>>>batch, without any >>>> >>>> >>>>>errors or calling any Csutom End Functions. >>>>>I also have MailWatch 0.5.1 installed with the custom >>>> >>>>MailWatch.pm module in >>>> >>>> >>>>>the CustomFunctions directory. >>>>>Here's a snip from the maillog >>>>> >>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning >>>> >>>>1 messages, 4207 >>>> >>>> >>>>>bytes >>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content >>>> >>>>Scanning: Starting >>>> >>>> >>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: >>>> >>>>Delivered 1 messages >>>> >>>> >>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: >>>> >>>>to=, >>>> >>>> >>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, >>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) >>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail >>>> >>>>Virus Scanner >>>> >>>> >>>>>version >>>>>4.40.11 starting... >>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling >>>> >>>>custom init function >>>> >>>> >>>>>MailWatchLogging >>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling >>>> >>>>SpamAssassin auto-whitelist >>>> >>>> >>>>>functionality... >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 >>>> >>>>(engine 2.28) >>>> >>>> >>>>>recognizing 102051 viruses >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using >>>> >>>>180 IDE files >>>> >>>> >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner >>>> >>>>using unrar command >>>> >>>> >>>>>/usr/local/bin/unrar >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock >>>>> >>>>>Otherwise MailScanner is working ok, all ail gets scanned >>>> >>>>and delivered. >>>> >>>> >>>>>Any ideas what might be causing this? >>>>>Thanks, >>>>> >>>>>Adri. >>>>> >>>>>------------------------ MailScanner list ------------------------ >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>'leave mailscanner' in the body of the email. >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>> >>>>************************************************************ >> >>********** >> >>>>This email and any files transmitted with it are confidential and >>>>intended solely for the use of the individual or entity to whom they >>>>are addressed. If you have received this email in error >> >>please notify >> >>>>the system manager. >>>> >>>>This footnote confirms that this email message has been swept >>>>for the presence of computer viruses and is believed to be clean. >>>> >>>>************************************************************ >> >>********** >> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>> >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 13:38:36 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:19 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, hmmm seems the cause is a different one! I just moved the MailWatch.pm from CustomFunctions backup and inserted a 'require MailScanner/Mailwatch.pm' in CustomConfig.pm. Restarted MailScanner and now it seems to work fine again.... Looks like there's something funny happening, when the MailWatch.pm is auto loaded by MS from the CustomFunctions directory. Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 15 April, 2005 14:35 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Adri > > hmm well looks like that's the problem then, even if it did > work with 4.39 > > try Walker Aumann's modified version of MailWatch.pm and see > if you get > the same results.. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > Martin, > > > > Just commented out the Always Lookup Last to diable MailWatch and no > > restarts in the last 10 min. > > Before commenting it out, MailWatch was still logging > properly, despite the > > restarts. > > > > Adri. > > > > > >>-----Original Message----- > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>Sent: 15 April, 2005 14:08 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Adri > >> > >>is logging to the mysql DB for Mailwatch OK?? > >> > >>What happens if you take out the Call to MailWatch.PM in > >>"Always Looked > >>Up Last" > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Adri Koppes wrote: > >> > >>>Martin, > >>> > >>>I can see MS starting all it's children (3 in my > >> > >>configuration) on the > >> > >>>install startup. > >>>Then after each batch, MS delivers the messages and I can > >> > >>see it restarting, > >> > >>>using a different PID each time. > >>>Checking the previous child seems to have died, since I only see 3 > >>>mailscanner processes in ps/top. > >>> > >>>Adri. > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>Sent: 15 April, 2005 13:47 > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>> > >>>> > >>>>Adri > >>>> > >>>>you sure this isn't just MS starting all it's children? How many > >>>>Children should it be starting? > >>>> > >>>>have you looked ove the last 30 minutes or so and made sure the > >>>>processed ID's are being reused in the logs. > >>>> > >>>>-- > >>>>Martin Hepworth > >>>>Snr Systems Administrator > >>>>Solid State Logic > >>>>Tel: +44 (0)1865 842300 > >>>> > >>>> > >>>>Adri Koppes wrote: > >>>> > >>>> > >>>>>Hi, > >>>>> > >>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >>>> > >>>>using portupgrade > >>>> > >>>> > >>>>>and the port made by J. Koopman. > >>>>>Before I was running 4.39.6 without any problems, but after > >>>> > >>>>the upgrade, > >>>> > >>>> > >>>>>MailScanner seems to restart every time it completes a > >>>> > >>>>batch, without any > >>>> > >>>> > >>>>>errors or calling any Csutom End Functions. > >>>>>I also have MailWatch 0.5.1 installed with the custom > >>>> > >>>>MailWatch.pm module in > >>>> > >>>> > >>>>>the CustomFunctions directory. > >>>>>Here's a snip from the maillog > >>>>> > >>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >>>> > >>>>1 messages, 4207 > >>>> > >>>> > >>>>>bytes > >>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >>>> > >>>>Scanning: Starting > >>>> > >>>> > >>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >>>> > >>>>Delivered 1 messages > >>>> > >>>> > >>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >>>> > >>>>to=, > >>>> > >>>> > >>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > >>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > >>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >>>> > >>>>Virus Scanner > >>>> > >>>> > >>>>>version > >>>>>4.40.11 starting... > >>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >>>> > >>>>custom init function > >>>> > >>>> > >>>>>MailWatchLogging > >>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >>>> > >>>>SpamAssassin auto-whitelist > >>>> > >>>> > >>>>>functionality... > >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >>>> > >>>>(engine 2.28) > >>>> > >>>> > >>>>>recognizing 102051 viruses > >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >>>> > >>>>180 IDE files > >>>> > >>>> > >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >>>> > >>>>using unrar command > >>>> > >>>> > >>>>>/usr/local/bin/unrar > >>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > >>>>> > >>>>>Otherwise MailScanner is working ok, all ail gets scanned > >>>> > >>>>and delivered. > >>>> > >>>> > >>>>>Any ideas what might be causing this? > >>>>>Thanks, > >>>>> > >>>>>Adri. > >>>>> > >>>>>------------------------ MailScanner list > ------------------------ > >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>'leave mailscanner' in the body of the email. > >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>> > >>>>>Support MailScanner development - buy the book off the website! > >>>> > >>>>************************************************************ > >> > >>********** > >> > >>>>This email and any files transmitted with it are confidential and > >>>>intended solely for the use of the individual or entity > to whom they > >>>>are addressed. If you have received this email in error > >> > >>please notify > >> > >>>>the system manager. > >>>> > >>>>This footnote confirms that this email message has been swept > >>>>for the presence of computer viruses and is believed to be clean. > >>>> > >>>>************************************************************ > >> > >>********** > >> > >>>>------------------------ MailScanner list ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>> > >>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been swept > >>for the presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > > > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 15 13:51:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Get it in a state where it isn't working by putting it back to the layout you started with. Then kill MailScanner. Then set "Debug = yes" in MailScanner.conf and restart MailScanner. service MailScanner stop then edit MailScanner.conf then service MailScanner startin service MailScanner startout then test MailScanner with check_MailScanner and look for any error messages. It should pickup and process 1 batch of messages and then stop. Then put it back to normal by setting "Debug = no" in MailScanner.conf and then service MailScanner restart and you will be running normally again. Hopefully the error messages it prints will give you some idea of what is really wrong. Adri Koppes wrote: >Martin, > >hmmm seems the cause is a different one! >I just moved the MailWatch.pm from CustomFunctions backup and inserted a >'require MailScanner/Mailwatch.pm' in CustomConfig.pm. >Restarted MailScanner and now it seems to work fine again.... >Looks like there's something funny happening, when the MailWatch.pm is auto >loaded by MS from the CustomFunctions directory. > >Adri. > > > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: 15 April, 2005 14:35 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner 4.40.11 restarting after every batch >> >> >>Adri >> >>hmm well looks like that's the problem then, even if it did >>work with 4.39 >> >>try Walker Aumann's modified version of MailWatch.pm and see >>if you get >>the same results.. >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Adri Koppes wrote: >> >> >>>Martin, >>> >>>Just commented out the Always Lookup Last to diable MailWatch and no >>>restarts in the last 10 min. >>>Before commenting it out, MailWatch was still logging >>> >>> >>properly, despite the >> >> >>>restarts. >>> >>>Adri. >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>Sent: 15 April, 2005 14:08 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>> >>>> >>>>Adri >>>> >>>>is logging to the mysql DB for Mailwatch OK?? >>>> >>>>What happens if you take out the Call to MailWatch.PM in >>>>"Always Looked >>>>Up Last" >>>> >>>>-- >>>>Martin Hepworth >>>>Snr Systems Administrator >>>>Solid State Logic >>>>Tel: +44 (0)1865 842300 >>>> >>>> >>>>Adri Koppes wrote: >>>> >>>> >>>> >>>>>Martin, >>>>> >>>>>I can see MS starting all it's children (3 in my >>>>> >>>>> >>>>configuration) on the >>>> >>>> >>>> >>>>>install startup. >>>>>Then after each batch, MS delivers the messages and I can >>>>> >>>>> >>>>see it restarting, >>>> >>>> >>>> >>>>>using a different PID each time. >>>>>Checking the previous child seems to have died, since I only see 3 >>>>>mailscanner processes in ps/top. >>>>> >>>>>Adri. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>-----Original Message----- >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>>>Sent: 15 April, 2005 13:47 >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>>>> >>>>>> >>>>>>Adri >>>>>> >>>>>>you sure this isn't just MS starting all it's children? How many >>>>>>Children should it be starting? >>>>>> >>>>>>have you looked ove the last 30 minutes or so and made sure the >>>>>>processed ID's are being reused in the logs. >>>>>> >>>>>>-- >>>>>>Martin Hepworth >>>>>>Snr Systems Administrator >>>>>>Solid State Logic >>>>>>Tel: +44 (0)1865 842300 >>>>>> >>>>>> >>>>>>Adri Koppes wrote: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Hi, >>>>>>> >>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, >>>>>>> >>>>>>> >>>>>>using portupgrade >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>and the port made by J. Koopman. >>>>>>>Before I was running 4.39.6 without any problems, but after >>>>>>> >>>>>>> >>>>>>the upgrade, >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>MailScanner seems to restart every time it completes a >>>>>>> >>>>>>> >>>>>>batch, without any >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>errors or calling any Csutom End Functions. >>>>>>>I also have MailWatch 0.5.1 installed with the custom >>>>>>> >>>>>>> >>>>>>MailWatch.pm module in >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>the CustomFunctions directory. >>>>>>>Here's a snip from the maillog >>>>>>> >>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning >>>>>>> >>>>>>> >>>>>>1 messages, 4207 >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>bytes >>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content >>>>>>> >>>>>>> >>>>>>Scanning: Starting >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: >>>>>>> >>>>>>> >>>>>>Delivered 1 messages >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: >>>>>>> >>>>>>> >>>>>>to=, >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, >>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) >>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail >>>>>>> >>>>>>> >>>>>>Virus Scanner >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>version >>>>>>>4.40.11 starting... >>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling >>>>>>> >>>>>>> >>>>>>custom init function >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>MailWatchLogging >>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling >>>>>>> >>>>>>> >>>>>>SpamAssassin auto-whitelist >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>functionality... >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 >>>>>>> >>>>>>> >>>>>>(engine 2.28) >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>recognizing 102051 viruses >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using >>>>>>> >>>>>>> >>>>>>180 IDE files >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner >>>>>>> >>>>>>> >>>>>>using unrar command >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>/usr/local/bin/unrar >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock >>>>>>> >>>>>>>Otherwise MailScanner is working ok, all ail gets scanned >>>>>>> >>>>>>> >>>>>>and delivered. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Any ideas what might be causing this? >>>>>>>Thanks, >>>>>>> >>>>>>>Adri. >>>>>>> >>>>>>>------------------------ MailScanner list >>>>>>> >>>>>>> >>------------------------ >> >> >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>'leave mailscanner' in the body of the email. >>>>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>>> >>>>>>>Support MailScanner development - buy the book off the website! >>>>>>> >>>>>>> >>>>>>************************************************************ >>>>>> >>>>>> >>>>********** >>>> >>>> >>>> >>>>>>This email and any files transmitted with it are confidential and >>>>>>intended solely for the use of the individual or entity >>>>>> >>>>>> >>to whom they >> >> >>>>>>are addressed. If you have received this email in error >>>>>> >>>>>> >>>>please notify >>>> >>>> >>>> >>>>>>the system manager. >>>>>> >>>>>>This footnote confirms that this email message has been swept >>>>>>for the presence of computer viruses and is believed to be clean. >>>>>> >>>>>>************************************************************ >>>>>> >>>>>> >>>>********** >>>> >>>> >>>> >>>>>>------------------------ MailScanner list ------------------------ >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>'leave mailscanner' in the body of the email. >>>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>> >>>>>>Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>>> >>>>>------------------------ MailScanner list ------------------------ >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>'leave mailscanner' in the body of the email. >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>************************************************************ >>>> >>>> >>********** >> >> >>>>This email and any files transmitted with it are confidential and >>>>intended solely for the use of the individual or entity to whom they >>>>are addressed. If you have received this email in error >>>> >>>> >>please notify >> >> >>>>the system manager. >>>> >>>>This footnote confirms that this email message has been swept >>>>for the presence of computer viruses and is believed to be clean. >>>> >>>>************************************************************ >>>> >>>> >>********** >> >> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 14:10:42 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Here's the debug output when I use the require 'MailScanner/MailWatch.pm'; in CustomConfig.pm. Adri. Starting MailScanner... In Debugging mode, not forking... SA bayes lock is /usr/local/etc/mail/spamassassin/bayes.lock Bayes lock is at /usr/local/etc/mail/spamassassin/bayes.lock Use of uninitialized value in numeric ne (!=) at /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 88. Use of uninitialized value in numeric ne (!=) at /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 97. INFO:: Meaningless output that goes nowhere, to keep SAVI happy Use of uninitialized value in length at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 130, line 34. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in int at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. Use of uninitialized value in int at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3165. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3169. Use of uninitialized value in int at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. Stopping now as you are debugging me. > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: 15 April, 2005 14:52 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Get it in a state where it isn't working by putting it back to the > layout you started with. Then kill MailScanner. Then set "Debug = yes" > in MailScanner.conf and restart MailScanner. > service MailScanner stop > then edit MailScanner.conf > then > service MailScanner startin > service MailScanner startout > then test MailScanner with > check_MailScanner > and look for any error messages. It should pickup and process > 1 batch of > messages and then stop. > Then put it back to normal by setting "Debug = no" in MailScanner.conf > and then > service MailScanner restart > and you will be running normally again. > > Hopefully the error messages it prints will give you some idea of what > is really wrong. > > Adri Koppes wrote: > > >Martin, > > > >hmmm seems the cause is a different one! > >I just moved the MailWatch.pm from CustomFunctions backup > and inserted a > >'require MailScanner/Mailwatch.pm' in CustomConfig.pm. > >Restarted MailScanner and now it seems to work fine again.... > >Looks like there's something funny happening, when the > MailWatch.pm is auto > >loaded by MS from the CustomFunctions directory. > > > >Adri. > > > > > > > > > >>-----Original Message----- > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>Sent: 15 April, 2005 14:35 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Adri > >> > >>hmm well looks like that's the problem then, even if it did > >>work with 4.39 > >> > >>try Walker Aumann's modified version of MailWatch.pm and see > >>if you get > >>the same results.. > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Adri Koppes wrote: > >> > >> > >>>Martin, > >>> > >>>Just commented out the Always Lookup Last to diable > MailWatch and no > >>>restarts in the last 10 min. > >>>Before commenting it out, MailWatch was still logging > >>> > >>> > >>properly, despite the > >> > >> > >>>restarts. > >>> > >>>Adri. > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>Sent: 15 April, 2005 14:08 > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>> > >>>> > >>>>Adri > >>>> > >>>>is logging to the mysql DB for Mailwatch OK?? > >>>> > >>>>What happens if you take out the Call to MailWatch.PM in > >>>>"Always Looked > >>>>Up Last" > >>>> > >>>>-- > >>>>Martin Hepworth > >>>>Snr Systems Administrator > >>>>Solid State Logic > >>>>Tel: +44 (0)1865 842300 > >>>> > >>>> > >>>>Adri Koppes wrote: > >>>> > >>>> > >>>> > >>>>>Martin, > >>>>> > >>>>>I can see MS starting all it's children (3 in my > >>>>> > >>>>> > >>>>configuration) on the > >>>> > >>>> > >>>> > >>>>>install startup. > >>>>>Then after each batch, MS delivers the messages and I can > >>>>> > >>>>> > >>>>see it restarting, > >>>> > >>>> > >>>> > >>>>>using a different PID each time. > >>>>>Checking the previous child seems to have died, since I > only see 3 > >>>>>mailscanner processes in ps/top. > >>>>> > >>>>>Adri. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>>>-----Original Message----- > >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>Sent: 15 April, 2005 13:47 > >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>>>> > >>>>>> > >>>>>>Adri > >>>>>> > >>>>>>you sure this isn't just MS starting all it's children? How many > >>>>>>Children should it be starting? > >>>>>> > >>>>>>have you looked ove the last 30 minutes or so and made sure the > >>>>>>processed ID's are being reused in the logs. > >>>>>> > >>>>>>-- > >>>>>>Martin Hepworth > >>>>>>Snr Systems Administrator > >>>>>>Solid State Logic > >>>>>>Tel: +44 (0)1865 842300 > >>>>>> > >>>>>> > >>>>>>Adri Koppes wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Hi, > >>>>>>> > >>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >>>>>>> > >>>>>>> > >>>>>>using portupgrade > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>and the port made by J. Koopman. > >>>>>>>Before I was running 4.39.6 without any problems, but after > >>>>>>> > >>>>>>> > >>>>>>the upgrade, > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>MailScanner seems to restart every time it completes a > >>>>>>> > >>>>>>> > >>>>>>batch, without any > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>errors or calling any Csutom End Functions. > >>>>>>>I also have MailWatch 0.5.1 installed with the custom > >>>>>>> > >>>>>>> > >>>>>>MailWatch.pm module in > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>the CustomFunctions directory. > >>>>>>>Here's a snip from the maillog > >>>>>>> > >>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >>>>>>> > >>>>>>> > >>>>>>1 messages, 4207 > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>bytes > >>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >>>>>>> > >>>>>>> > >>>>>>Scanning: Starting > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >>>>>>> > >>>>>>> > >>>>>>Delivered 1 messages > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >>>>>>> > >>>>>>> > >>>>>>to=, > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > >>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > >>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >>>>>>> > >>>>>>> > >>>>>>Virus Scanner > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>version > >>>>>>>4.40.11 starting... > >>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >>>>>>> > >>>>>>> > >>>>>>custom init function > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>MailWatchLogging > >>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >>>>>>> > >>>>>>> > >>>>>>SpamAssassin auto-whitelist > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>functionality... > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >>>>>>> > >>>>>>> > >>>>>>(engine 2.28) > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>recognizing 102051 viruses > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >>>>>>> > >>>>>>> > >>>>>>180 IDE files > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >>>>>>> > >>>>>>> > >>>>>>using unrar command > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>/usr/local/bin/unrar > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > >>>>>>> > >>>>>>>Otherwise MailScanner is working ok, all ail gets scanned > >>>>>>> > >>>>>>> > >>>>>>and delivered. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Any ideas what might be causing this? > >>>>>>>Thanks, > >>>>>>> > >>>>>>>Adri. > >>>>>>> > >>>>>>>------------------------ MailScanner list > >>>>>>> > >>>>>>> > >>------------------------ > >> > >> > >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>>the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>>> > >>>>>>>Support MailScanner development - buy the book off the website! > >>>>>>> > >>>>>>> > >>>>>>************************************************************ > >>>>>> > >>>>>> > >>>>********** > >>>> > >>>> > >>>> > >>>>>>This email and any files transmitted with it are > confidential and > >>>>>>intended solely for the use of the individual or entity > >>>>>> > >>>>>> > >>to whom they > >> > >> > >>>>>>are addressed. If you have received this email in error > >>>>>> > >>>>>> > >>>>please notify > >>>> > >>>> > >>>> > >>>>>>the system manager. > >>>>>> > >>>>>>This footnote confirms that this email message has been swept > >>>>>>for the presence of computer viruses and is believed to > be clean. > >>>>>> > >>>>>>************************************************************ > >>>>>> > >>>>>> > >>>>********** > >>>> > >>>> > >>>> > >>>>>>------------------------ MailScanner list > ------------------------ > >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>'leave mailscanner' in the body of the email. > >>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>> > >>>>>>Support MailScanner development - buy the book off the website! > >>>>>> > >>>>>> > >>>>>> > >>>>>------------------------ MailScanner list > ------------------------ > >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>'leave mailscanner' in the body of the email. > >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>> > >>>>>Support MailScanner development - buy the book off the website! > >>>>> > >>>>> > >>>>************************************************************ > >>>> > >>>> > >>********** > >> > >> > >>>>This email and any files transmitted with it are confidential and > >>>>intended solely for the use of the individual or entity > to whom they > >>>>are addressed. If you have received this email in error > >>>> > >>>> > >>please notify > >> > >> > >>>>the system manager. > >>>> > >>>>This footnote confirms that this email message has been swept > >>>>for the presence of computer viruses and is believed to be clean. > >>>> > >>>>************************************************************ > >>>> > >>>> > >>********** > >> > >> > >>>>------------------------ MailScanner list ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>>> > >>>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been swept > >>for the presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > >> > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 15 14:10:52 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: Adri most odd.. and you've definitely got Custom Functions Dir = /opt/MailScanner/lib/MailScanner/CustomFunctions or where-ever you need to put the CustomFunctions dir.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > Julian, > > Here's the output. Seems it can't call MailWatchLogging, eventhough the > MailWatchInit is getting callled. > > Adri. > > > Starting MailScanner... > In Debugging mode, not forking... > SA bayes lock is /usr/local/etc/mail/spamassassin/bayes.lock > Bayes lock is at /usr/local/etc/mail/spamassassin/bayes.lock > Use of uninitialized value in numeric ne (!=) at > /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 88. > Use of uninitialized value in numeric ne (!=) at > /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 97. > INFO:: Meaningless output that goes nowhere, to keep SAVI happy > Use of uninitialized value in hash element at > /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. > Use of uninitialized value in hash element at > /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. > Use of uninitialized value in pattern match (m//) at > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > Use of uninitialized value in pattern match (m//) at > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > Use of uninitialized value in addition (+) at > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. > Use of uninitialized value in pattern match (m//) at > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > Use of uninitialized value in int at > /usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. > Use of uninitialized value in addition (+) at > /usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. > Undefined subroutine &MailScanner::CustomConfig::MailWatchLogging called at > /usr/local/lib/MailScanner/MailScanner/Config.pm line 121. > > > >>-----Original Message----- >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>Sent: 15 April, 2005 14:52 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner 4.40.11 restarting after every batch >> >> >>Get it in a state where it isn't working by putting it back to the >>layout you started with. Then kill MailScanner. Then set "Debug = yes" >>in MailScanner.conf and restart MailScanner. >> service MailScanner stop >>then edit MailScanner.conf >>then >> service MailScanner startin >> service MailScanner startout >>then test MailScanner with >> check_MailScanner >>and look for any error messages. It should pickup and process >>1 batch of >>messages and then stop. >>Then put it back to normal by setting "Debug = no" in MailScanner.conf >>and then >> service MailScanner restart >>and you will be running normally again. >> >>Hopefully the error messages it prints will give you some idea of what >>is really wrong. >> >>Adri Koppes wrote: >> >> >>>Martin, >>> >>>hmmm seems the cause is a different one! >>>I just moved the MailWatch.pm from CustomFunctions backup >> >>and inserted a >> >>>'require MailScanner/Mailwatch.pm' in CustomConfig.pm. >>>Restarted MailScanner and now it seems to work fine again.... >>>Looks like there's something funny happening, when the >> >>MailWatch.pm is auto >> >>>loaded by MS from the CustomFunctions directory. >>> >>>Adri. >>> >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>Sent: 15 April, 2005 14:35 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>> >>>> >>>>Adri >>>> >>>>hmm well looks like that's the problem then, even if it did >>>>work with 4.39 >>>> >>>>try Walker Aumann's modified version of MailWatch.pm and see >>>>if you get >>>>the same results.. >>>> >>>>-- >>>>Martin Hepworth >>>>Snr Systems Administrator >>>>Solid State Logic >>>>Tel: +44 (0)1865 842300 >>>> >>>> >>>>Adri Koppes wrote: >>>> >>>> >>>> >>>>>Martin, >>>>> >>>>>Just commented out the Always Lookup Last to diable >> >>MailWatch and no >> >>>>>restarts in the last 10 min. >>>>>Before commenting it out, MailWatch was still logging >>>>> >>>>> >>>> >>>>properly, despite the >>>> >>>> >>>> >>>>>restarts. >>>>> >>>>>Adri. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>-----Original Message----- >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>>>Sent: 15 April, 2005 14:08 >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>>>> >>>>>> >>>>>>Adri >>>>>> >>>>>>is logging to the mysql DB for Mailwatch OK?? >>>>>> >>>>>>What happens if you take out the Call to MailWatch.PM in >>>>>>"Always Looked >>>>>>Up Last" >>>>>> >>>>>>-- >>>>>>Martin Hepworth >>>>>>Snr Systems Administrator >>>>>>Solid State Logic >>>>>>Tel: +44 (0)1865 842300 >>>>>> >>>>>> >>>>>>Adri Koppes wrote: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Martin, >>>>>>> >>>>>>>I can see MS starting all it's children (3 in my >>>>>>> >>>>>>> >>>>>> >>>>>>configuration) on the >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>install startup. >>>>>>>Then after each batch, MS delivers the messages and I can >>>>>>> >>>>>>> >>>>>> >>>>>>see it restarting, >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>using a different PID each time. >>>>>>>Checking the previous child seems to have died, since I >> >>only see 3 >> >>>>>>>mailscanner processes in ps/top. >>>>>>> >>>>>>>Adri. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>>-----Original Message----- >>>>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>>>>>Sent: 15 April, 2005 13:47 >>>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>>>>>> >>>>>>>> >>>>>>>>Adri >>>>>>>> >>>>>>>>you sure this isn't just MS starting all it's children? How many >>>>>>>>Children should it be starting? >>>>>>>> >>>>>>>>have you looked ove the last 30 minutes or so and made sure the >>>>>>>>processed ID's are being reused in the logs. >>>>>>>> >>>>>>>>-- >>>>>>>>Martin Hepworth >>>>>>>>Snr Systems Administrator >>>>>>>>Solid State Logic >>>>>>>>Tel: +44 (0)1865 842300 >>>>>>>> >>>>>>>> >>>>>>>>Adri Koppes wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>Hi, >>>>>>>>> >>>>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>using portupgrade >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>and the port made by J. Koopman. >>>>>>>>>Before I was running 4.39.6 without any problems, but after >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>the upgrade, >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>MailScanner seems to restart every time it completes a >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>batch, without any >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>errors or calling any Csutom End Functions. >>>>>>>>>I also have MailWatch 0.5.1 installed with the custom >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>MailWatch.pm module in >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>the CustomFunctions directory. >>>>>>>>>Here's a snip from the maillog >>>>>>>>> >>>>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>1 messages, 4207 >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>bytes >>>>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>Scanning: Starting >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>Delivered 1 messages >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>to=, >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, >>>>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) >>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>Virus Scanner >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>version >>>>>>>>>4.40.11 starting... >>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>custom init function >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>MailWatchLogging >>>>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>SpamAssassin auto-whitelist >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>functionality... >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>(engine 2.28) >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>recognizing 102051 viruses >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>180 IDE files >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>using unrar command >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>/usr/local/bin/unrar >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock >>>>>>>>> >>>>>>>>>Otherwise MailScanner is working ok, all ail gets scanned >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>and delivered. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>Any ideas what might be causing this? >>>>>>>>>Thanks, >>>>>>>>> >>>>>>>>>Adri. >>>>>>>>> >>>>>>>>>------------------------ MailScanner list >>>>>>>>> >>>>>>>>> >>>> >>>>------------------------ >>>> >>>> >>>> >>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>>>'leave mailscanner' in the body of the email. >>>>>>>>>Before posting, read the Wiki >> >>(http://wiki.mailscanner.info/) and >> >>>>>>>>>the archives >> >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>>>>>>>>Support MailScanner development - buy the book off the website! >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>************************************************************ >>>>>>>> >>>>>>>> >>>>>> >>>>>>********** >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>This email and any files transmitted with it are >> >>confidential and >> >>>>>>>>intended solely for the use of the individual or entity >>>>>>>> >>>>>>>> >>>> >>>>to whom they >>>> >>>> >>>> >>>>>>>>are addressed. If you have received this email in error >>>>>>>> >>>>>>>> >>>>>> >>>>>>please notify >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>the system manager. >>>>>>>> >>>>>>>>This footnote confirms that this email message has been swept >>>>>>>>for the presence of computer viruses and is believed to >> >>be clean. >> >>>>>>>>************************************************************ >>>>>>>> >>>>>>>> >>>>>> >>>>>>********** >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>------------------------ MailScanner list >> >>------------------------ >> >>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>>'leave mailscanner' in the body of the email. >>>>>>>>Before posting, read the Wiki >> >>(http://wiki.mailscanner.info/) and >> >>>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>>>> >>>>>>>>Support MailScanner development - buy the book off the website! >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>>------------------------ MailScanner list >> >>------------------------ >> >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>'leave mailscanner' in the body of the email. >>>>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>>> >>>>>>>Support MailScanner development - buy the book off the website! >>>>>>> >>>>>>> >>>>>> >>>>>>************************************************************ >>>>>> >>>>>> >>>> >>>>********** >>>> >>>> >>>> >>>>>>This email and any files transmitted with it are confidential and >>>>>>intended solely for the use of the individual or entity >> >>to whom they >> >>>>>>are addressed. If you have received this email in error >>>>>> >>>>>> >>>> >>>>please notify >>>> >>>> >>>> >>>>>>the system manager. >>>>>> >>>>>>This footnote confirms that this email message has been swept >>>>>>for the presence of computer viruses and is believed to be clean. >>>>>> >>>>>>************************************************************ >>>>>> >>>>>> >>>> >>>>********** >>>> >>>> >>>> >>>>>>------------------------ MailScanner list ------------------------ >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>'leave mailscanner' in the body of the email. >>>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>> >>>>>>Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>>> >>>>> >>>>>------------------------ MailScanner list ------------------------ >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>'leave mailscanner' in the body of the email. >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>> >>>>************************************************************ >> >>********** >> >>>>This email and any files transmitted with it are confidential and >>>>intended solely for the use of the individual or entity to whom they >>>>are addressed. If you have received this email in error >> >>please notify >> >>>>the system manager. >>>> >>>>This footnote confirms that this email message has been swept >>>>for the presence of computer viruses and is believed to be clean. >>>> >>>>************************************************************ >> >>********** >> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 14:05:14 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Here's the output. Seems it can't call MailWatchLogging, eventhough the MailWatchInit is getting callled. Adri. Starting MailScanner... In Debugging mode, not forking... SA bayes lock is /usr/local/etc/mail/spamassassin/bayes.lock Bayes lock is at /usr/local/etc/mail/spamassassin/bayes.lock Use of uninitialized value in numeric ne (!=) at /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 88. Use of uninitialized value in numeric ne (!=) at /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 97. INFO:: Meaningless output that goes nowhere, to keep SAVI happy Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. Use of uninitialized value in hash element at /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. Use of uninitialized value in pattern match (m//) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. Use of uninitialized value in int at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. Use of uninitialized value in addition (+) at /usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. Undefined subroutine &MailScanner::CustomConfig::MailWatchLogging called at /usr/local/lib/MailScanner/MailScanner/Config.pm line 121. > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: 15 April, 2005 14:52 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Get it in a state where it isn't working by putting it back to the > layout you started with. Then kill MailScanner. Then set "Debug = yes" > in MailScanner.conf and restart MailScanner. > service MailScanner stop > then edit MailScanner.conf > then > service MailScanner startin > service MailScanner startout > then test MailScanner with > check_MailScanner > and look for any error messages. It should pickup and process > 1 batch of > messages and then stop. > Then put it back to normal by setting "Debug = no" in MailScanner.conf > and then > service MailScanner restart > and you will be running normally again. > > Hopefully the error messages it prints will give you some idea of what > is really wrong. > > Adri Koppes wrote: > > >Martin, > > > >hmmm seems the cause is a different one! > >I just moved the MailWatch.pm from CustomFunctions backup > and inserted a > >'require MailScanner/Mailwatch.pm' in CustomConfig.pm. > >Restarted MailScanner and now it seems to work fine again.... > >Looks like there's something funny happening, when the > MailWatch.pm is auto > >loaded by MS from the CustomFunctions directory. > > > >Adri. > > > > > > > > > >>-----Original Message----- > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>Sent: 15 April, 2005 14:35 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Adri > >> > >>hmm well looks like that's the problem then, even if it did > >>work with 4.39 > >> > >>try Walker Aumann's modified version of MailWatch.pm and see > >>if you get > >>the same results.. > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Adri Koppes wrote: > >> > >> > >>>Martin, > >>> > >>>Just commented out the Always Lookup Last to diable > MailWatch and no > >>>restarts in the last 10 min. > >>>Before commenting it out, MailWatch was still logging > >>> > >>> > >>properly, despite the > >> > >> > >>>restarts. > >>> > >>>Adri. > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>Sent: 15 April, 2005 14:08 > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>> > >>>> > >>>>Adri > >>>> > >>>>is logging to the mysql DB for Mailwatch OK?? > >>>> > >>>>What happens if you take out the Call to MailWatch.PM in > >>>>"Always Looked > >>>>Up Last" > >>>> > >>>>-- > >>>>Martin Hepworth > >>>>Snr Systems Administrator > >>>>Solid State Logic > >>>>Tel: +44 (0)1865 842300 > >>>> > >>>> > >>>>Adri Koppes wrote: > >>>> > >>>> > >>>> > >>>>>Martin, > >>>>> > >>>>>I can see MS starting all it's children (3 in my > >>>>> > >>>>> > >>>>configuration) on the > >>>> > >>>> > >>>> > >>>>>install startup. > >>>>>Then after each batch, MS delivers the messages and I can > >>>>> > >>>>> > >>>>see it restarting, > >>>> > >>>> > >>>> > >>>>>using a different PID each time. > >>>>>Checking the previous child seems to have died, since I > only see 3 > >>>>>mailscanner processes in ps/top. > >>>>> > >>>>>Adri. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>>>-----Original Message----- > >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>Sent: 15 April, 2005 13:47 > >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>>>> > >>>>>> > >>>>>>Adri > >>>>>> > >>>>>>you sure this isn't just MS starting all it's children? How many > >>>>>>Children should it be starting? > >>>>>> > >>>>>>have you looked ove the last 30 minutes or so and made sure the > >>>>>>processed ID's are being reused in the logs. > >>>>>> > >>>>>>-- > >>>>>>Martin Hepworth > >>>>>>Snr Systems Administrator > >>>>>>Solid State Logic > >>>>>>Tel: +44 (0)1865 842300 > >>>>>> > >>>>>> > >>>>>>Adri Koppes wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Hi, > >>>>>>> > >>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >>>>>>> > >>>>>>> > >>>>>>using portupgrade > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>and the port made by J. Koopman. > >>>>>>>Before I was running 4.39.6 without any problems, but after > >>>>>>> > >>>>>>> > >>>>>>the upgrade, > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>MailScanner seems to restart every time it completes a > >>>>>>> > >>>>>>> > >>>>>>batch, without any > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>errors or calling any Csutom End Functions. > >>>>>>>I also have MailWatch 0.5.1 installed with the custom > >>>>>>> > >>>>>>> > >>>>>>MailWatch.pm module in > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>the CustomFunctions directory. > >>>>>>>Here's a snip from the maillog > >>>>>>> > >>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >>>>>>> > >>>>>>> > >>>>>>1 messages, 4207 > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>bytes > >>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >>>>>>> > >>>>>>> > >>>>>>Scanning: Starting > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >>>>>>> > >>>>>>> > >>>>>>Delivered 1 messages > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >>>>>>> > >>>>>>> > >>>>>>to=, > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > >>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > >>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >>>>>>> > >>>>>>> > >>>>>>Virus Scanner > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>version > >>>>>>>4.40.11 starting... > >>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >>>>>>> > >>>>>>> > >>>>>>custom init function > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>MailWatchLogging > >>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >>>>>>> > >>>>>>> > >>>>>>SpamAssassin auto-whitelist > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>functionality... > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >>>>>>> > >>>>>>> > >>>>>>(engine 2.28) > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>recognizing 102051 viruses > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >>>>>>> > >>>>>>> > >>>>>>180 IDE files > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >>>>>>> > >>>>>>> > >>>>>>using unrar command > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>/usr/local/bin/unrar > >>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using locktype = flock > >>>>>>> > >>>>>>>Otherwise MailScanner is working ok, all ail gets scanned > >>>>>>> > >>>>>>> > >>>>>>and delivered. > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Any ideas what might be causing this? > >>>>>>>Thanks, > >>>>>>> > >>>>>>>Adri. > >>>>>>> > >>>>>>>------------------------ MailScanner list > >>>>>>> > >>>>>>> > >>------------------------ > >> > >> > >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>>the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>>> > >>>>>>>Support MailScanner development - buy the book off the website! > >>>>>>> > >>>>>>> > >>>>>>************************************************************ > >>>>>> > >>>>>> > >>>>********** > >>>> > >>>> > >>>> > >>>>>>This email and any files transmitted with it are > confidential and > >>>>>>intended solely for the use of the individual or entity > >>>>>> > >>>>>> > >>to whom they > >> > >> > >>>>>>are addressed. If you have received this email in error > >>>>>> > >>>>>> > >>>>please notify > >>>> > >>>> > >>>> > >>>>>>the system manager. > >>>>>> > >>>>>>This footnote confirms that this email message has been swept > >>>>>>for the presence of computer viruses and is believed to > be clean. > >>>>>> > >>>>>>************************************************************ > >>>>>> > >>>>>> > >>>>********** > >>>> > >>>> > >>>> > >>>>>>------------------------ MailScanner list > ------------------------ > >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>'leave mailscanner' in the body of the email. > >>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>> > >>>>>>Support MailScanner development - buy the book off the website! > >>>>>> > >>>>>> > >>>>>> > >>>>>------------------------ MailScanner list > ------------------------ > >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>'leave mailscanner' in the body of the email. > >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>> > >>>>>Support MailScanner development - buy the book off the website! > >>>>> > >>>>> > >>>>************************************************************ > >>>> > >>>> > >>********** > >> > >> > >>>>This email and any files transmitted with it are confidential and > >>>>intended solely for the use of the individual or entity > to whom they > >>>>are addressed. If you have received this email in error > >>>> > >>>> > >>please notify > >> > >> > >>>>the system manager. > >>>> > >>>>This footnote confirms that this email message has been swept > >>>>for the presence of computer viruses and is believed to be clean. > >>>> > >>>>************************************************************ > >>>> > >>>> > >>********** > >> > >> > >>>>------------------------ MailScanner list ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>>> > >>>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been swept > >>for the presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > >> > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Fri Apr 15 14:32:21 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, In MailScanner.conf I have: Custom Functions Dir = /usr/local/lib/MailScanner/MailScanner/CustomFunctions Which is the directory I had copied MailWatch.pm. I switched from the require 'MailScanner/MaiLWatch.pm' syntax to the CustomFunctions directory and automatic loading during the upgrade to 4.40.11. With versions 4.39.6 and earlier, I used the require 'MailScanner/MailWatch.pm', which always works. I don't know if I would have had the same problem with version eariler then 4.40.11 and putting the MailWatch.pm in the CustomFunctions directory. Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 15 April, 2005 15:11 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Adri > > most odd.. > > and you've definitely got > > Custom Functions Dir = > /opt/MailScanner/lib/MailScanner/CustomFunctions > > or where-ever you need to put the CustomFunctions dir.. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > Julian, > > > > Here's the output. Seems it can't call MailWatchLogging, > eventhough the > > MailWatchInit is getting callled. > > > > Adri. > > > > > > Starting MailScanner... > > In Debugging mode, not forking... > > SA bayes lock is /usr/local/etc/mail/spamassassin/bayes.lock > > Bayes lock is at /usr/local/etc/mail/spamassassin/bayes.lock > > Use of uninitialized value in numeric ne (!=) at > > /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 88. > > Use of uninitialized value in numeric ne (!=) at > > /usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 97. > > INFO:: Meaningless output that goes nowhere, to keep SAVI happy > > Use of uninitialized value in hash element at > > /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. > > Use of uninitialized value in hash element at > > /usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. > > Use of uninitialized value in pattern match (m//) at > > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > > Use of uninitialized value in pattern match (m//) at > > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > > Use of uninitialized value in addition (+) at > > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. > > Use of uninitialized value in pattern match (m//) at > > /usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > > Use of uninitialized value in int at > > /usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. > > Use of uninitialized value in addition (+) at > > /usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. > > Undefined subroutine > &MailScanner::CustomConfig::MailWatchLogging called at > > /usr/local/lib/MailScanner/MailScanner/Config.pm line 121. > > > > > > > >>-----Original Message----- > >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>Sent: 15 April, 2005 14:52 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Get it in a state where it isn't working by putting it back to the > >>layout you started with. Then kill MailScanner. Then set > "Debug = yes" > >>in MailScanner.conf and restart MailScanner. > >> service MailScanner stop > >>then edit MailScanner.conf > >>then > >> service MailScanner startin > >> service MailScanner startout > >>then test MailScanner with > >> check_MailScanner > >>and look for any error messages. It should pickup and process > >>1 batch of > >>messages and then stop. > >>Then put it back to normal by setting "Debug = no" in > MailScanner.conf > >>and then > >> service MailScanner restart > >>and you will be running normally again. > >> > >>Hopefully the error messages it prints will give you some > idea of what > >>is really wrong. > >> > >>Adri Koppes wrote: > >> > >> > >>>Martin, > >>> > >>>hmmm seems the cause is a different one! > >>>I just moved the MailWatch.pm from CustomFunctions backup > >> > >>and inserted a > >> > >>>'require MailScanner/Mailwatch.pm' in CustomConfig.pm. > >>>Restarted MailScanner and now it seems to work fine again.... > >>>Looks like there's something funny happening, when the > >> > >>MailWatch.pm is auto > >> > >>>loaded by MS from the CustomFunctions directory. > >>> > >>>Adri. > >>> > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>Sent: 15 April, 2005 14:35 > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>> > >>>> > >>>>Adri > >>>> > >>>>hmm well looks like that's the problem then, even if it did > >>>>work with 4.39 > >>>> > >>>>try Walker Aumann's modified version of MailWatch.pm and see > >>>>if you get > >>>>the same results.. > >>>> > >>>>-- > >>>>Martin Hepworth > >>>>Snr Systems Administrator > >>>>Solid State Logic > >>>>Tel: +44 (0)1865 842300 > >>>> > >>>> > >>>>Adri Koppes wrote: > >>>> > >>>> > >>>> > >>>>>Martin, > >>>>> > >>>>>Just commented out the Always Lookup Last to diable > >> > >>MailWatch and no > >> > >>>>>restarts in the last 10 min. > >>>>>Before commenting it out, MailWatch was still logging > >>>>> > >>>>> > >>>> > >>>>properly, despite the > >>>> > >>>> > >>>> > >>>>>restarts. > >>>>> > >>>>>Adri. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>>>-----Original Message----- > >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>Sent: 15 April, 2005 14:08 > >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>>>> > >>>>>> > >>>>>>Adri > >>>>>> > >>>>>>is logging to the mysql DB for Mailwatch OK?? > >>>>>> > >>>>>>What happens if you take out the Call to MailWatch.PM in > >>>>>>"Always Looked > >>>>>>Up Last" > >>>>>> > >>>>>>-- > >>>>>>Martin Hepworth > >>>>>>Snr Systems Administrator > >>>>>>Solid State Logic > >>>>>>Tel: +44 (0)1865 842300 > >>>>>> > >>>>>> > >>>>>>Adri Koppes wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Martin, > >>>>>>> > >>>>>>>I can see MS starting all it's children (3 in my > >>>>>>> > >>>>>>> > >>>>>> > >>>>>>configuration) on the > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>install startup. > >>>>>>>Then after each batch, MS delivers the messages and I can > >>>>>>> > >>>>>>> > >>>>>> > >>>>>>see it restarting, > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>using a different PID each time. > >>>>>>>Checking the previous child seems to have died, since I > >> > >>only see 3 > >> > >>>>>>>mailscanner processes in ps/top. > >>>>>>> > >>>>>>>Adri. > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>>>-----Original Message----- > >>>>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>>>Sent: 15 April, 2005 13:47 > >>>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>>>>>> > >>>>>>>> > >>>>>>>>Adri > >>>>>>>> > >>>>>>>>you sure this isn't just MS starting all it's > children? How many > >>>>>>>>Children should it be starting? > >>>>>>>> > >>>>>>>>have you looked ove the last 30 minutes or so and > made sure the > >>>>>>>>processed ID's are being reused in the logs. > >>>>>>>> > >>>>>>>>-- > >>>>>>>>Martin Hepworth > >>>>>>>>Snr Systems Administrator > >>>>>>>>Solid State Logic > >>>>>>>>Tel: +44 (0)1865 842300 > >>>>>>>> > >>>>>>>> > >>>>>>>>Adri Koppes wrote: > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>Hi, > >>>>>>>>> > >>>>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>using portupgrade > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>and the port made by J. Koopman. > >>>>>>>>>Before I was running 4.39.6 without any problems, but after > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>the upgrade, > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>MailScanner seems to restart every time it completes a > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>batch, without any > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>errors or calling any Csutom End Functions. > >>>>>>>>>I also have MailWatch 0.5.1 installed with the custom > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>MailWatch.pm module in > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>the CustomFunctions directory. > >>>>>>>>>Here's a snip from the maillog > >>>>>>>>> > >>>>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>1 messages, 4207 > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>bytes > >>>>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>Scanning: Starting > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>Delivered 1 messages > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>to=, > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, > >>>>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) > >>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>Virus Scanner > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>version > >>>>>>>>>4.40.11 starting... > >>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>custom init function > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>MailWatchLogging > >>>>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>SpamAssassin auto-whitelist > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>functionality... > >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>(engine 2.28) > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>recognizing 102051 viruses > >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>180 IDE files > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>using unrar command > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>/usr/local/bin/unrar > >>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using > locktype = flock > >>>>>>>>> > >>>>>>>>>Otherwise MailScanner is working ok, all ail gets scanned > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>and delivered. > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>Any ideas what might be causing this? > >>>>>>>>>Thanks, > >>>>>>>>> > >>>>>>>>>Adri. > >>>>>>>>> > >>>>>>>>>------------------------ MailScanner list > >>>>>>>>> > >>>>>>>>> > >>>> > >>>>------------------------ > >>>> > >>>> > >>>> > >>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>>>Before posting, read the Wiki > >> > >>(http://wiki.mailscanner.info/) and > >> > >>>>>>>>>the archives > >> > >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>>>>>>>>Support MailScanner development - buy the book off > the website! > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>************************************************************ > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>>>********** > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>This email and any files transmitted with it are > >> > >>confidential and > >> > >>>>>>>>intended solely for the use of the individual or entity > >>>>>>>> > >>>>>>>> > >>>> > >>>>to whom they > >>>> > >>>> > >>>> > >>>>>>>>are addressed. If you have received this email in error > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>>>please notify > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>the system manager. > >>>>>>>> > >>>>>>>>This footnote confirms that this email message has been swept > >>>>>>>>for the presence of computer viruses and is believed to > >> > >>be clean. > >> > >>>>>>>>************************************************************ > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>>>********** > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>------------------------ MailScanner list > >> > >>------------------------ > >> > >>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>>Before posting, read the Wiki > >> > >>(http://wiki.mailscanner.info/) and > >> > >>>>>>>>the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>>>> > >>>>>>>>Support MailScanner development - buy the book off > the website! > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>> > >>>>>>>------------------------ MailScanner list > >> > >>------------------------ > >> > >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>>the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>>> > >>>>>>>Support MailScanner development - buy the book off the website! > >>>>>>> > >>>>>>> > >>>>>> > >>>>>>************************************************************ > >>>>>> > >>>>>> > >>>> > >>>>********** > >>>> > >>>> > >>>> > >>>>>>This email and any files transmitted with it are > confidential and > >>>>>>intended solely for the use of the individual or entity > >> > >>to whom they > >> > >>>>>>are addressed. If you have received this email in error > >>>>>> > >>>>>> > >>>> > >>>>please notify > >>>> > >>>> > >>>> > >>>>>>the system manager. > >>>>>> > >>>>>>This footnote confirms that this email message has been swept > >>>>>>for the presence of computer viruses and is believed to > be clean. > >>>>>> > >>>>>>************************************************************ > >>>>>> > >>>>>> > >>>> > >>>>********** > >>>> > >>>> > >>>> > >>>>>>------------------------ MailScanner list > ------------------------ > >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>'leave mailscanner' in the body of the email. > >>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>> > >>>>>>Support MailScanner development - buy the book off the website! > >>>>>> > >>>>>> > >>>>>> > >>>>> > >>>>>------------------------ MailScanner list > ------------------------ > >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>'leave mailscanner' in the body of the email. > >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>> > >>>>>Support MailScanner development - buy the book off the website! > >>>>> > >>>>> > >>>> > >>>>************************************************************ > >> > >>********** > >> > >>>>This email and any files transmitted with it are confidential and > >>>>intended solely for the use of the individual or entity > to whom they > >>>>are addressed. If you have received this email in error > >> > >>please notify > >> > >>>>the system manager. > >>>> > >>>>This footnote confirms that this email message has been swept > >>>>for the presence of computer viruses and is believed to be clean. > >>>> > >>>>************************************************************ > >> > >>********** > >> > >>>>------------------------ MailScanner list ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>>> > >>>> > >>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>> > >>> > >> > >>-- > >>Julian Field > >>www.MailScanner.info > >>Buy the MailScanner book at www.MailScanner.info/store > >> > >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > > > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 15 14:39:36 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: Adri I've been running the MW.pm in the CustomFunctions dir for a while, but I run the tar version not JP's port-ed version (not that that should make much difference). Unless of course there's some sort of file-length problem going on here. Try changing the CustomFunctions dir to something like /opt/Mailscanner/lib/MailScanner/CustomFunctions which is slightly shorter and works for me.. /usr/local/lib/MailScanner/MailScanner/CustomFunctions -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > Martin, > > In MailScanner.conf I have: > > Custom Functions Dir = > /usr/local/lib/MailScanner/MailScanner/CustomFunctions > > Which is the directory I had copied MailWatch.pm. > I switched from the require 'MailScanner/MaiLWatch.pm' syntax to the > CustomFunctions directory and automatic loading during the upgrade to > 4.40.11. > With versions 4.39.6 and earlier, I used the require > 'MailScanner/MailWatch.pm', which always works. > I don't know if I would have had the same problem with version eariler then > 4.40.11 and putting the MailWatch.pm in the CustomFunctions directory. > > Adri. > > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: 15 April, 2005 15:11 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner 4.40.11 restarting after every batch >> >> >>Adri >> >>most odd.. >> >>and you've definitely got >> >>Custom Functions Dir = >>/opt/MailScanner/lib/MailScanner/CustomFunctions >> >>or where-ever you need to put the CustomFunctions dir.. >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Adri Koppes wrote: >> >>>Julian, >>> >>>Here's the output. Seems it can't call MailWatchLogging, >> >>eventhough the >> >>>MailWatchInit is getting callled. >>> >>>Adri. >>> >>> >>>Starting MailScanner... >>>In Debugging mode, not forking... >>>SA bayes lock is /usr/local/etc/mail/spamassassin/bayes.lock >>>Bayes lock is at /usr/local/etc/mail/spamassassin/bayes.lock >>>Use of uninitialized value in numeric ne (!=) at >>>/usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 88. >>>Use of uninitialized value in numeric ne (!=) at >>>/usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 97. >>>INFO:: Meaningless output that goes nowhere, to keep SAVI happy >>>Use of uninitialized value in hash element at >>>/usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. >>>Use of uninitialized value in hash element at >>>/usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. >>>Use of uninitialized value in pattern match (m//) at >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. >>>Use of uninitialized value in pattern match (m//) at >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. >>>Use of uninitialized value in addition (+) at >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. >>>Use of uninitialized value in pattern match (m//) at >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. >>>Use of uninitialized value in int at >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. >>>Use of uninitialized value in addition (+) at >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. >>>Undefined subroutine >> >>&MailScanner::CustomConfig::MailWatchLogging called at >> >>>/usr/local/lib/MailScanner/MailScanner/Config.pm line 121. >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>>>Sent: 15 April, 2005 14:52 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>> >>>> >>>>Get it in a state where it isn't working by putting it back to the >>>>layout you started with. Then kill MailScanner. Then set >> >>"Debug = yes" >> >>>>in MailScanner.conf and restart MailScanner. >>>> service MailScanner stop >>>>then edit MailScanner.conf >>>>then >>>> service MailScanner startin >>>> service MailScanner startout >>>>then test MailScanner with >>>> check_MailScanner >>>>and look for any error messages. It should pickup and process >>>>1 batch of >>>>messages and then stop. >>>>Then put it back to normal by setting "Debug = no" in >> >>MailScanner.conf >> >>>>and then >>>> service MailScanner restart >>>>and you will be running normally again. >>>> >>>>Hopefully the error messages it prints will give you some >> >>idea of what >> >>>>is really wrong. >>>> >>>>Adri Koppes wrote: >>>> >>>> >>>> >>>>>Martin, >>>>> >>>>>hmmm seems the cause is a different one! >>>>>I just moved the MailWatch.pm from CustomFunctions backup >>>> >>>>and inserted a >>>> >>>> >>>>>'require MailScanner/Mailwatch.pm' in CustomConfig.pm. >>>>>Restarted MailScanner and now it seems to work fine again.... >>>>>Looks like there's something funny happening, when the >>>> >>>>MailWatch.pm is auto >>>> >>>> >>>>>loaded by MS from the CustomFunctions directory. >>>>> >>>>>Adri. >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>-----Original Message----- >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>>>Sent: 15 April, 2005 14:35 >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>>>> >>>>>> >>>>>>Adri >>>>>> >>>>>>hmm well looks like that's the problem then, even if it did >>>>>>work with 4.39 >>>>>> >>>>>>try Walker Aumann's modified version of MailWatch.pm and see >>>>>>if you get >>>>>>the same results.. >>>>>> >>>>>>-- >>>>>>Martin Hepworth >>>>>>Snr Systems Administrator >>>>>>Solid State Logic >>>>>>Tel: +44 (0)1865 842300 >>>>>> >>>>>> >>>>>>Adri Koppes wrote: >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>Martin, >>>>>>> >>>>>>>Just commented out the Always Lookup Last to diable >>>> >>>>MailWatch and no >>>> >>>> >>>>>>>restarts in the last 10 min. >>>>>>>Before commenting it out, MailWatch was still logging >>>>>>> >>>>>>> >>>>>> >>>>>>properly, despite the >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>restarts. >>>>>>> >>>>>>>Adri. >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>>>-----Original Message----- >>>>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>>>>>Sent: 15 April, 2005 14:08 >>>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>>>>>> >>>>>>>> >>>>>>>>Adri >>>>>>>> >>>>>>>>is logging to the mysql DB for Mailwatch OK?? >>>>>>>> >>>>>>>>What happens if you take out the Call to MailWatch.PM in >>>>>>>>"Always Looked >>>>>>>>Up Last" >>>>>>>> >>>>>>>>-- >>>>>>>>Martin Hepworth >>>>>>>>Snr Systems Administrator >>>>>>>>Solid State Logic >>>>>>>>Tel: +44 (0)1865 842300 >>>>>>>> >>>>>>>> >>>>>>>>Adri Koppes wrote: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>Martin, >>>>>>>>> >>>>>>>>>I can see MS starting all it's children (3 in my >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>configuration) on the >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>install startup. >>>>>>>>>Then after each batch, MS delivers the messages and I can >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>see it restarting, >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>using a different PID each time. >>>>>>>>>Checking the previous child seems to have died, since I >>>> >>>>only see 3 >>>> >>>> >>>>>>>>>mailscanner processes in ps/top. >>>>>>>>> >>>>>>>>>Adri. >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>>>-----Original Message----- >>>>>>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>>>>>>>>>Sent: 15 April, 2005 13:47 >>>>>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>Adri >>>>>>>>>> >>>>>>>>>>you sure this isn't just MS starting all it's >> >>children? How many >> >>>>>>>>>>Children should it be starting? >>>>>>>>>> >>>>>>>>>>have you looked ove the last 30 minutes or so and >> >>made sure the >> >>>>>>>>>>processed ID's are being reused in the logs. >>>>>>>>>> >>>>>>>>>>-- >>>>>>>>>>Martin Hepworth >>>>>>>>>>Snr Systems Administrator >>>>>>>>>>Solid State Logic >>>>>>>>>>Tel: +44 (0)1865 842300 >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>Adri Koppes wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>Hi, >>>>>>>>>>> >>>>>>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>using portupgrade >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>and the port made by J. Koopman. >>>>>>>>>>>Before I was running 4.39.6 without any problems, but after >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>the upgrade, >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>MailScanner seems to restart every time it completes a >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>batch, without any >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>errors or calling any Csutom End Functions. >>>>>>>>>>>I also have MailWatch 0.5.1 installed with the custom >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>MailWatch.pm module in >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>the CustomFunctions directory. >>>>>>>>>>>Here's a snip from the maillog >>>>>>>>>>> >>>>>>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>1 messages, 4207 >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>bytes >>>>>>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>Scanning: Starting >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>Delivered 1 messages >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>to=, >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, pri=123217, >>>>>>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, stat=Sent (OK) >>>>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>Virus Scanner >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>version >>>>>>>>>>>4.40.11 starting... >>>>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>custom init function >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>MailWatchLogging >>>>>>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>SpamAssassin auto-whitelist >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>functionality... >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>(engine 2.28) >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>recognizing 102051 viruses >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>180 IDE files >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>using unrar command >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>/usr/local/bin/unrar >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using >> >>locktype = flock >> >>>>>>>>>>>Otherwise MailScanner is working ok, all ail gets scanned >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>>and delivered. >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>>>Any ideas what might be causing this? >>>>>>>>>>>Thanks, >>>>>>>>>>> >>>>>>>>>>>Adri. >>>>>>>>>>> >>>>>>>>>>>------------------------ MailScanner list >>>>>>>>>>> >>>>>>>>>>> >>>>>> >>>>>>------------------------ >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>>>>>'leave mailscanner' in the body of the email. >>>>>>>>>>>Before posting, read the Wiki >>>> >>>>(http://wiki.mailscanner.info/) and >>>> >>>> >>>>>>>>>>>the archives >>>> >>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> >>>>>>>>>>>Support MailScanner development - buy the book off >> >>the website! >> >>>>>>>>>>> >>>>>>>>>>************************************************************ >>>>>>>>>> >>>>>>>>>> >>>>>>>> >>>>>>>>********** >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>>This email and any files transmitted with it are >>>> >>>>confidential and >>>> >>>> >>>>>>>>>>intended solely for the use of the individual or entity >>>>>>>>>> >>>>>>>>>> >>>>>> >>>>>>to whom they >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>>>are addressed. If you have received this email in error >>>>>>>>>> >>>>>>>>>> >>>>>>>> >>>>>>>>please notify >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>>the system manager. >>>>>>>>>> >>>>>>>>>>This footnote confirms that this email message has been swept >>>>>>>>>>for the presence of computer viruses and is believed to >>>> >>>>be clean. >>>> >>>> >>>>>>>>>>************************************************************ >>>>>>>>>> >>>>>>>>>> >>>>>>>> >>>>>>>>********** >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>>>>------------------------ MailScanner list >>>> >>>>------------------------ >>>> >>>> >>>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>>>>'leave mailscanner' in the body of the email. >>>>>>>>>>Before posting, read the Wiki >>>> >>>>(http://wiki.mailscanner.info/) and >>>> >>>> >>>>>>>>>>the archives >> >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>>>>>>>>>Support MailScanner development - buy the book off >> >>the website! >> >>>>>>>>>> >>>>>>>>>> >>>>>>>>>------------------------ MailScanner list >>>> >>>>------------------------ >>>> >>>> >>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>>>'leave mailscanner' in the body of the email. >>>>>>>>>Before posting, read the Wiki >> >>(http://wiki.mailscanner.info/) and >> >>>>>>>>>the archives >> >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>>>>>>>>Support MailScanner development - buy the book off the website! >>>>>>>>> >>>>>>>>> >>>>>>>> >>>>>>>>************************************************************ >>>>>>>> >>>>>>>> >>>>>> >>>>>>********** >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>This email and any files transmitted with it are >> >>confidential and >> >>>>>>>>intended solely for the use of the individual or entity >>>> >>>>to whom they >>>> >>>> >>>>>>>>are addressed. If you have received this email in error >>>>>>>> >>>>>>>> >>>>>> >>>>>>please notify >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>the system manager. >>>>>>>> >>>>>>>>This footnote confirms that this email message has been swept >>>>>>>>for the presence of computer viruses and is believed to >> >>be clean. >> >>>>>>>>************************************************************ >>>>>>>> >>>>>>>> >>>>>> >>>>>>********** >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>>>------------------------ MailScanner list >> >>------------------------ >> >>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>>'leave mailscanner' in the body of the email. >>>>>>>>Before posting, read the Wiki >> >>(http://wiki.mailscanner.info/) and >> >>>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>>>> >>>>>>>>Support MailScanner development - buy the book off the website! >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> >>>>>>>------------------------ MailScanner list >> >>------------------------ >> >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>>'leave mailscanner' in the body of the email. >>>>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>>> >>>>>>>Support MailScanner development - buy the book off the website! >>>>>>> >>>>>>> >>>>>> >>>>>>************************************************************ >>>> >>>>********** >>>> >>>> >>>>>>This email and any files transmitted with it are confidential and >>>>>>intended solely for the use of the individual or entity >> >>to whom they >> >>>>>>are addressed. If you have received this email in error >>>> >>>>please notify >>>> >>>> >>>>>>the system manager. >>>>>> >>>>>>This footnote confirms that this email message has been swept >>>>>>for the presence of computer viruses and is believed to be clean. >>>>>> >>>>>>************************************************************ >>>> >>>>********** >>>> >>>> >>>>>>------------------------ MailScanner list ------------------------ >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>>'leave mailscanner' in the body of the email. >>>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>> >>>>>>Support MailScanner development - buy the book off the website! >>>>>> >>>>>> >>>>>> >>>>> >>>>>------------------------ MailScanner list ------------------------ >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>'leave mailscanner' in the body of the email. >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>> >>>>-- >>>>Julian Field >>>>www.MailScanner.info >>>>Buy the MailScanner book at www.MailScanner.info/store >>>> >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>>------------------------ MailScanner list ------------------------ >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>> >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Fri Apr 15 17:47:29 2005 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:29:20 2006 Subject: IP phishing false positive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MailScanner is warning about phishing fraud for links that contain IP addresses even if the IP address matches the display text. Example: MailScanner has detected a possible fraud attempt from "192.168.1.1" claming to be http://192.168.1.1 MailScanner 4.40.11-1 -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Fri Apr 15 18:40:02 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:20 2006 Subject: IP phishing false positive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mark Nienberg wrote: > MailScanner is warning about phishing fraud for links that contain IP > addresses even if the IP address matches the display text. > Example: > > MailScanner has detected a possible fraud attempt from "192.168.1.1" > claming to be http://192.168.1.1 > > MailScanner 4.40.11-1 > Marc, This is probably why: # While detecting "Phishing" attacks, do you also want to point out links # to numeric IP addresses. Genuine links to totally numeric IP addresses # are very rare, so this option is set to "yes" by default. If a numeric # IP address is found in a link, the same phishing warning message is used # as in the Find Phishing Fraud option above. # This can also be the filename of a ruleset. Also Find Numeric Phishing = yes Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mark at TIPPINGMAR.COM Fri Apr 15 20:30:44 2005 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:29:20 2006 Subject: IP phishing false positive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Mark Nienberg wrote: > >> MailScanner is warning about phishing fraud for links that contain IP >> addresses even if the IP address matches the display text. >> Example: >> >> MailScanner has detected a possible fraud attempt from "192.168.1.1" >> claming to be http://192.168.1.1 >> >> MailScanner 4.40.11-1 >> > Marc, > > This is probably why: > # While detecting "Phishing" attacks, do you also want to point out links > # to numeric IP addresses. Genuine links to totally numeric IP addresses > # are very rare, so this option is set to "yes" by default. If a numeric > # IP address is found in a link, the same phishing warning message is > used > # as in the Find Phishing Fraud option above. > # This can also be the filename of a ruleset. > Also Find Numeric Phishing = yes > > Denis > I think it should first make sure the link and the display name are different before it flags as fraudulent. There is no fraud attempt if the two match. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 16 11:04:00 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: IP phishing false positive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Aargh, my first false positive in months! It found the numeric IP addresses mentioned in my previous reply to this thread, discovered I had put too large a score (6) on the NORMAL_HTTP_TO_IP rule and binned the message. Oops. For any others who also didn't get my reply, here it is (more or less) again: I have changed the phishing net so that it marks numerical links (where the two numbers match) with a different warning message. Add this to your /etc/MailScanner/reports/en/languages.conf (or equivalent) file: NumericLinkWarning = MailScanner warning: numerical links are often malicious: (That should all be on 1 line) and apply the attached patch to your Message.pm. This is for 4.40-11 and I don't guarantee your success if you try to apply the patch to other versions unless you do it by hand. Mark Nienberg wrote: > Denis Beauchemin wrote: > >> Mark Nienberg wrote: >> >>> MailScanner is warning about phishing fraud for links that contain IP >>> addresses even if the IP address matches the display text. >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-GZIP 1.5KB. ] [ Unable to print this part. ] From derrilh at gmail.com Sun Apr 17 05:05:48 2005 From: derrilh at gmail.com (Derril Hedk) Date: Thu Jan 12 21:29:20 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, Some of my customers are receiving the following notice: Could not parse Outlook Rich Text attachment as part of a blocked email. I am wondering if there is any way to turn this feature off so that it doesn't even try to parse the email? Derril ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sun Apr 17 12:44:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Derril Hedk wrote: >Hello, > >Some of my customers are receiving the following notice: > >Could not parse Outlook Rich Text attachment > >as part of a blocked email. I am wondering if there is any way to turn >this feature off so that it doesn't even try to parse the email? > > 2 answers: 1) Try "TNEF Expander = internal" as the internal one, while slower, is more flexible in what it can parse. 2) If that doesn't help, then just set "Expand TNEF = no" to disable TNEF expansion completely. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sun Apr 17 17:37:28 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:20 2006 Subject: System denying relay attemts fro external hosts Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, My new system will not accept any new mail from external hosts to deliver mail for the domains I host. It says relaying denied I have edited the mailertable file and restarted the machine. Is there something I am not doing? I have a SUSE 9.2 machine with the latest MS version Thanks Lance -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.9.13 - Release Date: 16/04/2005 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From danielk at AVALONPUB.COM Sun Apr 17 17:51:53 2005 From: danielk at AVALONPUB.COM (Daniel Kleinsinger) Date: Thu Jan 12 21:29:20 2006 Subject: System denying relay attemts fro external hosts Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Hi, > My new system will not accept any new mail from external hosts to > deliver mail for the domains I host. > > It says relaying denied > > I have edited the mailertable file and restarted the machine. Is there > something I am not doing? Add the domains to access or relay-domains? Daniel ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Sun Apr 17 17:57:53 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:20 2006 Subject: System denying relay attemts fro external hosts Message-ID: Lance Haig wrote: > Hi, > My new system will not accept any new mail from external hosts to > deliver mail for the domains I host. > > It says relaying denied > > I have edited the mailertable file and restarted the machine. Is > there something I am not doing? > > I have a SUSE 9.2 machine with the latest MS version > > Thanks > > Lance Did you add any domains to local-host-names or relay-domains? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sun Apr 17 18:55:07 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:20 2006 Subject: System denying relay attemts fro external hosts Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Duuuhhhh I am a moron Thanks Lance Daniel Kleinsinger wrote: > Lance Haig wrote: > >> Hi, >> My new system will not accept any new mail from external hosts to >> deliver mail for the domains I host. >> >> It says relaying denied >> >> I have edited the mailertable file and restarted the machine. Is there >> something I am not doing? > > > Add the domains to access or relay-domains? > > Daniel > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.308 / Virus Database: 266.9.13 - Release Date: 16/04/2005 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From P.G.M.Peters at UTWENTE.NL Mon Apr 18 07:34:48 2005 From: P.G.M.Peters at UTWENTE.NL (Peter Peters) Date: Thu Jan 12 21:29:20 2006 Subject: Version 4.40.11-1 not honoring rules? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote on 13-4-2005 23:23: > There was a bug in previous versions where it would do a "first matches" > rule check on the ruleset for "Virus Scanning", which meant it would > scan the message if the "first" recipient in the message requested > scanning. > > It now scans a message if any of the recipients asked for it to be scanned. It also happens when it's only one recipient who, according to the rules, doesn't want scanning. > Peter Peters wrote: > >> Since the upgrade to 4.40.11-1 MS seems to scan everything for virusses >> and spam. Default in rules-files is no. Only some domains are scanned >> according to the rules. After upgrading MS scans all e-mail. >> >> Before the upgrade the log contained lines showing "unscanned" messages. >> After the upgrade no more "unscanned" messages are logged and users are >> complaining about their messages beeing scanned. -- Peter Peters, senior beheerder (Security) Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) Universiteit Twente, Postbus 217, 7500 AE Enschede telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Mon Apr 18 08:04:19 2005 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:29:20 2006 Subject: IP phishing false positive Message-ID: >-----Original Message----- >From: MailScanner mailing list >[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field >Sent: 16 April 2005 09:06 >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: IP phishing false positive > [snip] >Add this to your /etc/MailScanner/reports/en/languages.conf (or >equivalent) file: >NumericLinkWarning = MailScanner warning: >numerical >links are often malicious: >(That should all be on 1 line) > >and apply the attached patch to your Message.pm. > >This is for 4.40-11 and I don't guarantee your success if you try to >apply the patch to other versions unless you do it by hand. > >Hopefully this solves the problem okay. Julian Where will I find a downloadable version of MS with all these latest changes/fixes? The "Beta releases for testing" page cannot be accessed on the MailScanner web site. I am about to upgrade MS and want all the latest features & fixes since 4.40-11 was announced. Quentin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 09:01:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: Version 4.40.11-1 not honoring rules? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What MTA are you using? Peter Peters wrote: > Julian Field wrote on 13-4-2005 23:23: > >> There was a bug in previous versions where it would do a "first matches" >> rule check on the ruleset for "Virus Scanning", which meant it would >> scan the message if the "first" recipient in the message requested >> scanning. >> >> It now scans a message if any of the recipients asked for it to be >> scanned. > > > It also happens when it's only one recipient who, according to the > rules, doesn't want scanning. > >> Peter Peters wrote: >> >>> Since the upgrade to 4.40.11-1 MS seems to scan everything for virusses >>> and spam. Default in rules-files is no. Only some domains are scanned >>> according to the rules. After upgrading MS scans all e-mail. >>> >>> Before the upgrade the log contained lines showing "unscanned" >>> messages. >>> After the upgrade no more "unscanned" messages are logged and users are >>> complaining about their messages beeing scanned. >> > > -- > Peter Peters, senior beheerder (Security) > Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) > Universiteit Twente, Postbus 217, 7500 AE Enschede > telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 09:40:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: Version 4.40.11-1 not honoring rules? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Try this change for SweepViruses.pm: -----SNIP----- --- SweepViruses.pm.old 2005-03-07 21:01:27.000000000 +0000 +++ SweepViruses.pm 2005-04-18 09:38:15.416751930 +0100 @@ -666,6 +666,7 @@ while(defined($id = $BaseDirH->read())) { next unless -d "$id"; # Only check directories next if $id =~ /^\.+$/; # Don't check myself or my parent + next unless MailScanner::Config::Value('virusscan',$batch->{messages}{id}) =~ /1/; # The "./" is important as it gets the path right for parser code $success = TryCommercial("./$id", $BaseDir, \%Reports, \%Types, \$NumInfections, $ScanType); @@ -710,6 +711,8 @@ #print STDERR "Report merging for \"$id\" and \"$reports\"\n"; next unless $id && $reports; my $message = $batch->{messages}{"$id"}; + # Skip this message if we didn't actually want it to be scanned. + next unless MailScanner::Config::Value('virusscan', $message); #print STDERR "Message is $message\n"; $message->{virusinfected} = 1; -----SNIP----- As soon as you can confirm this works for you, I will put out a beta (for Quentin). Julian Field wrote: > What MTA are you using? > > Peter Peters wrote: > >> Julian Field wrote on 13-4-2005 23:23: >> >>> There was a bug in previous versions where it would do a "first >>> matches" >>> rule check on the ruleset for "Virus Scanning", which meant it would >>> scan the message if the "first" recipient in the message requested >>> scanning. >>> >>> It now scans a message if any of the recipients asked for it to be >>> scanned. >> >> >> >> It also happens when it's only one recipient who, according to the >> rules, doesn't want scanning. >> >>> Peter Peters wrote: >>> >>>> Since the upgrade to 4.40.11-1 MS seems to scan everything for >>>> virusses >>>> and spam. Default in rules-files is no. Only some domains are scanned >>>> according to the rules. After upgrading MS scans all e-mail. >>>> >>>> Before the upgrade the log contained lines showing "unscanned" >>>> messages. >>>> After the upgrade no more "unscanned" messages are logged and users >>>> are >>>> complaining about their messages beeing scanned. >>> >>> >> >> -- >> Peter Peters, senior beheerder (Security) >> Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE) >> Universiteit Twente, Postbus 217, 7500 AE Enschede >> telefoon: 053 - 489 2301, fax: 053 - 489 2383, >> http://www.utwente.nl/itbe >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 09:41:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: IP phishing false positive Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Quentin Campbell wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field >>Sent: 16 April 2005 09:06 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: IP phishing false positive >> >> >> >[snip] > > >>Add this to your /etc/MailScanner/reports/en/languages.conf (or >>equivalent) file: >>NumericLinkWarning = MailScanner warning: >>numerical >>links are often malicious: >>(That should all be on 1 line) >> >>and apply the attached patch to your Message.pm. >> >>This is for 4.40-11 and I don't guarantee your success if you try to >>apply the patch to other versions unless you do it by hand. >> >>Hopefully this solves the problem okay. >> >> > >Julian > >Where will I find a downloadable version of MS with all these latest >changes/fixes? > >The "Beta releases for testing" page cannot be accessed on the >MailScanner web site. > >I am about to upgrade MS and want all the latest features & fixes since >4.40-11 was announced. > > > I will put out a beta shortly, once Peter Peters reports news about the change I just posted. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner at MANGO.ZW Mon Apr 18 11:53:58 2005 From: mailscanner at MANGO.ZW (Jim Holland) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner response to ClamAV output on empty attachments Message-ID: Hi Julian I am currently using: Sendmail 8.13.1 MailScanner version 4.40.11 ClamAV 0.84rc1 I often notice the following types of entries in the maillog file: Apr 17 09:50:17 mail MailScanner[1923]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/1923/./j3H7kTGh004659/msg-1923-68.txt: Empty file". Please contact the authors! Apr 17 09:53:53 mail MailScanner[1954]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/1954/./j3H7qfHA008171/msg-1954-78.txt: Empty file". Please contact the authors! Apr 17 09:54:52 mail MailScanner[1954]: ProcessClamAVOutput: unrecognised line "/var/spool/MailScanner/incoming/1954/./j3H7ru4K008605/readme.pif: Empty file". Please contact the authors! As far as I can see, these are simply redundant reports by MailScanner when an empty attachment is found. The notice "Please contact the authors!" seems a little alarmist unless there are some situations where action really does need to be taken. May I suggest that it would be better not to scan empty attachments at all? That would save time and also avoid the above error message. Regards Jim Holland System Administrator MANGO - Zimbabwe's non-profit e-mail service ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 11:59:40 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner response to ClamAV output on empty attachments Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The message is a bit alarmist, but it could well be a result of the ClamAV guys seriously changing their output format or something like that, so I try to make sure you folks keep me ahead of the game. To get rid of this one, change SweepViruses.pm line 2333 to this return 0 if /Empty file\.?$/; which is 2 characters different from what it said before. Jim Holland wrote: >Hi Julian > >I am currently using: > > Sendmail 8.13.1 > MailScanner version 4.40.11 > ClamAV 0.84rc1 > >I often notice the following types of entries in the maillog file: > >Apr 17 09:50:17 mail MailScanner[1923]: ProcessClamAVOutput: unrecognised line >"/var/spool/MailScanner/incoming/1923/./j3H7kTGh004659/msg-1923-68.txt: >Empty file". Please contact the authors! > >Apr 17 09:53:53 mail MailScanner[1954]: ProcessClamAVOutput: unrecognised line >"/var/spool/MailScanner/incoming/1954/./j3H7qfHA008171/msg-1954-78.txt: >Empty file". Please contact the authors! > >Apr 17 09:54:52 mail MailScanner[1954]: ProcessClamAVOutput: unrecognised >line "/var/spool/MailScanner/incoming/1954/./j3H7ru4K008605/readme.pif: >Empty file". Please contact the authors! > >As far as I can see, these are simply redundant reports by MailScanner >when an empty attachment is found. The notice "Please contact the >authors!" seems a little alarmist unless there are some situations where >action really does need to be taken. May I suggest that it would be >better not to scan empty attachments at all? That would save time and >also avoid the above error message. > >Regards > >Jim Holland >System Administrator >MANGO - Zimbabwe's non-profit e-mail service > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Mon Apr 18 13:15:48 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:20 2006 Subject: MailScanner 4.40.11 restarting after every batch Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, I had a close look at MailWatch.pm, comparing it with other CustomFunction modules and I noticed MailWatch.pm did NOT include the 'package MailScanner::CustomConfig;' line at the top. All other modules privoded by MS did have it included. Is your MW.pm module the original MailWatch 0.5.1 version or did you make some changes? Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 15 April, 2005 15:40 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner 4.40.11 restarting after every batch > > > Adri > > I've been running the MW.pm in the CustomFunctions dir for a > while, but > I run the tar version not JP's port-ed version (not that that should > make much difference). > > Unless of course there's some sort of file-length problem > going on here. > > Try changing the CustomFunctions dir to something like > /opt/Mailscanner/lib/MailScanner/CustomFunctions which is slightly > shorter and works for me.. > /usr/local/lib/MailScanner/MailScanner/CustomFunctions > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > Martin, > > > > In MailScanner.conf I have: > > > > Custom Functions Dir = > > /usr/local/lib/MailScanner/MailScanner/CustomFunctions > > > > Which is the directory I had copied MailWatch.pm. > > I switched from the require 'MailScanner/MaiLWatch.pm' syntax to the > > CustomFunctions directory and automatic loading during the > upgrade to > > 4.40.11. > > With versions 4.39.6 and earlier, I used the require > > 'MailScanner/MailWatch.pm', which always works. > > I don't know if I would have had the same problem with > version eariler then > > 4.40.11 and putting the MailWatch.pm in the CustomFunctions > directory. > > > > Adri. > > > > > > > >>-----Original Message----- > >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>Sent: 15 April, 2005 15:11 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: MailScanner 4.40.11 restarting after every batch > >> > >> > >>Adri > >> > >>most odd.. > >> > >>and you've definitely got > >> > >>Custom Functions Dir = > >>/opt/MailScanner/lib/MailScanner/CustomFunctions > >> > >>or where-ever you need to put the CustomFunctions dir.. > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Adri Koppes wrote: > >> > >>>Julian, > >>> > >>>Here's the output. Seems it can't call MailWatchLogging, > >> > >>eventhough the > >> > >>>MailWatchInit is getting callled. > >>> > >>>Adri. > >>> > >>> > >>>Starting MailScanner... > >>>In Debugging mode, not forking... > >>>SA bayes lock is /usr/local/etc/mail/spamassassin/bayes.lock > >>>Bayes lock is at /usr/local/etc/mail/spamassassin/bayes.lock > >>>Use of uninitialized value in numeric ne (!=) at > >>>/usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 88. > >>>Use of uninitialized value in numeric ne (!=) at > >>>/usr/local/lib/MailScanner/MailScanner/WorkArea.pm line 97. > >>>INFO:: Meaningless output that goes nowhere, to keep SAVI happy > >>>Use of uninitialized value in hash element at > >>>/usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 158. > >>>Use of uninitialized value in hash element at > >>>/usr/local/lib/MailScanner/MailScanner/SweepOther.pm line 342. > >>>Use of uninitialized value in pattern match (m//) at > >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > >>>Use of uninitialized value in pattern match (m//) at > >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > >>>Use of uninitialized value in addition (+) at > >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4364. > >>>Use of uninitialized value in pattern match (m//) at > >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 4347. > >>>Use of uninitialized value in int at > >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 3404. > >>>Use of uninitialized value in addition (+) at > >>>/usr/local/lib/MailScanner/MailScanner/Message.pm line 3408. > >>>Undefined subroutine > >> > >>&MailScanner::CustomConfig::MailWatchLogging called at > >> > >>>/usr/local/lib/MailScanner/MailScanner/Config.pm line 121. > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>>>Sent: 15 April, 2005 14:52 > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>> > >>>> > >>>>Get it in a state where it isn't working by putting it back to the > >>>>layout you started with. Then kill MailScanner. Then set > >> > >>"Debug = yes" > >> > >>>>in MailScanner.conf and restart MailScanner. > >>>> service MailScanner stop > >>>>then edit MailScanner.conf > >>>>then > >>>> service MailScanner startin > >>>> service MailScanner startout > >>>>then test MailScanner with > >>>> check_MailScanner > >>>>and look for any error messages. It should pickup and process > >>>>1 batch of > >>>>messages and then stop. > >>>>Then put it back to normal by setting "Debug = no" in > >> > >>MailScanner.conf > >> > >>>>and then > >>>> service MailScanner restart > >>>>and you will be running normally again. > >>>> > >>>>Hopefully the error messages it prints will give you some > >> > >>idea of what > >> > >>>>is really wrong. > >>>> > >>>>Adri Koppes wrote: > >>>> > >>>> > >>>> > >>>>>Martin, > >>>>> > >>>>>hmmm seems the cause is a different one! > >>>>>I just moved the MailWatch.pm from CustomFunctions backup > >>>> > >>>>and inserted a > >>>> > >>>> > >>>>>'require MailScanner/Mailwatch.pm' in CustomConfig.pm. > >>>>>Restarted MailScanner and now it seems to work fine again.... > >>>>>Looks like there's something funny happening, when the > >>>> > >>>>MailWatch.pm is auto > >>>> > >>>> > >>>>>loaded by MS from the CustomFunctions directory. > >>>>> > >>>>>Adri. > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>>>-----Original Message----- > >>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>Sent: 15 April, 2005 14:35 > >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>>>> > >>>>>> > >>>>>>Adri > >>>>>> > >>>>>>hmm well looks like that's the problem then, even if it did > >>>>>>work with 4.39 > >>>>>> > >>>>>>try Walker Aumann's modified version of MailWatch.pm and see > >>>>>>if you get > >>>>>>the same results.. > >>>>>> > >>>>>>-- > >>>>>>Martin Hepworth > >>>>>>Snr Systems Administrator > >>>>>>Solid State Logic > >>>>>>Tel: +44 (0)1865 842300 > >>>>>> > >>>>>> > >>>>>>Adri Koppes wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>Martin, > >>>>>>> > >>>>>>>Just commented out the Always Lookup Last to diable > >>>> > >>>>MailWatch and no > >>>> > >>>> > >>>>>>>restarts in the last 10 min. > >>>>>>>Before commenting it out, MailWatch was still logging > >>>>>>> > >>>>>>> > >>>>>> > >>>>>>properly, despite the > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>restarts. > >>>>>>> > >>>>>>>Adri. > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>>>-----Original Message----- > >>>>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>>>Sent: 15 April, 2005 14:08 > >>>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>>>Subject: Re: MailScanner 4.40.11 restarting after every batch > >>>>>>>> > >>>>>>>> > >>>>>>>>Adri > >>>>>>>> > >>>>>>>>is logging to the mysql DB for Mailwatch OK?? > >>>>>>>> > >>>>>>>>What happens if you take out the Call to MailWatch.PM in > >>>>>>>>"Always Looked > >>>>>>>>Up Last" > >>>>>>>> > >>>>>>>>-- > >>>>>>>>Martin Hepworth > >>>>>>>>Snr Systems Administrator > >>>>>>>>Solid State Logic > >>>>>>>>Tel: +44 (0)1865 842300 > >>>>>>>> > >>>>>>>> > >>>>>>>>Adri Koppes wrote: > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>Martin, > >>>>>>>>> > >>>>>>>>>I can see MS starting all it's children (3 in my > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>configuration) on the > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>install startup. > >>>>>>>>>Then after each batch, MS delivers the messages and I can > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>see it restarting, > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>using a different PID each time. > >>>>>>>>>Checking the previous child seems to have died, since I > >>>> > >>>>only see 3 > >>>> > >>>> > >>>>>>>>>mailscanner processes in ps/top. > >>>>>>>>> > >>>>>>>>>Adri. > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>>>-----Original Message----- > >>>>>>>>>>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > >>>>>>>>>>Sent: 15 April, 2005 13:47 > >>>>>>>>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>>>>>Subject: Re: MailScanner 4.40.11 restarting after > every batch > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>Adri > >>>>>>>>>> > >>>>>>>>>>you sure this isn't just MS starting all it's > >> > >>children? How many > >> > >>>>>>>>>>Children should it be starting? > >>>>>>>>>> > >>>>>>>>>>have you looked ove the last 30 minutes or so and > >> > >>made sure the > >> > >>>>>>>>>>processed ID's are being reused in the logs. > >>>>>>>>>> > >>>>>>>>>>-- > >>>>>>>>>>Martin Hepworth > >>>>>>>>>>Snr Systems Administrator > >>>>>>>>>>Solid State Logic > >>>>>>>>>>Tel: +44 (0)1865 842300 > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>Adri Koppes wrote: > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>Hi, > >>>>>>>>>>> > >>>>>>>>>>>I just upgraded to MailScanner 4.40.11 on FreeBSD 4.10, > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>using portupgrade > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>and the port made by J. Koopman. > >>>>>>>>>>>Before I was running 4.39.6 without any problems, but after > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>the upgrade, > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>MailScanner seems to restart every time it completes a > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>batch, without any > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>errors or calling any Csutom End Functions. > >>>>>>>>>>>I also have MailWatch 0.5.1 installed with the custom > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>MailWatch.pm module in > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>the CustomFunctions directory. > >>>>>>>>>>>Here's a snip from the maillog > >>>>>>>>>>> > >>>>>>>>>>>Apr 15 13:25:07 bsd MailScanner[27422]: New Batch: Scanning > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>1 messages, 4207 > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>bytes > >>>>>>>>>>>Apr 15 13:25:20 bsd MailScanner[27422]: Virus and Content > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>Scanning: Starting > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>Apr 15 13:25:23 bsd MailScanner[27422]: Uninfected: > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>Delivered 1 messages > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>Apr 15 13:25:24 bsd sendmail[27512]: j3FBOQ8S027485: > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>to=, > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>delay=00:00:57, xdelay=00:00:01, mailer=esmtp24, > pri=123217, > >>>>>>>>>>>relay=[192.168.0.3] [192.168.0.3], dsn=2.0.0, > stat=Sent (OK) > >>>>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: MailScanner E-Mail > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>Virus Scanner > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>version > >>>>>>>>>>>4.40.11 starting... > >>>>>>>>>>>Apr 15 13:25:24 bsd MailScanner[27513]: Config: calling > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>custom init function > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>MailWatchLogging > >>>>>>>>>>>Apr 15 13:25:26 bsd MailScanner[27513]: Enabling > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>SpamAssassin auto-whitelist > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>functionality... > >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI 3.91 > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>(engine 2.28) > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>recognizing 102051 viruses > >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: SophosSAVI using > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>180 IDE files > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: ClamAV scanner > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>using unrar command > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>/usr/local/bin/unrar > >>>>>>>>>>>Apr 15 13:25:31 bsd MailScanner[27513]: Using > >> > >>locktype = flock > >> > >>>>>>>>>>>Otherwise MailScanner is working ok, all ail gets scanned > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>and delivered. > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>>Any ideas what might be causing this? > >>>>>>>>>>>Thanks, > >>>>>>>>>>> > >>>>>>>>>>>Adri. > >>>>>>>>>>> > >>>>>>>>>>>------------------------ MailScanner list > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>> > >>>>>>------------------------ > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with > the words: > >>>>>>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>>>>>Before posting, read the Wiki > >>>> > >>>>(http://wiki.mailscanner.info/) and > >>>> > >>>> > >>>>>>>>>>>the archives > >>>> > >>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>> > >>>>>>>>>>>Support MailScanner development - buy the book off > >> > >>the website! > >> > >>>>>>>>>>> > >>>>>>>>>>************************************************************ > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>> > >>>>>>>>********** > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>>This email and any files transmitted with it are > >>>> > >>>>confidential and > >>>> > >>>> > >>>>>>>>>>intended solely for the use of the individual or entity > >>>>>>>>>> > >>>>>>>>>> > >>>>>> > >>>>>>to whom they > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>>>are addressed. If you have received this email in error > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>> > >>>>>>>>please notify > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>>the system manager. > >>>>>>>>>> > >>>>>>>>>>This footnote confirms that this email message has > been swept > >>>>>>>>>>for the presence of computer viruses and is believed to > >>>> > >>>>be clean. > >>>> > >>>> > >>>>>>>>>>************************************************************ > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>> > >>>>>>>>********** > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>>------------------------ MailScanner list > >>>> > >>>>------------------------ > >>>> > >>>> > >>>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with > the words: > >>>>>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>>>>Before posting, read the Wiki > >>>> > >>>>(http://wiki.mailscanner.info/) and > >>>> > >>>> > >>>>>>>>>>the archives > >> > >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>>>>>>>>>Support MailScanner development - buy the book off > >> > >>the website! > >> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>------------------------ MailScanner list > >>>> > >>>>------------------------ > >>>> > >>>> > >>>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>>>Before posting, read the Wiki > >> > >>(http://wiki.mailscanner.info/) and > >> > >>>>>>>>>the archives > >> > >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>>>>>>>>Support MailScanner development - buy the book off > the website! > >>>>>>>>> > >>>>>>>>> > >>>>>>>> > >>>>>>>>************************************************************ > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>>>********** > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>This email and any files transmitted with it are > >> > >>confidential and > >> > >>>>>>>>intended solely for the use of the individual or entity > >>>> > >>>>to whom they > >>>> > >>>> > >>>>>>>>are addressed. If you have received this email in error > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>>>please notify > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>the system manager. > >>>>>>>> > >>>>>>>>This footnote confirms that this email message has been swept > >>>>>>>>for the presence of computer viruses and is believed to > >> > >>be clean. > >> > >>>>>>>>************************************************************ > >>>>>>>> > >>>>>>>> > >>>>>> > >>>>>>********** > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>------------------------ MailScanner list > >> > >>------------------------ > >> > >>>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>>Before posting, read the Wiki > >> > >>(http://wiki.mailscanner.info/) and > >> > >>>>>>>>the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>>>> > >>>>>>>>Support MailScanner development - buy the book off > the website! > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>> > >>>>>>>------------------------ MailScanner list > >> > >>------------------------ > >> > >>>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>>'leave mailscanner' in the body of the email. > >>>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>>the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>>> > >>>>>>>Support MailScanner development - buy the book off the website! > >>>>>>> > >>>>>>> > >>>>>> > >>>>>>************************************************************ > >>>> > >>>>********** > >>>> > >>>> > >>>>>>This email and any files transmitted with it are > confidential and > >>>>>>intended solely for the use of the individual or entity > >> > >>to whom they > >> > >>>>>>are addressed. If you have received this email in error > >>>> > >>>>please notify > >>>> > >>>> > >>>>>>the system manager. > >>>>>> > >>>>>>This footnote confirms that this email message has been swept > >>>>>>for the presence of computer viruses and is believed to > be clean. > >>>>>> > >>>>>>************************************************************ > >>>> > >>>>********** > >>>> > >>>> > >>>>>>------------------------ MailScanner list > ------------------------ > >>>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>>'leave mailscanner' in the body of the email. > >>>>>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and > >>>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>> > >>>>>>Support MailScanner development - buy the book off the website! > >>>>>> > >>>>>> > >>>>>> > >>>>> > >>>>>------------------------ MailScanner list > ------------------------ > >>>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>>'leave mailscanner' in the body of the email. > >>>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>> > >>>>>Support MailScanner development - buy the book off the website! > >>>>> > >>>>> > >>>>> > >>>> > >>>>-- > >>>>Julian Field > >>>>www.MailScanner.info > >>>>Buy the MailScanner book at www.MailScanner.info/store > >>>> > >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>>> > >>>>------------------------ MailScanner list ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>> > >>> > >>>------------------------ MailScanner list ------------------------ > >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been swept > >>for the presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list ------------------------ > >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > > > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ds at CARIBENET.COM Mon Apr 18 15:42:06 2005 From: ds at CARIBENET.COM (Dirk Enrique Seiffert) Date: Thu Jan 12 21:29:20 2006 Subject: SuSE 9.2 rcMailScanner startup script Message-ID: I am running MailScanner 4.40.11 on SuSE 9.2 Professional with a selfcompiled postfix-2.1.5-3.2. Postfix runs in chroot environment. Installation was no problem at all. The SuSE package worked out of the box. as discribed install instructions for postfix on www.mailscanner.info . Staring MailScanner with rcMailScanner start I get: Initializing incoming postfixInitializing outgoing postfix failed But everything works licke a charme, nothing strange in the maillogs. So this is more a cosmetic issue than a tecnical one: I just would like to get rid of this error message. Any ideas? Thanks a lot Enrique -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Mon Apr 18 17:08:05 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:20 2006 Subject: SuSE 9.2 rcMailScanner startup script Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dirk Enrique Seiffert said: > I am running MailScanner 4.40.11 on SuSE 9.2 Professional with a > selfcompiled > postfix-2.1.5-3.2. Postfix runs in chroot environment. Installation was no > problem at all. The SuSE package worked out of the box. as discribed > install > instructions for postfix on www.mailscanner.info . > > Staring MailScanner with rcMailScanner start I get: > > Initializing incoming postfixInitializing outgoing postfix failed I spent a while playing with this. It's because Postfix is started by Suse automatically (And Yast won't let you turn it off) and MailScanner tries to start Postfix as well and gets a failure (Which is what the start up script is reporting). I found by tweeking the start up script I could get rid of the error (Which as you correctly say, is cosmetic). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Mon Apr 18 21:09:03 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:20 2006 Subject: maillog logging level Message-ID: I do not quite understand the new way of MailScanner loggin using the syslog thing. I searched the archives and found that I need to put a -r in there somewhere but that is not enough information for me. Can someone help me out with getting the mailscanner logging back to "old school"? Thank you Billy Pumphrey ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 21:54:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: maillog logging level Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] MailScanner has logged using syslog as far back as I can remember... What is the problem, and what OS are you using? Billy Pumphrey wrote: >I do not quite understand the new way of MailScanner loggin using the syslog >thing. I searched the archives and found that I need to put a -r in there >somewhere but that is not enough information for me. Can someone help me >out with getting the mailscanner logging back to "old school"? > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Mon Apr 18 22:08:01 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:20 2006 Subject: maillog logging level Message-ID: I am using CentOS 4 MailScanner 4.40.11 Spamassassin 3.0.1 In the past before I made my new server, maillog contained entries of all of the mail that went through. Now it just contains a few lines such as: Apr 17 05:10:35 WoodenMS update.virus.scanners: Found generic installed Apr 17 05:10:35 WoodenMS update.virus.scanners: Running autoupdate for generic Apr 17 06:01:01 WoodenMS update.virus.scanners: Delaying cron job up to 600 seco nds Apr 17 06:09:50 WoodenMS update.virus.scanners: Found clamav installed Apr 17 06:09:50 WoodenMS update.virus.scanners: Running autoupdate for clamav Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: ERROR: Please edit the example config file /etc/freshclam.conf. Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: ERROR: Please edit the example config file /etc/clamd.conf. Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: ERROR: Can't parse the config file /etc/clamd.conf Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV updater failed Apr 17 06:09:50 WoodenMS update.virus.scanners: Found generic installed Apr 17 06:09:50 WoodenMS update.virus.scanners: Running autoupdate for generic Apr 17 07:01:01 WoodenMS update.virus.scanners: Delaying cron job up to 600 seco nds Apr 17 07:10:01 WoodenMS update.virus.scanners: Found clamav installed Apr 17 07:10:01 WoodenMS update.virus.scanners: Running autoupdate for clamav Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: ERROR: Please edit the example config file /etc/freshclam.conf. Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: ERROR: Please edit the example config file /etc/clamd.conf. Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: ERROR: Can't parse the config file /etc/clamd.conf Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV updater failed Apr 17 07:10:01 WoodenMS update.virus.scanners: Found generic installed Apr 17 07:10:01 WoodenMS update.virus.scanners: Running autoupdate for generic Apr 17 08:01:01 WoodenMS update.virus.scanners: Delaying cron job up to 600 seco Nds Despite the ClamAV autoupdate error, that is a problem that I didn't see before. > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: Monday, April 18, 2005 3:54 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > MailScanner has logged using syslog as far back as I can remember... > > What is the problem, and what OS are you using? > > Billy Pumphrey wrote: > > >I do not quite understand the new way of MailScanner loggin using the > syslog > >thing. I searched the archives and found that I need to put a -r in > there > >somewhere but that is not enough information for me. Can someone > >help me out with getting the mailscanner logging back to "old school"? > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store Professional > Support Services at www.MailScanner.biz MailScanner thanks transtec > Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: Monday, April 18, 2005 3:54 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > MailScanner has logged using syslog as far back as I can remember... > > What is the problem, and what OS are you using? > > Billy Pumphrey wrote: > > >I do not quite understand the new way of MailScanner loggin using the > syslog > >thing. I searched the archives and found that I need to put a -r in > there > >somewhere but that is not enough information for me. Can someone > >help me out with getting the mailscanner logging back to "old school"? > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store Professional > Support Services at www.MailScanner.biz MailScanner thanks transtec > Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 22:21:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: maillog logging level Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What priority levels are logged in maillog is governed by your /etc/syslog.conf, so start there. Also you need to edit the ClamAV config files so it knows where to find your Clam signature database files for the autoupdating. Billy Pumphrey wrote: >I am using CentOS 4 >MailScanner 4.40.11 >Spamassassin 3.0.1 > >In the past before I made my new server, maillog contained entries of all of >the mail that went through. Now it just contains a few lines such as: > >Apr 17 05:10:35 WoodenMS update.virus.scanners: Found generic installed Apr >17 05:10:35 WoodenMS update.virus.scanners: Running autoupdate for generic >Apr 17 06:01:01 WoodenMS update.virus.scanners: Delaying cron job up to 600 >seco nds Apr 17 06:09:50 WoodenMS update.virus.scanners: Found clamav >installed Apr 17 06:09:50 WoodenMS update.virus.scanners: Running autoupdate >for clamav Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update >warning: >ERROR: >Please edit the example config file /etc/freshclam.conf. >Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: >ERROR: >Please edit the example config file /etc/clamd.conf. >Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: >ERROR: >Can't parse the config file /etc/clamd.conf Apr 17 06:09:50 WoodenMS >ClamAV-autoupdate[1085]: ClamAV updater failed Apr 17 06:09:50 WoodenMS >update.virus.scanners: Found generic installed Apr 17 06:09:50 WoodenMS >update.virus.scanners: Running autoupdate for generic Apr 17 07:01:01 >WoodenMS update.virus.scanners: Delaying cron job up to 600 seco nds Apr 17 >07:10:01 WoodenMS update.virus.scanners: Found clamav installed Apr 17 >07:10:01 WoodenMS update.virus.scanners: Running autoupdate for clamav Apr >17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: >ERROR: >Please edit the example config file /etc/freshclam.conf. >Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: >ERROR: >Please edit the example config file /etc/clamd.conf. >Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: >ERROR: >Can't parse the config file /etc/clamd.conf Apr 17 07:10:01 WoodenMS >ClamAV-autoupdate[1248]: ClamAV updater failed Apr 17 07:10:01 WoodenMS >update.virus.scanners: Found generic installed Apr 17 07:10:01 WoodenMS >update.virus.scanners: Running autoupdate for generic Apr 17 08:01:01 >WoodenMS update.virus.scanners: Delaying cron job up to 600 seco Nds > > > >Despite the ClamAV autoupdate error, that is a problem that I didn't see >before. > > > >>-----Original Message----- >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>Sent: Monday, April 18, 2005 3:54 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: maillog logging level >> >>MailScanner has logged using syslog as far back as I can remember... >> >>What is the problem, and what OS are you using? >> >>Billy Pumphrey wrote: >> >> >> >>>I do not quite understand the new way of MailScanner loggin using the >>> >>> >>syslog >> >> >>>thing. I searched the archives and found that I need to put a -r in >>> >>> >>there >> >> >>>somewhere but that is not enough information for me. Can someone >>>help me out with getting the mailscanner logging back to "old school"? >>> >>> >>> >>> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store Professional >>Support Services at www.MailScanner.biz MailScanner thanks transtec >>Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > >>-----Original Message----- >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>Sent: Monday, April 18, 2005 3:54 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: maillog logging level >> >>MailScanner has logged using syslog as far back as I can remember... >> >>What is the problem, and what OS are you using? >> >>Billy Pumphrey wrote: >> >> >> >>>I do not quite understand the new way of MailScanner loggin using the >>> >>> >>syslog >> >> >>>thing. I searched the archives and found that I need to put a -r in >>> >>> >>there >> >> >>>somewhere but that is not enough information for me. Can someone >>>help me out with getting the mailscanner logging back to "old school"? >>> >>> >>> >>> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store Professional >>Support Services at www.MailScanner.biz MailScanner thanks transtec >>Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Mon Apr 18 22:28:23 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:20 2006 Subject: maillog logging level Message-ID: Here is my syslog.conf file: # Log all kernel messages to the console. # Logging much else clutters up the screen. #kern.* /dev/console # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages # The authpriv file has restricted access. authpriv.* /var/log/secure # Log all the mail messages in one place. mail.* -/var/log/maillog # Log cron stuff cron.* /var/log/cron # Everybody gets emergency messages *.emerg * # Save news errors of level crit and higher in a special file. uucp,news.crit /var/log/spooler # Save boot messages also to boot.log local7.* /var/log/boot.log As far as clamv, are you speaking of: # Path to the database directory. # Default: hardcoded (depends on installation options) #DatabaseDirectory /var/lib/clamav In the clamd.conf file? > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: Monday, April 18, 2005 4:22 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > What priority levels are logged in maillog is governed by your > /etc/syslog.conf, so start there. > Also you need to edit the ClamAV config files so it knows where to find > your Clam signature database files for the autoupdating. > > Billy Pumphrey wrote: > > >I am using CentOS 4 > >MailScanner 4.40.11 > >Spamassassin 3.0.1 > > > >In the past before I made my new server, maillog contained entries of all > of > >the mail that went through. Now it just contains a few lines such as: > > > >Apr 17 05:10:35 WoodenMS update.virus.scanners: Found generic installed > Apr > >17 05:10:35 WoodenMS update.virus.scanners: Running autoupdate for > generic > >Apr 17 06:01:01 WoodenMS update.virus.scanners: Delaying cron job up to > 600 > >seco nds Apr 17 06:09:50 WoodenMS update.virus.scanners: Found clamav > >installed Apr 17 06:09:50 WoodenMS update.virus.scanners: Running > autoupdate > >for clamav Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV > update > >warning: > >ERROR: > >Please edit the example config file /etc/freshclam.conf. > >Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: > >ERROR: > >Please edit the example config file /etc/clamd.conf. > >Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: > >ERROR: > >Can't parse the config file /etc/clamd.conf Apr 17 06:09:50 WoodenMS > >ClamAV-autoupdate[1085]: ClamAV updater failed Apr 17 06:09:50 WoodenMS > >update.virus.scanners: Found generic installed Apr 17 06:09:50 WoodenMS > >update.virus.scanners: Running autoupdate for generic Apr 17 07:01:01 > >WoodenMS update.virus.scanners: Delaying cron job up to 600 seco nds Apr > 17 > >07:10:01 WoodenMS update.virus.scanners: Found clamav installed Apr 17 > >07:10:01 WoodenMS update.virus.scanners: Running autoupdate for clamav > Apr > >17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: > >ERROR: > >Please edit the example config file /etc/freshclam.conf. > >Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: > >ERROR: > >Please edit the example config file /etc/clamd.conf. > >Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: > >ERROR: > >Can't parse the config file /etc/clamd.conf Apr 17 07:10:01 WoodenMS > >ClamAV-autoupdate[1248]: ClamAV updater failed Apr 17 07:10:01 WoodenMS > >update.virus.scanners: Found generic installed Apr 17 07:10:01 WoodenMS > >update.virus.scanners: Running autoupdate for generic Apr 17 08:01:01 > >WoodenMS update.virus.scanners: Delaying cron job up to 600 seco Nds > > > > > > > >Despite the ClamAV autoupdate error, that is a problem that I didn't see > >before. > > > > > > > >>-----Original Message----- > >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>Sent: Monday, April 18, 2005 3:54 PM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: maillog logging level > >> > >>MailScanner has logged using syslog as far back as I can remember... > >> > >>What is the problem, and what OS are you using? > >> > >>Billy Pumphrey wrote: > >> > >> > >> > >>>I do not quite understand the new way of MailScanner loggin using the > >>> > >>> > >>syslog > >> > >> > >>>thing. I searched the archives and found that I need to put a -r in > >>> > >>> > >>there > >> > >> > >>>somewhere but that is not enough information for me. Can someone > >>>help me out with getting the mailscanner logging back to "old school"? > >>> > >>> > >>> > >>> > >>-- > >>Julian Field > >>www.MailScanner.info > >>Buy the MailScanner book at www.MailScanner.info/store Professional > >>Support Services at www.MailScanner.biz MailScanner thanks transtec > >>Computers for their support > >> > >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >>------------------------ MailScanner list ------------------------ To > >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > > > >------------------------ MailScanner list ------------------------ To > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > >>-----Original Message----- > >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>Sent: Monday, April 18, 2005 3:54 PM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: maillog logging level > >> > >>MailScanner has logged using syslog as far back as I can remember... > >> > >>What is the problem, and what OS are you using? > >> > >>Billy Pumphrey wrote: > >> > >> > >> > >>>I do not quite understand the new way of MailScanner loggin using the > >>> > >>> > >>syslog > >> > >> > >>>thing. I searched the archives and found that I need to put a -r in > >>> > >>> > >>there > >> > >> > >>>somewhere but that is not enough information for me. Can someone > >>>help me out with getting the mailscanner logging back to "old school"? > >>> > >>> > >>> > >>> > >>-- > >>Julian Field > >>www.MailScanner.info > >>Buy the MailScanner book at www.MailScanner.info/store Professional > >>Support Services at www.MailScanner.biz MailScanner thanks transtec > >>Computers for their support > >> > >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >>------------------------ MailScanner list ------------------------ To > >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > > > >------------------------ MailScanner list ------------------------ To > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > >------------------------ MailScanner list ------------------------ > >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 18 22:47:58 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:20 2006 Subject: maillog logging level Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Billy Pumphrey wrote: >Here is my syslog.conf file: > ># Log all kernel messages to the console. ># Logging much else clutters up the screen. >#kern.* /dev/console > ># Log anything (except mail) of level info or higher. ># Don't log private authentication messages! >*.info;mail.none;authpriv.none;cron.none /var/log/messages > ># The authpriv file has restricted access. >authpriv.* /var/log/secure > ># Log all the mail messages in one place. >mail.* -/var/log/maillog > > That looks okay. > ># Log cron stuff >cron.* /var/log/cron > ># Everybody gets emergency messages >*.emerg * > ># Save news errors of level crit and higher in a special file. >uucp,news.crit /var/log/spooler > ># Save boot messages also to boot.log >local7.* /var/log/boot.log > > >As far as clamv, are you speaking of: ># Path to the database directory. ># Default: hardcoded (depends on installation options) >#DatabaseDirectory /var/lib/clamav > >In the clamd.conf file? > > Yep, you should uncomment that. And check there is something in /var/lib/clamav! > > >>-----Original Message----- >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>Sent: Monday, April 18, 2005 4:22 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: maillog logging level >> >>What priority levels are logged in maillog is governed by your >>/etc/syslog.conf, so start there. >>Also you need to edit the ClamAV config files so it knows where to find >>your Clam signature database files for the autoupdating. >> >>Billy Pumphrey wrote: >> >> >> >>>I am using CentOS 4 >>>MailScanner 4.40.11 >>>Spamassassin 3.0.1 >>> >>>In the past before I made my new server, maillog contained entries of all >>> >>> >>of >> >> >>>the mail that went through. Now it just contains a few lines such as: >>> >>>Apr 17 05:10:35 WoodenMS update.virus.scanners: Found generic installed >>> >>> >>Apr >> >> >>>17 05:10:35 WoodenMS update.virus.scanners: Running autoupdate for >>> >>> >>generic >> >> >>>Apr 17 06:01:01 WoodenMS update.virus.scanners: Delaying cron job up to >>> >>> >>600 >> >> >>>seco nds Apr 17 06:09:50 WoodenMS update.virus.scanners: Found clamav >>>installed Apr 17 06:09:50 WoodenMS update.virus.scanners: Running >>> >>> >>autoupdate >> >> >>>for clamav Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV >>> >>> >>update >> >> >>>warning: >>>ERROR: >>>Please edit the example config file /etc/freshclam.conf. >>>Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: >>>ERROR: >>>Please edit the example config file /etc/clamd.conf. >>>Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV update warning: >>>ERROR: >>>Can't parse the config file /etc/clamd.conf Apr 17 06:09:50 WoodenMS >>>ClamAV-autoupdate[1085]: ClamAV updater failed Apr 17 06:09:50 WoodenMS >>>update.virus.scanners: Found generic installed Apr 17 06:09:50 WoodenMS >>>update.virus.scanners: Running autoupdate for generic Apr 17 07:01:01 >>>WoodenMS update.virus.scanners: Delaying cron job up to 600 seco nds Apr >>> >>> >>17 >> >> >>>07:10:01 WoodenMS update.virus.scanners: Found clamav installed Apr 17 >>>07:10:01 WoodenMS update.virus.scanners: Running autoupdate for clamav >>> >>> >>Apr >> >> >>>17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: >>>ERROR: >>>Please edit the example config file /etc/freshclam.conf. >>>Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: >>>ERROR: >>>Please edit the example config file /etc/clamd.conf. >>>Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV update warning: >>>ERROR: >>>Can't parse the config file /etc/clamd.conf Apr 17 07:10:01 WoodenMS >>>ClamAV-autoupdate[1248]: ClamAV updater failed Apr 17 07:10:01 WoodenMS >>>update.virus.scanners: Found generic installed Apr 17 07:10:01 WoodenMS >>>update.virus.scanners: Running autoupdate for generic Apr 17 08:01:01 >>>WoodenMS update.virus.scanners: Delaying cron job up to 600 seco Nds >>> >>> >>> >>>Despite the ClamAV autoupdate error, that is a problem that I didn't see >>>before. >>> >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>>>Sent: Monday, April 18, 2005 3:54 PM >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: maillog logging level >>>> >>>>MailScanner has logged using syslog as far back as I can remember... >>>> >>>>What is the problem, and what OS are you using? >>>> >>>>Billy Pumphrey wrote: >>>> >>>> >>>> >>>> >>>> >>>>>I do not quite understand the new way of MailScanner loggin using the >>>>> >>>>> >>>>> >>>>> >>>>syslog >>>> >>>> >>>> >>>> >>>>>thing. I searched the archives and found that I need to put a -r in >>>>> >>>>> >>>>> >>>>> >>>>there >>>> >>>> >>>> >>>> >>>>>somewhere but that is not enough information for me. Can someone >>>>>help me out with getting the mailscanner logging back to "old school"? >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>-- >>>>Julian Field >>>>www.MailScanner.info >>>>Buy the MailScanner book at www.MailScanner.info/store Professional >>>>Support Services at www.MailScanner.biz MailScanner thanks transtec >>>>Computers for their support >>>> >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>>------------------------ MailScanner list ------------------------ To >>>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ To >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>>>Sent: Monday, April 18, 2005 3:54 PM >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: maillog logging level >>>> >>>>MailScanner has logged using syslog as far back as I can remember... >>>> >>>>What is the problem, and what OS are you using? >>>> >>>>Billy Pumphrey wrote: >>>> >>>> >>>> >>>> >>>> >>>>>I do not quite understand the new way of MailScanner loggin using the >>>>> >>>>> >>>>> >>>>> >>>>syslog >>>> >>>> >>>> >>>> >>>>>thing. I searched the archives and found that I need to put a -r in >>>>> >>>>> >>>>> >>>>> >>>>there >>>> >>>> >>>> >>>> >>>>>somewhere but that is not enough information for me. Can someone >>>>>help me out with getting the mailscanner logging back to "old school"? >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>-- >>>>Julian Field >>>>www.MailScanner.info >>>>Buy the MailScanner book at www.MailScanner.info/store Professional >>>>Support Services at www.MailScanner.biz MailScanner thanks transtec >>>>Computers for their support >>>> >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>>------------------------ MailScanner list ------------------------ To >>>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ To >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>> >>> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Christo at IT4AFRICA.CO.ZA Tue Apr 19 07:24:20 2005 From: Christo at IT4AFRICA.CO.ZA (Christo Bezuidenhout) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level {Virus Scanned} Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: 18 April 2005 11:48 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level {Virus Scanned} > > Billy Pumphrey wrote: > > >Here is my syslog.conf file: > > > ># Log all kernel messages to the console. > ># Logging much else clutters up the screen. > >#kern.* /dev/console > > > ># Log anything (except mail) of level info or higher. > ># Don't log private authentication messages! > >*.info;mail.none;authpriv.none;cron.none > /var/log/messages > > > ># The authpriv file has restricted access. > >authpriv.* > /var/log/secure > > > ># Log all the mail messages in one place. > >mail.* > -/var/log/maillog Is the '-' supposed to be in from of /var/log/maillog I had a look at my syslog.conf and it is without that. > > > > > That looks okay. > > > > ># Log cron stuff > >cron.* /var/log/cron > > > ># Everybody gets emergency messages > >*.emerg * > > > ># Save news errors of level crit and higher in a special file. > >uucp,news.crit > /var/log/spooler > > > ># Save boot messages also to boot.log > >local7.* > /var/log/boot.log > > > > > >As far as clamv, are you speaking of: > ># Path to the database directory. > ># Default: hardcoded (depends on installation options) > >#DatabaseDirectory /var/lib/clamav > > > >In the clamd.conf file? > > > > > Yep, you should uncomment that. And check there is something > in /var/lib/clamav! > > > > > > >>-----Original Message----- > >>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>Sent: Monday, April 18, 2005 4:22 PM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: maillog logging level > >> > >>What priority levels are logged in maillog is governed by your > >>/etc/syslog.conf, so start there. > >>Also you need to edit the ClamAV config files so it knows where to > >>find your Clam signature database files for the autoupdating. > >> > >>Billy Pumphrey wrote: > >> > >> > >> > >>>I am using CentOS 4 > >>>MailScanner 4.40.11 > >>>Spamassassin 3.0.1 > >>> > >>>In the past before I made my new server, maillog contained > entries of > >>>all > >>> > >>> > >>of > >> > >> > >>>the mail that went through. Now it just contains a few > lines such as: > >>> > >>>Apr 17 05:10:35 WoodenMS update.virus.scanners: Found generic > >>>installed > >>> > >>> > >>Apr > >> > >> > >>>17 05:10:35 WoodenMS update.virus.scanners: Running autoupdate for > >>> > >>> > >>generic > >> > >> > >>>Apr 17 06:01:01 WoodenMS update.virus.scanners: Delaying > cron job up > >>>to > >>> > >>> > >>600 > >> > >> > >>>seco nds Apr 17 06:09:50 WoodenMS update.virus.scanners: > Found clamav > >>>installed Apr 17 06:09:50 WoodenMS update.virus.scanners: Running > >>> > >>> > >>autoupdate > >> > >> > >>>for clamav Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV > >>> > >>> > >>update > >> > >> > >>>warning: > >>>ERROR: > >>>Please edit the example config file /etc/freshclam.conf. > >>>Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV > update warning: > >>>ERROR: > >>>Please edit the example config file /etc/clamd.conf. > >>>Apr 17 06:09:50 WoodenMS ClamAV-autoupdate[1085]: ClamAV > update warning: > >>>ERROR: > >>>Can't parse the config file /etc/clamd.conf Apr 17 > 06:09:50 WoodenMS > >>>ClamAV-autoupdate[1085]: ClamAV updater failed Apr 17 06:09:50 > >>>WoodenMS > >>>update.virus.scanners: Found generic installed Apr 17 06:09:50 > >>>WoodenMS > >>>update.virus.scanners: Running autoupdate for generic Apr > 17 07:01:01 > >>>WoodenMS update.virus.scanners: Delaying cron job up to > 600 seco nds > >>>Apr > >>> > >>> > >>17 > >> > >> > >>>07:10:01 WoodenMS update.virus.scanners: Found clamav > installed Apr > >>>17 > >>>07:10:01 WoodenMS update.virus.scanners: Running autoupdate for > >>>clamav > >>> > >>> > >>Apr > >> > >> > >>>17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV > update warning: > >>>ERROR: > >>>Please edit the example config file /etc/freshclam.conf. > >>>Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV > update warning: > >>>ERROR: > >>>Please edit the example config file /etc/clamd.conf. > >>>Apr 17 07:10:01 WoodenMS ClamAV-autoupdate[1248]: ClamAV > update warning: > >>>ERROR: > >>>Can't parse the config file /etc/clamd.conf Apr 17 > 07:10:01 WoodenMS > >>>ClamAV-autoupdate[1248]: ClamAV updater failed Apr 17 07:10:01 > >>>WoodenMS > >>>update.virus.scanners: Found generic installed Apr 17 07:10:01 > >>>WoodenMS > >>>update.virus.scanners: Running autoupdate for generic Apr > 17 08:01:01 > >>>WoodenMS update.virus.scanners: Delaying cron job up to > 600 seco Nds > >>> > >>> > >>> > >>>Despite the ClamAV autoupdate error, that is a problem > that I didn't > >>>see before. > >>> > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>>>Sent: Monday, April 18, 2005 3:54 PM > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: maillog logging level > >>>> > >>>>MailScanner has logged using syslog as far back as I can > remember... > >>>> > >>>>What is the problem, and what OS are you using? > >>>> > >>>>Billy Pumphrey wrote: > >>>> > >>>> > >>>> > >>>> > >>>> > >>>>>I do not quite understand the new way of MailScanner > loggin using > >>>>>the > >>>>> > >>>>> > >>>>> > >>>>> > >>>>syslog > >>>> > >>>> > >>>> > >>>> > >>>>>thing. I searched the archives and found that I need to > put a -r > >>>>>in > >>>>> > >>>>> > >>>>> > >>>>> > >>>>there > >>>> > >>>> > >>>> > >>>> > >>>>>somewhere but that is not enough information for me. > Can someone > >>>>>help me out with getting the mailscanner logging back to > "old school"? > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>-- > >>>>Julian Field > >>>>www.MailScanner.info > >>>>Buy the MailScanner book at www.MailScanner.info/store > Professional > >>>>Support Services at www.MailScanner.biz MailScanner > thanks transtec > >>>>Computers for their support > >>>> > >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>>> > >>>>------------------------ MailScanner list > ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>>> > >>>> > >>>> > >>>------------------------ MailScanner list > ------------------------ To > >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > >>>>Sent: Monday, April 18, 2005 3:54 PM > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: maillog logging level > >>>> > >>>>MailScanner has logged using syslog as far back as I can > remember... > >>>> > >>>>What is the problem, and what OS are you using? > >>>> > >>>>Billy Pumphrey wrote: > >>>> > >>>> > >>>> > >>>> > >>>> > >>>>>I do not quite understand the new way of MailScanner > loggin using > >>>>>the > >>>>> > >>>>> > >>>>> > >>>>> > >>>>syslog > >>>> > >>>> > >>>> > >>>> > >>>>>thing. I searched the archives and found that I need to > put a -r > >>>>>in > >>>>> > >>>>> > >>>>> > >>>>> > >>>>there > >>>> > >>>> > >>>> > >>>> > >>>>>somewhere but that is not enough information for me. > Can someone > >>>>>help me out with getting the mailscanner logging back to > "old school"? > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>-- > >>>>Julian Field > >>>>www.MailScanner.info > >>>>Buy the MailScanner book at www.MailScanner.info/store > Professional > >>>>Support Services at www.MailScanner.biz MailScanner > thanks transtec > >>>>Computers for their support > >>>> > >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >>>> > >>>>------------------------ MailScanner list > ------------------------ > >>>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>>'leave mailscanner' in the body of the email. > >>>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>>Support MailScanner development - buy the book off the website! > >>>> > >>>> > >>>> > >>>> > >>>------------------------ MailScanner list > ------------------------ To > >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>>------------------------ MailScanner list > ------------------------ To > >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>>'leave mailscanner' in the body of the email. > >>>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >>> > >>> > >>> > >>> > >>> > >>-- > >>Julian Field > >>www.MailScanner.info > >>Buy the MailScanner book at www.MailScanner.info/store Professional > >>Support Services at www.MailScanner.biz MailScanner thanks transtec > >>Computers for their support > >> > >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >> > >>------------------------ MailScanner list > ------------------------ To > >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >> > > > >------------------------ MailScanner list > ------------------------ To > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kevins at BMRB.CO.UK Tue Apr 19 08:30:40 2005 From: kevins at BMRB.CO.UK (Kevin Spicer) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level {Virus Scanned} Message-ID: On Tue, 2005-04-19 at 08:24 +0200, Christo Bezuidenhout wrote: > > ># Log all the mail messages in one place. > > >mail.* > > -/var/log/maillog > > Is the '-' supposed to be in from of /var/log/maillog > > I had a look at my syslog.conf and it is without that. All that means is that syslog won't flush all pending messages to disk immediately it recieves them. The downside of this is if the system crashes you may lose a few messages. The upside is that it reduces disk I/O. Given that MailScanner is pretty heavy in the disk I/O department (especially if you've not got the work area in tmpfs) this is generally considered a good idea. -- _________________________________________________________________ With effect from Tuesday 29th March 2005 KMR Group, KMR Software and BMRB have moved offices. Our new address is: Ealing Gateway 26-30 Uxbridge Road Ealing London W5 2BP t: 020 8433 4000 f: 020 8433 4001 All direct line numbers remain unchanged _________________________________________________________________ BMRB http://www.bmrb.co.uk _________________________________________________________________ This message (and any attachment) is intended only for the recipient and may contain confidential and/or privileged material. If you have received this in error, please contact the sender and delete this message immediately. Disclosure, copying or other action taken in respect of this email or in reliance on it is prohibited. BMRB Limited accepts no liability in relation to any personal emails, or content of any email which does not directly relate to our business. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 09:15:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level {Virus Scanned} Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kevin Spicer wrote: >On Tue, 2005-04-19 at 08:24 +0200, Christo Bezuidenhout wrote: > > >>>># Log all the mail messages in one place. >>>>mail.* >>>> >>>> >>>-/var/log/maillog >>> >>> >>Is the '-' supposed to be in from of /var/log/maillog >> >>I had a look at my syslog.conf and it is without that. >> >> > >All that means is that syslog won't flush all pending messages to disk >immediately it recieves them. The downside of this is if the system >crashes you may lose a few messages. > Note that "messages" refers to syslog entries, not email messages! > The upside is that it reduces disk >I/O. Given that MailScanner is pretty heavy in the disk I/O department >(especially if you've not got the work area in tmpfs) this is generally >considered a good idea. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ricardo.canavate at nozar.es Tue Apr 19 12:02:54 2005 From: ricardo.canavate at nozar.es ([iso-8859-1] Ricardo Luis Cañavate) Date: Thu Jan 12 21:29:21 2006 Subject: Personal Rule forSpamAssassin Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Friends! I need help again, although my contributions are nothing, I have been always asking for help, thanks in advanced for all your support. I have SpamAssassin and I want to make a rule who look inside some Subject, Body, email addresses inside my organization for block some messages they are sending without control. I try to learn by reading other rules and I try to create my own rule but I am a very bad "spamassassin ruler". Ricardo Luís Cañavate García Dpto. Informática NOZAR Grupo Inmobiliario Tel: 91 758 96 30 | Fax: 91 559 85 82 www.nozar.es ========================================================================= Usted recibe este mensaje porque su dirección e-mail se encuentra en nuestra base de datos al haber tenido contactos anteriores con nosotros, por lo que entendemos que contamos con su autorización para enviarle información profesional. No obstante, si no desea seguir recibiéndola basta con hacérnoslo saber. Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. You are receiving this message because your e-mail address is listed in our database due to previous communications with us, so we have assumed that we have your permission to send you professional information. However, if you do not wish to continue to receive such information then please let us know. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by professional privilege. If you are not the intended recipient you are hereby notified that any dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. ======================================================================= ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 12:10:12 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Personal Rule forSpamAssassin Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please read the thread with the subject "Re: MailScanner Scan Subject", in particular my reply on 14 April 2005. Ricardo Luis Cañavate wrote: >Hi Friends! > >I need help again, although my contributions are nothing, I have been always >asking for help, thanks in advanced for all your support. > >I have SpamAssassin and I want to make a rule who look inside some Subject, >Body, email addresses inside my organization for block some messages they >are sending without control. > >I try to learn by reading other rules and I try to create my own rule but I >am a very bad "spamassassin ruler". > > > >Ricardo Luís Cañavate García >Dpto. Informática >NOZAR Grupo Inmobiliario >Tel: 91 758 96 30 | Fax: 91 559 85 82 >www.nozar.es > > >========================================================================= >Usted recibe este mensaje porque su dirección e-mail se encuentra en >nuestra base de datos al haber tenido contactos anteriores con nosotros, >por lo que entendemos que contamos con su autorización para enviarle >información profesional. No obstante, si no desea seguir recibiéndola >basta con hacérnoslo saber. >Este mensaje se dirige exclusivamente a su destinatario y puede contener >información privilegiada o confidencial. Si no es vd. el destinatario >indicado, queda notificado de que la utilización, divulgación y/o copia >sin autorización está prohibida en virtud de la legislación vigente. >Si ha recibido este mensaje por error, le rogamos que nos lo comunique >inmediatamente por esta misma vía y proceda a su destrucción. > > >You are receiving this message because your e-mail address is listed in >our database due to previous communications with us, >so we have assumed that we have your permission to send you professional >information. However, if you do not wish to continue to receive such >information then please let us know. >This message is intended exclusively for its addressee and may contain >information that is CONFIDENTIAL and protected by professional privilege. >If you are not the intended recipient you are hereby notified that any >dissemination, copy or disclosure of this communication is strictly >prohibited by law. If this message has been received in error, please >immediately notify us via e-mail and delete it. >======================================================================= > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Tue Apr 19 12:11:51 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:29:21 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, > 2) If that doesn't help, then just set "Expand TNEF = no" to > disable TNEF expansion completely. ... which of course means that RTF mails that are encoded as TNEF are not proberly scanned for viruses anymore. Just thought this should be pointed out. Kind regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 12:26:11 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jan-Peter Koopmann wrote: >Hi, > > > >>2) If that doesn't help, then just set "Expand TNEF = no" to >>disable TNEF expansion completely. >> >> > >... which of course means that RTF mails that are encoded as TNEF are not proberly scanned for viruses anymore. Just thought this should be pointed out. > > For various values of "RTF" :-) Please remember there is "Microsoft Outlook Rich Text Format" and the "RTF" that can be im/exported by things like Microsoft Wood. They are totally different things. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From webalizer at NWCWEB.COM Tue Apr 19 14:47:36 2005 From: webalizer at NWCWEB.COM (Dave Duffner - PSCGi) Date: Thu Jan 12 21:29:21 2006 Subject: MailScanner's SA wants it's Mommy... Message-ID: Greetings, Same Bat Time, same Bat Station kids... Reason this is going here is because this is MailScanner calling up SpamAssassin, we've discussed this before but now I'm totally baffled. Julian, my copy of MS/SA wants you so bad it just can't let go. It's AWL is so upset that I won't let it play with you anymore that it's gone AWOL and on the rampage randomly. We've finally pinned down the fact that in the Ensim implementation of the MS/SA/ClamAV setup (MS 4.63, SA 3.XX on a Linux FC1 base) puts the AWL file for each mail account in that account's .spamassassin directory. That was fine, wiped them out so that there was no AWL file to refer to. Turned AWL off in all the locations ever posted here in the List, checked it once again after a recent upgrade of Ensim (as they like to screw things up in a blow-it-all-away format vs. selective upgrades) and it's stating autolearn, AWL, etc. are all shut down. That was working fine for about a week, then I noted the AWL was back just on Julian's posts here. That part we've never been able to determine as to why it just likes Julian's posts, but it does. It's obsessed with them. So I check again this morning and find we've gone from an AWL 0.0 adjustment to now a 0.9 as it's building that file up again based on the fact Julian posts quite a bit here (which is completely normal). It's rebuilt the AWL file in the account I use for this List. I checked other posts here, some seem to get skipped in checking as has been mentioned here recently. Can live with that part as the percentage is low. But other posts, even from those who post quite a bit never get that AWL tag or adjustment. Any clues on this? I'm just about bonkers with it. David J. Duffner President PSCGi Paradise Shore Communications Group www.pscginternet.com I--I Message scanned by MailScanner, and is believed to be clean. CONFIDENTIALITY NOTICE: This transmission intended for the specified destination and person. If this is not you, this e-mail must be deleted immediately. www.pscginternet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 19 14:57:08 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:21 2006 Subject: MailScanner's SA wants it's Mommy... Message-ID: Dave in spam.assassin.prefs.conf make sure AWL is OFF, that should be enough to cancel anything. Also make sure that it's off in the user MailScanner runs as .spamassassin dir. use_auto_whitelist 0 What about other settings, is that OK for spamassassin - ie obeying the spam.assassin.prefs.conf???? AWL in 3.0x is a bit of a PITA, quite q few people have trouble with it, and I thinks lots of things have been fixed for the upcoming 3.1 release. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Dave Duffner - PSCGi wrote: > Greetings, > > Same Bat Time, same Bat Station kids... > > Reason this is going here is because this is > MailScanner calling up SpamAssassin, we've discussed > this before but now I'm totally baffled. > > Julian, my copy of MS/SA wants you so bad it > just can't let go. It's AWL is so upset that I won't > let it play with you anymore that it's gone AWOL and > on the rampage randomly. > > We've finally pinned down the fact that in the > Ensim implementation of the MS/SA/ClamAV setup > (MS 4.63, SA 3.XX on a Linux FC1 base) puts the AWL > file for each mail account in that account's .spamassassin > directory. That was fine, wiped them out so that there > was no AWL file to refer to. > > Turned AWL off in all the locations ever posted > here in the List, checked it once again after a recent > upgrade of Ensim (as they like to screw things up in a > blow-it-all-away format vs. selective upgrades) and > it's stating autolearn, AWL, etc. are all shut down. > > That was working fine for about a week, then I > noted the AWL was back just on Julian's posts here. That > part we've never been able to determine as to why it just > likes Julian's posts, but it does. It's obsessed with > them. > > So I check again this morning and find we've gone > from an AWL 0.0 adjustment to now a 0.9 as it's building > that file up again based on the fact Julian posts quite > a bit here (which is completely normal). It's rebuilt > the AWL file in the account I use for this List. > > I checked other posts here, some seem to get > skipped in checking as has been mentioned here recently. > Can live with that part as the percentage is low. But > other posts, even from those who post quite a bit never > get that AWL tag or adjustment. > > Any clues on this? I'm just about bonkers with it. > > David J. Duffner > President > PSCGi > Paradise Shore Communications Group > www.pscginternet.com > > > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpoe at PLATTESHERIFF.ORG Tue Apr 19 15:01:03 2005 From: rpoe at PLATTESHERIFF.ORG (Rob Poe) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: I have a client who is requesting that I remove the double extension rule. They are getting files (jokes, at that!) with .htm.html extensions (along with other things) and they want the double extension rule removed. I think this is a bad idea, can anyone give me a better argument than "Because I said" to leave it in place? What are the chances of them being MORE at risk for infection? Thanks! Rob ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From roger at RUDNICK.COM.BR Tue Apr 19 15:07:21 2005 From: roger at RUDNICK.COM.BR (Roger Jochem) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I was saved from some infections in the last year thanks to that rule in MailScanner. For 5 or 6 times last year this function stopped new viruses way before McAfee, Clamav and BitDefender in my server. In some of these cases, the first antivirus was 4 hours late in the detection, and all this time I would be voulnerable if this whas turned off... I use this argument (that's true) all the time with my users when they complain about this, and it's working! Regards Roger Jochem ----- Original Message ----- From: "Rob Poe" To: Sent: Tuesday, April 19, 2005 11:01 AM Subject: Question regarding Filename Rules > I have a client who is requesting that I remove the double extension rule. They are getting files (jokes, at that!) with .htm.html extensions (along with other things) and they want the double extension rule removed. > > I think this is a bad idea, can anyone give me a better argument than "Because I said" to leave it in place? > > What are the chances of them being MORE at risk for infection? > > Thanks! > > Rob > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpoe at PLATTESHERIFF.ORG Tue Apr 19 15:12:56 2005 From: rpoe at PLATTESHERIFF.ORG (Rob Poe) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: I guess the thing about it is this: If we're blocking executable files, then how would that rule help? I'm not being argumentative .. Just curious.. >>> roger@RUDNICK.COM.BR 4/19/2005 9:07:21 AM >>> I was saved from some infections in the last year thanks to that rule in MailScanner. For 5 or 6 times last year this function stopped new viruses way before McAfee, Clamav and BitDefender in my server. In some of these cases, the first antivirus was 4 hours late in the detection, and all this time I would be voulnerable if this whas turned off... I use this argument (that's true) all the time with my users when they complain about this, and it's working! Regards Roger Jochem ----- Original Message ----- From: "Rob Poe" To: Sent: Tuesday, April 19, 2005 11:01 AM Subject: Question regarding Filename Rules > I have a client who is requesting that I remove the double extension rule. They are getting files (jokes, at that!) with .htm.html extensions (along with other things) and they want the double extension rule removed. > > I think this is a bad idea, can anyone give me a better argument than "Because I said" to leave it in place? > > What are the chances of them being MORE at risk for infection? > > Thanks! > > Rob > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Apr 19 15:17:04 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: The only problem with the double extension rule I've seen so far is that when you get files named "Dr. Bla. Blableble.doc" with several periods in the filename, they get rejected. I've added the extensions I *do* want to allow through before the double extension rule so that they don't get blocked. That should be enough as long as it's not an executable extension like .EXE, .PIF, .SCR and others like them. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Roger Jochem Sent: Tuesday, April 19, 2005 9:07 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Question regarding Filename Rules I was saved from some infections in the last year thanks to that rule in MailScanner. For 5 or 6 times last year this function stopped new viruses way before McAfee, Clamav and BitDefender in my server. In some of these cases, the first antivirus was 4 hours late in the detection, and all this time I would be voulnerable if this whas turned off... I use this argument (that's true) all the time with my users when they complain about this, and it's working! Regards Roger Jochem ----- Original Message ----- From: "Rob Poe" To: Sent: Tuesday, April 19, 2005 11:01 AM Subject: Question regarding Filename Rules > I have a client who is requesting that I remove the double extension rule. They are getting files (jokes, at that!) with .htm.html extensions (along with other things) and they want the double extension rule removed. > > I think this is a bad idea, can anyone give me a better argument than "Because I said" to leave it in place? > > What are the chances of them being MORE at risk for infection? > > Thanks! > > Rob > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From webalizer at NWCWEB.COM Tue Apr 19 15:18:08 2005 From: webalizer at NWCWEB.COM (Dave Duffner - PSCGi) Date: Thu Jan 12 21:29:21 2006 Subject: MailScanner's SA wants it's Mommy... Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > Sent: Tuesday, April 19, 2005 9:57 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: MailScanner's SA wants it's Mommy... > > > Dave > > in spam.assassin.prefs.conf make sure AWL is OFF, that should > be enough to cancel anything. Also make sure that it's off in > the user MailScanner runs as .spamassassin dir. > > use_auto_whitelist 0 Yep, that setting has been in place for quite some time and even in the Headers it's noting autolearn is disabled. Even though it's pointless in the 3.0X version, we've even used that switch in the mailscanner.conf file to see if that had any effect or was causing an override of the one you list above - nada. Now you mention 'make sure it's off in the "user" MS runs as that dir? Can you be a bit more specific as I'm not getting a grip on how/where that might be? If I take it as-is above, you're saying if MS is run as Root then there's a conf file for just the Root user that needs that switch as well? That'd be a new one on me... > What about other settings, is that OK for spamassassin - ie > obeying the spam.assassin.prefs.conf???? Far as I can see, it's doing everything else according to the settings in that conf file you mention. The only bug that seems apparent is that SA isn't run on every e-mail as it should (and was with previous versions). Looks like it missed about 10% of the incoming mail, you can see in the headers that MS handled it, but there's no SA notes at all. We may have changed settings in such a way that it won't modify headers for those messages with a 0.0 rating, or the MS/SA upgraded versions may do that by default so that could be a false situation. But it tags all messages with an MS info section, just not all with an SA tag. > AWL in 3.0x is a bit of a PITA, quite q few people have > trouble with it, and I thinks lots of things have been fixed > for the upcoming 3.1 release. > -- > Martin Hepworth Yep, that I've noticed in the threads. I'll be looking forward to that fix, just hope Ensim can handle the integration as we had to wait until just recently to get their patch to upgrade it without fouling everything up. > Dave Duffner - PSCGi wrote: > > Greetings, > > > > Same Bat Time, same Bat Station kids... > > > > Reason this is going here is because this is MailScanner > > calling up SpamAssassin, we've discussed this before but now I'm > > totally baffled. > > > > Julian, my copy of MS/SA wants you so bad it > > just can't let go. It's AWL is so upset that I won't > > let it play with you anymore that it's gone AWOL and > > on the rampage randomly. > > > > We've finally pinned down the fact that in the > > Ensim implementation of the MS/SA/ClamAV setup > > (MS 4.63, SA 3.XX on a Linux FC1 base) puts the AWL > > file for each mail account in that account's .spamassassin > directory. > > That was fine, wiped them out so that there was no AWL file > to refer > > to. > > > > Turned AWL off in all the locations ever posted > > here in the List, checked it once again after a recent upgrade of > > Ensim (as they like to screw things up in a blow-it-all-away format > > vs. selective upgrades) and it's stating autolearn, AWL, > etc. are all > > shut down. > > > > That was working fine for about a week, then I > > noted the AWL was back just on Julian's posts here. That > part we've > > never been able to determine as to why it just likes > Julian's posts, > > but it does. It's obsessed with them. > > > > So I check again this morning and find we've gone > from an AWL > > 0.0 adjustment to now a 0.9 as it's building that file up > again based > > on the fact Julian posts quite a bit here (which is completely > > normal). It's rebuilt the AWL file in the account I use for this > > List. > > > > I checked other posts here, some seem to get > > skipped in checking as has been mentioned here recently. > > Can live with that part as the percentage is low. But > > other posts, even from those who post quite a bit never > > get that AWL tag or adjustment. > > > > Any clues on this? I'm just about bonkers with it. > > > > David J. Duffner > > President > > PSCGi > > Paradise Shore Communications Group > > www.pscginternet.com > > > > > > > > I--I > > Message scanned by MailScanner, and is believed to be clean. > > CONFIDENTIALITY NOTICE: This transmission intended for the > specified > > destination and person. If this is not you, this > > e-mail must be deleted immediately. www.pscginternet.com > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read > the Wiki > > (http://wiki.mailscanner.info/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential > and intended solely for the use of the individual or entity > to whom they are addressed. If you have received this email > in error please notify the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' > in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > I--I Message scanned by MailScanner, and is believed to be clean. CONFIDENTIALITY NOTICE: This transmission intended for the specified destination and person. If this is not you, this e-mail must be deleted immediately. www.pscginternet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 19 16:17:52 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:21 2006 Subject: MailScanner's SA wants it's Mommy... Message-ID: Dave Duffner - PSCGi wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth >>Sent: Tuesday, April 19, 2005 9:57 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: MailScanner's SA wants it's Mommy... >> >> >>Dave >> >>in spam.assassin.prefs.conf make sure AWL is OFF, that should >>be enough to cancel anything. Also make sure that it's off in >>the user MailScanner runs as .spamassassin dir. >> >>use_auto_whitelist 0 > > > Yep, that setting has been in place for quite some time > and even in the Headers it's noting autolearn is disabled. Even > though it's pointless in the 3.0X version, we've even used that > switch in the mailscanner.conf file to see if that had any effect > or was causing an override of the one you list above - nada. > > Now you mention 'make sure it's off in the "user" MS runs > as that dir? Can you be a bit more specific as I'm not getting > a grip on how/where that might be? > > If I take it as-is above, you're saying if MS is run as > Root then there's a conf file for just the Root user that needs > that switch as well? That'd be a new one on me... > Check in ~root/.spamassassin and make sure it's getting overridden in one of the files there. Also worth checking in /etc/mail/spamassassin as well in case ensim is doing something odd. Also make sure that MailScanner.conf has the correct settings (location) for the spam.assassin.prefs.conf. a "spamassasson -p /path-to/spam.assassin.prefs.conf -D --lint" run as the mailscanner user (root/whatever) should tell you if AWL is getting turned on somehow. > >>What about other settings, is that OK for spamassassin - ie >>obeying the spam.assassin.prefs.conf???? > > > Far as I can see, it's doing everything else according to > the settings in that conf file you mention. The only bug that > seems apparent is that SA isn't run on every e-mail as it should > (and was with previous versions). Looks like it missed about 10% > of the incoming mail, you can see in the headers that MS handled > it, but there's no SA notes at all. We may have changed settings > in such a way that it won't modify headers for those messages > with a 0.0 rating, or the MS/SA upgraded versions may do that by > default so that could be a false situation. But it tags all > messages with an MS info section, just not all with an SA tag. > > check for timeouts in the logs, also compare you old and new MailScanner.conf. Are you sure there's no MailScanner whitelisting going on via rules sets? >>AWL in 3.0x is a bit of a PITA, quite q few people have >>trouble with it, and I thinks lots of things have been fixed >>for the upcoming 3.1 release. >>-- >>Martin Hepworth > > > Yep, that I've noticed in the threads. I'll be looking > forward to that fix, just hope Ensim can handle the integration > as we had to wait until just recently to get their patch to > upgrade it without fouling everything up. > > -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Tue Apr 19 16:23:02 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level Message-ID: > >As far as clamv, are you speaking of: > ># Path to the database directory. > ># Default: hardcoded (depends on installation options) > >#DatabaseDirectory /var/lib/clamav > > > >In the clamd.conf file? > > > > > Yep, you should uncomment that. And check there is something in > /var/lib/clamav! > There is nothing in /var/lib/clamav. I believe that the uncommented on is working because the errors are gone. So when I comment the DatabaseDirectory out and type "clamd" it errors saying that it cannot find the database. Here is the latest entries from my maillog. I know that messages have successfully went through the WoodenMS machine ok because I receive them, but there just isn't anything in the log yet stating that mail went through; however, there are sometimes that it logs messages like so: Apr 19 04:02:06 WoodenMS sendmail[1241]: ruleset=trust_auth, arg1=root@localhost .localdomain, relay=localhost.localdomain [127.0.0.1], reject=550 5.7.1 ... not authenticated Apr 19 04:02:06 WoodenMS sendmail[1241]: j3J9260h001241: from=, size=3655, class=0, nrcpts=1, msgid=<200504190902.j3J926sE001239@loc alhost.localdomain>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0 .0.1] Other log entries: Apr 19 10:02:56 WoodenMS MailScanner[3920]: Read 108 hostnames from the phishing whitelist Apr 19 10:02:58 WoodenMS MailScanner[3920]: Enabling SpamAssassin auto-whitelist functionality... Apr 19 10:03:00 WoodenMS MailScanner[3920]: Using locktype = posix Apr 19 10:03:00 WoodenMS MailScanner[3920]: Creating hardcoded struct_flock subr outine for linux (Linux-type) Apr 19 10:03:07 WoodenMS MailScanner[3921]: MailScanner E-Mail Virus Scanner ver sion 4.40.11 starting... Apr 19 10:03:07 WoodenMS MailScanner[3921]: Read 108 hostnames from the phishing whitelist Apr 19 10:03:09 WoodenMS MailScanner[3921]: Enabling SpamAssassin auto-whitelist functionality... Apr 19 10:03:11 WoodenMS MailScanner[3921]: Using locktype = posix Apr 19 10:03:11 WoodenMS MailScanner[3921]: Creating hardcoded struct_flock subr outine for linux (Linux-type) Apr 19 10:03:18 WoodenMS MailScanner[3922]: MailScanner E-Mail Virus Scanner ver sion 4.40.11 starting... Apr 19 10:03:18 WoodenMS MailScanner[3922]: Read 108 hostnames from the phishing whitelist Apr 19 10:03:20 WoodenMS MailScanner[3922]: Enabling SpamAssassin auto-whitelist functionality... Apr 19 10:03:22 WoodenMS MailScanner[3922]: Using locktype = posix Apr 19 10:03:22 WoodenMS MailScanner[3922]: Creating hardcoded struct_flock subr outine for linux (Linux-type) Apr 19 10:03:29 WoodenMS MailScanner[3923]: MailScanner E-Mail Virus Scanner ver sion 4.40.11 starting... Apr 19 10:03:29 WoodenMS MailScanner[3923]: Read 108 hostnames from the phishing whitelist Apr 19 10:03:31 WoodenMS MailScanner[3923]: Enabling SpamAssassin auto-whitelist functionality... Apr 19 10:03:33 WoodenMS MailScanner[3923]: Using locktype = posix Apr 19 10:03:33 WoodenMS MailScanner[3923]: Creating hardcoded struct_flock subr outine for linux (Linux-type) Apr 19 10:05:49 WoodenMS update.virus.scanners: Found clamav installed Apr 19 10:05:49 WoodenMS update.virus.scanners: Running autoupdate for clamav Apr 19 10:05:49 WoodenMS ClamAV-autoupdate[3951]: ClamAV did not need updating Apr 19 10:05:49 WoodenMS update.virus.scanners: Found generic installed Apr 19 10:05:49 WoodenMS update.virus.scanners: Running autoupdate for generic At the time of this writin, time was 10:22 and the last entry in the log is 10:05 as you can see. ?? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Tue Apr 19 16:32:35 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level Message-ID: I think that I have a clue! I stopped mailscanner via service MailScanner stop. Then I sent a message to test to see if it would come through and it did. So messages are not even going through MailScanner. At this point I do not know how to trouble shoot why really. I thought that I configured my new server (this one) the same as my last one. My setup is that MailScanner is the relay between the internet and my exchange server 10.1.1.2. I will run briefly what I did. Edited mailertable to: Woodmaclaw.com esmtp:[10.1.1.2] www.woodmaclaw.com esmtp:[10.1.1.2] Then I ran the makefile thing (??? Can't recall the command) for mailtertable Other than that I change organization name and such in MailScanner.conf. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 19 16:31:26 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rob Poe wrote: >I have a client who is requesting that I remove the double extension rule. They are getting files (jokes, at that!) with .htm.html extensions (along with other things) and they want the double extension rule removed. > >I think this is a bad idea, can anyone give me a better argument than "Because I said" to leave it in place? > >What are the chances of them being MORE at risk for infection? > > Quite frankly, I've got several exceptions to the double-extension rule for any "two of same kind" extension cases. Certainly there's nothing that hides a true file type about .htm.html, or about .jpg.jpeg, etc. I've also got allowances for conversion between extensions that are of the same threat level if I allow said file types. ie: .doc.rtf. If you allow .rtf files, and .doc files, there's nothing fishy about a .doc.rtf, other than to imply it was run through a conversion tool. I liberally allow many extensions MailScanner does not allow by default, so these are acceptable here if they pass virus scan. I lean mostly on my 3 virus scanners to pick up viruses, and not on my filename rules, so my rules are pretty liberal. A sampling of my rules: # allow document format conversions. .wps.doc, .wps.rtf, etc # in these cases the first extension is of the same threat class as the last extension. # Unless denied outright above, these are no more threatening when doubled. allow \.wps\.doc$ - - allow \.wps\.rtf$ - - allow \.xls\.doc$ - - allow \.ppt\.doc$ - - #allow 4 letter extensions with equivalent 3 letter ie: file.html.htm # note: any 3.4 variants are redundant in my case because of the modified double-extension rule allow \.html\.htm$ - - allow \.icon\.ico$ - - allow \.conf\.cfg$ - - allow \.mpeg\.mpg$ - - Lastly, I've greatly restricted the scope of the original extension hiding rule. Which would have never matched your ".htm.html" in the first place. I know of no truly malicious file extensions for windows that are 4 letters in length, which would be useful to hide as some other extension. Therefore, I require that the last extension be 3 characters, not 3-4. I also know of no malicious file extensions containing numbers, so I require the last extension to be alpha-only. Finally, there are very few four character extensions worth hiding behind, so I only check a few common user-recognizable 4-character extensions for an extension hiding after it. # Deny all other double file extensions. This catches any hidden filenames. #MEK - made this a bit less generic. Second extension now must be # all alpha instead of alphanumeric # And only certain 4-char extensions are checked for hiding. #3.3 extension hiding deny \.[a-z][a-z0-9]{2}\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension # look for 3 character extension hiding behind innocuous 4-character extension. (selective 4.3) deny \.text\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.jpeg\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.mpeg\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.pict\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.jiff\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.html\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.tiff\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.vrml\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.conf\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.diff\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.java\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.cert\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.icon\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Tue Apr 19 16:34:52 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: Excellent points... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Matt Kettler Sent: Tuesday, April 19, 2005 10:31 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Question regarding Filename Rules Rob Poe wrote: >I have a client who is requesting that I remove the double extension rule. They are getting files (jokes, at that!) with .htm.html extensions (along with other things) and they want the double extension rule removed. > >I think this is a bad idea, can anyone give me a better argument than "Because I said" to leave it in place? > >What are the chances of them being MORE at risk for infection? > > Quite frankly, I've got several exceptions to the double-extension rule for any "two of same kind" extension cases. Certainly there's nothing that hides a true file type about .htm.html, or about .jpg.jpeg, etc. I've also got allowances for conversion between extensions that are of the same threat level if I allow said file types. ie: .doc.rtf. If you allow .rtf files, and .doc files, there's nothing fishy about a .doc.rtf, other than to imply it was run through a conversion tool. I liberally allow many extensions MailScanner does not allow by default, so these are acceptable here if they pass virus scan. I lean mostly on my 3 virus scanners to pick up viruses, and not on my filename rules, so my rules are pretty liberal. A sampling of my rules: # allow document format conversions. .wps.doc, .wps.rtf, etc # in these cases the first extension is of the same threat class as the last extension. # Unless denied outright above, these are no more threatening when doubled. allow \.wps\.doc$ - - allow \.wps\.rtf$ - - allow \.xls\.doc$ - - allow \.ppt\.doc$ - - #allow 4 letter extensions with equivalent 3 letter ie: file.html.htm # note: any 3.4 variants are redundant in my case because of the modified double-extension rule allow \.html\.htm$ - - allow \.icon\.ico$ - - allow \.conf\.cfg$ - - allow \.mpeg\.mpg$ - - Lastly, I've greatly restricted the scope of the original extension hiding rule. Which would have never matched your ".htm.html" in the first place. I know of no truly malicious file extensions for windows that are 4 letters in length, which would be useful to hide as some other extension. Therefore, I require that the last extension be 3 characters, not 3-4. I also know of no malicious file extensions containing numbers, so I require the last extension to be alpha-only. Finally, there are very few four character extensions worth hiding behind, so I only check a few common user-recognizable 4-character extensions for an extension hiding after it. # Deny all other double file extensions. This catches any hidden filenames. #MEK - made this a bit less generic. Second extension now must be # all alpha instead of alphanumeric # And only certain 4-char extensions are checked for hiding. #3.3 extension hiding deny \.[a-z][a-z0-9]{2}\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension # look for 3 character extension hiding behind innocuous 4-character extension. (selective 4.3) deny \.text\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.jpeg\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.mpeg\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.pict\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.jiff\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.html\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.tiff\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.vrml\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.conf\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.diff\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.java\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.cert\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension deny \.icon\s*\.[a-z]{3}$ Found possible filename hiding Attempt to hide real filename extension ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 16:53:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did you kill the sendmail service and stop it from starting when the system boots? As the installation script tells you, you need to do this after installation (I kept it separate for clarity and also because a lot of RPM-based systems do not have the "service" command). chkconfig MailScanner on chkconfig sendmail off service sendmail stop service MailScanner start I would suspect you still have a sendmail process running even after you have done the "service MailScanner stop" as it will be left over the "sendmail" service, which is not wanted. Billy Pumphrey wrote: >I think that I have a clue! > >I stopped mailscanner via service MailScanner stop. >Then I sent a message to test to see if it would come through and it did. > >So messages are not even going through MailScanner. At this point I do not >know how to trouble shoot why really. I thought that I configured my new >server (this one) the same as my last one. My setup is that MailScanner is >the relay between the internet and my exchange server 10.1.1.2. I will run >briefly what I did. >Edited mailertable to: >Woodmaclaw.com esmtp:[10.1.1.2] >www.woodmaclaw.com esmtp:[10.1.1.2] > >Then I ran the makefile thing (??? Can't recall the command) for >mailtertable > >Other than that I change organization name and such in MailScanner.conf. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 19 16:54:06 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:21 2006 Subject: MailScanner's SA wants it's Mommy... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Dave > > in spam.assassin.prefs.conf make sure AWL is OFF, that should be enough > to cancel anything. Also make sure that it's off in the user MailScanner > runs as .spamassassin dir. > > use_auto_whitelist 0 I personally would not use spam.assasssin.prefs.conf for this. I would use /etc/mail/spamassassin/local.cf. Note: This is in direct contradiction of the recommendations by MailScanner's stock spam.assassin.prefs.conf. However, let me explain my rationale. use_auto_whitelist is classified as an administrator setting by spamassassin, along with several other settings. No matter what your settings are, spamassassin is not supposed to honor administrator settings in a user preferences file. Since spam.assassin.prefs.conf is supposed to be user preference file, any administrator settings do not belong here. If you look in MailScanner's SA.pm it's being passed to userprefs_filename in the Mail::SpamAssassin object. That's very much intended by the SpamAssassin code to be an unprivileged file. The way MailScanner invokes SA, it winds up honoring administrator settings in this file, but IMO, that's a bug in SpamAssassin. These options should not be working. Technically speaking, bayes_path, bayes_file_mode, and many other options that are in the standard distribution's spam.assassin.prefs.conf should be refused here as well. They seem to work, but IMO it's depending on a bug in SpamAssassin's security. Files which are entered by untrusted users from the perspective of the SpamAssassin code should not be able to set file paths, permissions, executable paths, etc because they can be used to muck up the server. bayes_file_mode could be used by an unprivileged user in a conventional setup to lock everyone else but root out of a global bayes DB, for example. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 19 16:58:18 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:21 2006 Subject: Personal Rule forSpamAssassin Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ricardo Luis Cañavate wrote: >Hi Friends! > >I need help again, although my contributions are nothing, I have been always >asking for help, thanks in advanced for all your support. > >I have SpamAssassin and I want to make a rule who look inside some Subject, >Body, email addresses inside my organization for block some messages they >are sending without control. > >I try to learn by reading other rules and I try to create my own rule but I >am a very bad "spamassassin ruler". > > > Might I suggest reading the wiki site. It's got a somewhat updated copy of the rule writing guide I made a year or so ago. http://wiki.apache.org/spamassassin/WritingRules That should give you resources and examples for writing any kind of basic and intermediate SpamAssassin rule you might want to do, and hints and directions for advanced rules. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 17:11:42 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] As a point of historical note, the only reason I ever put the double-extension trap rule in there was an example of a more advanced type of rule and what could be achieved with it. Every mail gateway under the sun (even Microsoft's!) allow simple blocking by filename extension. I wanted to demonstrate that, with MailScanner, you could go way beyond such simple rules and could implement something that was potentially very useful. And all in 1 rule. Alex Neuman van der Hans wrote: >Excellent points... > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >Of Matt Kettler >Sent: Tuesday, April 19, 2005 10:31 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: Question regarding Filename Rules > >Rob Poe wrote: > > > >>I have a client who is requesting that I remove the double extension rule. >> >> >They are getting files (jokes, at that!) with .htm.html extensions (along >with other things) and they want the double extension rule removed. > > >>I think this is a bad idea, can anyone give me a better argument than >> >> >"Because I said" to leave it in place? > > >>What are the chances of them being MORE at risk for infection? >> >> >> >> > >Quite frankly, I've got several exceptions to the double-extension rule for >any "two of same kind" extension cases. > >Certainly there's nothing that hides a true file type about .htm.html, or >about .jpg.jpeg, etc. > >I've also got allowances for conversion between extensions that are of the >same threat level if I allow said file types. ie: .doc.rtf. If you allow >.rtf files, and .doc files, there's nothing fishy about a .doc.rtf, other >than to imply it was run through a conversion tool. I liberally allow many >extensions MailScanner does not allow by default, so these are acceptable >here if they pass virus scan. > > I lean mostly on my 3 virus scanners to pick up viruses, and not on my >filename rules, so my rules are pretty liberal. > >A sampling of my rules: > ># allow document format conversions. .wps.doc, .wps.rtf, etc # in these >cases the first extension is of the same threat class as the last extension. ># Unless denied outright above, these are no more threatening when doubled. >allow \.wps\.doc$ - - >allow \.wps\.rtf$ - - >allow \.xls\.doc$ - - >allow \.ppt\.doc$ - - > > >#allow 4 letter extensions with equivalent 3 letter ie: file.html.htm # >note: any 3.4 variants are redundant in my case because of the modified >double-extension rule >allow \.html\.htm$ - - >allow \.icon\.ico$ - - >allow \.conf\.cfg$ - - >allow \.mpeg\.mpg$ - - > > >Lastly, I've greatly restricted the scope of the original extension hiding >rule. Which would have never matched your ".htm.html" in the first place. > >I know of no truly malicious file extensions for windows that are 4 letters >in length, which would be useful to hide as some other extension. Therefore, >I require that the last extension be 3 characters, not 3-4. >I also know of no malicious file extensions containing numbers, so I require >the last extension to be alpha-only. > >Finally, there are very few four character extensions worth hiding behind, >so I only check a few common user-recognizable 4-character extensions for an >extension hiding after it. > ># Deny all other double file extensions. This catches any hidden filenames. >#MEK - made this a bit less generic. Second extension now must be # all >alpha instead of alphanumeric # And only certain 4-char extensions are >checked for hiding. > >#3.3 extension hiding >deny \.[a-z][a-z0-9]{2}\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension ># look for 3 character extension hiding behind innocuous 4-character >extension. (selective 4.3) >deny \.text\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.jpeg\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.mpeg\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.pict\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.jiff\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.html\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.tiff\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.vrml\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.conf\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.diff\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.java\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.cert\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension >deny \.icon\s*\.[a-z]{3}$ Found possible filename >hiding Attempt to hide real filename extension > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 17:12:12 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] If, for a laugh, you want to see what Micrsosoft run themselves in the way of virus/spam scanning, take a look at the first document listed at the bottom of http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC35AD-8BA1-48B1-91F3-563313EE878A&displaylang=en It's a real hoot :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 19 17:25:23 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: Julian interesting indeed, and looking the the ppt presentation they've got eTrust on the desktops! There stats are consistent with mine...percentage wise.. More than 8.8 million external e-mail messages per day More than 7.5 million e-mail messages blocked per day -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Julian Field wrote: > If, for a laugh, you want to see what Micrsosoft run themselves in the > way of virus/spam scanning, take a look at the first document listed at > the bottom of > > http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC35AD-8BA1-48B1-91F3-563313EE878A&displaylang=en > > > It's a real hoot :-) > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 18:03:07 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] But they do some lovely things. They block all incoming mail that doesn't have an envelope sender address. This of course includes error messages when people have spelled an email address incorrectly. But I guess everyone at Microsoft is so clever they never mistype addresses. Martin Hepworth wrote: > Julian > > interesting indeed, and looking the the ppt presentation they've got > eTrust on the desktops! > > There stats are consistent with mine...percentage wise.. > > More than 8.8 million external e-mail messages per day > More than 7.5 million e-mail messages blocked per day > > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Julian Field wrote: > >> If, for a laugh, you want to see what Micrsosoft run themselves in the >> way of virus/spam scanning, take a look at the first document listed at >> the bottom of >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC35AD-8BA1-48B1-91F3-563313EE878A&displaylang=en >> >> >> >> It's a real hoot :-) >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rpoe at PLATTESHERIFF.ORG Tue Apr 19 18:38:13 2005 From: rpoe at PLATTESHERIFF.ORG (Rob Poe) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: MS Exchange Server: 689.20 MS Exchange User CAL: 49.56/user MS Outlook 2003: 99.40/seat The knowledge you still have a better solution than Microsoft....Priceless!! >>> MailScanner@ECS.SOTON.AC.UK 4/19/2005 11:12:12 AM >>> If, for a laugh, you want to see what Micrsosoft run themselves in the way of virus/spam scanning, take a look at the first document listed at the bottom of http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC35AD-8BA1-48B1-91F3-563313EE878A&displaylang=en It's a real hoot :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Tue Apr 19 19:31:42 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: Julian Field wrote: > But they do some lovely things. They block all incoming mail that > doesn't have an envelope sender address. This of course includes error > messages when people have spelled an email address incorrectly. But I > guess everyone at Microsoft is so clever they never mistype addresses. > I might be wrong, but at a cursory glance it also looks like they bounce spam. Will they ever be rich enough to buy a clue? ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Tue Apr 19 19:32:35 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: At 01:38 PM 4/19/2005, you wrote: >MS Exchange Server: 689.20 >MS Exchange User CAL: 49.56/user >MS Outlook 2003: 99.40/seat > >The knowledge you still have a better solution than Microsoft....Priceless!! > Plus, you need twice the hardware to run Microsoft's bloated 'C' code to handle the same volume of mail as a an MS system.. AT LEAST! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 19 19:45:47 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] DNSAdmin wrote: > At 01:38 PM 4/19/2005, you wrote: > >> MS Exchange Server: 689.20 >> MS Exchange User CAL: 49.56/user >> MS Outlook 2003: 99.40/seat >> >> The knowledge you still have a better solution than >> Microsoft....Priceless!! >> > > Plus, you need twice the hardware to run Microsoft's bloated 'C' code to > handle the same volume of mail as a an MS system.. AT LEAST! And people still ask me why MailScanner is written in "inefficient" Perl when it should be written better in "efficient" C. On the usual rule of thumb that 1 line of Perl is about 10 lines of C, that would make MailScanner well on the way to 1/2 million lines of code. Eek! Now that *would* be a big project. Just think, the first decent size C program I wrote was 6,000 lines of C (The Atari ST version of Autoroute, if anyone is interested). That seemed quite big to me at the time. And I still haven't ever attended a programming course :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Apr 19 19:39:03 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Kevin Miller wrote: > Julian Field wrote: > >>But they do some lovely things. They block all incoming mail that >>doesn't have an envelope sender address. This of course includes error >>messages when people have spelled an email address incorrectly. But I >>guess everyone at Microsoft is so clever they never mistype addresses. >> > > > I might be wrong, but at a cursory glance it also looks like they bounce > spam. Will they ever be rich enough to buy a clue? > If they did buy it, they would squash it or break it! -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Tue Apr 19 19:54:44 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: Scott Silva wrote: > Kevin Miller wrote: >> Julian Field wrote: >> >>> But they do some lovely things. They block all incoming mail that >>> doesn't have an envelope sender address. This of course includes >>> error messages when people have spelled an email address >>> incorrectly. But I guess everyone at Microsoft is so clever they >>> never mistype addresses. >>> >> >> >> I might be wrong, but at a cursory glance it also looks like they >> bounce spam. Will they ever be rich enough to buy a clue? >> > If they did buy it, they would squash it or break it! Or patent it? ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From billy at PLANETGEEK.BIZ Tue Apr 19 20:45:24 2005 From: billy at PLANETGEEK.BIZ (Billy Pumphrey) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level Message-ID: When I set it up I either ran the one in the mailscanner book: Chkconfig --level all sendmail off Chkconfig --level 345 MailScanner on Service sendmail stop Service MailScanner start Or the one on the site http://www.sng.ecs.soton.ac.uk/mailscanner/install/linux.shtml service sendmail stop chkconfig sendmail off chkconfig --level 2345 MailScanner on service MailScanner start I do not recall which one that I did, but that did confuse me a little because they are different. I tried researching exactly what this does but I did not get very far. I did run what you just said and here is what I found: If I do service MailScanner stop Then service sendmail status Sendmail is stopped UPDATE UPDATE I feel stupid :), and linux just kicks my behind. My mistake on what information I have been giving you, I am sorry :(. I cannot pass mail through the machine. How I have been testing was by sending a email to my external email address, that address gets forwarded to my work address where mailscanner would then process it. What I forgot was that I had changed my setup. I no longer was forwarding my email, but I setup a POP3 account on my outlook and it received the email that way. (hope that makes sense) In other words, the email was never passing through mailscanner. So I believe my sendmail chkconfig to be correct. Now I am really lost on what to check. ?? > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: Tuesday, April 19, 2005 10:53 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > Did you kill the sendmail service and stop it from starting when the > system boots? > As the installation script tells you, you need to do this after > installation (I kept it separate for clarity and also because a lot of > RPM-based systems do not have the "service" command). > chkconfig MailScanner on > chkconfig sendmail off > service sendmail stop > service MailScanner start > > I would suspect you still have a sendmail process running even after you > have done the "service MailScanner stop" as it will be left over the > "sendmail" service, which is not wanted. > > Billy Pumphrey wrote: > > >I think that I have a clue! > > > >I stopped mailscanner via service MailScanner stop. > >Then I sent a message to test to see if it would come through and it did. > > > >So messages are not even going through MailScanner. At this point I do > not > >know how to trouble shoot why really. I thought that I configured my new > >server (this one) the same as my last one. My setup is that MailScanner > is > >the relay between the internet and my exchange server 10.1.1.2. I will > run > >briefly what I did. > >Edited mailertable to: > >Woodmaclaw.com esmtp:[10.1.1.2] > >www.woodmaclaw.com esmtp:[10.1.1.2] > > > >Then I ran the makefile thing (??? Can't recall the command) for > >mailtertable > > > >Other than that I change organization name and such in MailScanner.conf. > > > >------------------------ MailScanner list ------------------------ To > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >'leave mailscanner' in the body of the email. > >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > >Support MailScanner development - buy the book off the website! > > > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Tue Apr 19 21:12:48 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rob Poe wrote: >I guess the thing about it is this: > >If we're blocking executable files, then how would that rule help? > >I'm not being argumentative .. Just curious.. > > > Rob, I run with that rule turned off because it caused too much trouble BUT I block all executables (pif, bat, exe, ...). Turns out I was never caught off guard, even with slow antivirus updates. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From pparsons at COLUMBIAFUELS.COM Tue Apr 19 21:55:11 2005 From: pparsons at COLUMBIAFUELS.COM (Philip Parsons) Date: Thu Jan 12 21:29:21 2006 Subject: MCP whitelist Message-ID: I cannot seem to find a way to add an MCp white list. I see a reference to it in mcp.spam.assassin.prefs.conf but it does not seem to be working I have the entries setup this way.. whitelist_from noc@xxxxx.com whitelist_from wsjohnson@xxxxxx.net whitelist_from brandy@xxxxx.com whitelist_from *@xxxx.ca Any ideas.. Thank you. Philip Parsons Team Leader, IT Columbia Fuels Inc. 2669 Wilfert Rd., Victoria BC, V9B 5Z3 Phone: (250) 391-3638 Cell: (250) 883-5972 http://www.columbiafuels.com http://www.columbiaenergy.com http://www.columbiaice.com pparsons@columbiafuels.com E-mail protection by Mailscanner/SA Virus protection by Bitdefender/ClamAv ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ds at CARIBENET.COM Wed Apr 20 00:30:34 2005 From: ds at CARIBENET.COM (Dirk Enrique Seiffert) Date: Thu Jan 12 21:29:21 2006 Subject: SuSE 9.2 rcMailScanner startup script Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] El Lun 18 Abr 2005 11:08, Drew Marshall escribió: > Dirk Enrique Seiffert said: > > I am running MailScanner 4.40.11 on SuSE 9.2 Professional with a > > selfcompiled > > postfix-2.1.5-3.2. Postfix runs in chroot environment. Installation was > > no problem at all. The SuSE package worked out of the box. as discribed > > install > > instructions for postfix on www.mailscanner.info . > > > > Staring MailScanner with rcMailScanner start I get: > > > > Initializing incoming postfixInitializing outgoing postfix failed > > I spent a while playing with this. It's because Postfix is started by Suse > automatically (And Yast won't let you turn it off) and MailScanner tries > to start Postfix as well and gets a failure (Which is what the start up > script is reporting). I found by tweeking the start up script I could get > rid of the error (Which as you correctly say, is cosmetic). I set chkconfig postfix off, so postfix gets called from the rcMailScanner script. Do you remember which modification you did in the startup script? Thanks a lot Enrique > > Drew > > > -- > In line with our policy, this message has > been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > www.themarshalls.co.uk/policy > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Dirk Enrique Seiffert CaribeNet S.A. - Cartagena - Colombia www.caribenet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From d.jones at FX.NET.NZ Wed Apr 20 01:11:45 2005 From: d.jones at FX.NET.NZ (Donovan Jones) Date: Thu Jan 12 21:29:21 2006 Subject: Stray processes on Debain Sarge Message-ID: Hi I have 2 mailscanner boxes running on Debian sarge. All software is currently up to date with whats in sarge, versions are: razor 2.670-1 pyzor 0.4.0+cvs20030 dcc 1.2.74-2 f-prot 0.5.14 spamassassin 3.0.2-1 mailscanner 4.40.11-1 exim 4.50-4 on both boxes I am having the same problems with stray processes. I have hundreds of pyzor processes that have not been killed: mf1:~# ps auxww | grep pyzor | wc -l 617 each one is keeping a UDP port open (lsof -i output): pyzor 30845 Debian-exim 3u IPv4 3426743 UDP *:60561 I am not getting spamassassin timeouts and I am getting PYZOR_CHECK matches in my spamassassin reports so pyzor is working but some processes don't seem to be killed. The other problem is MailScanner processes that chew up 100% CPU time. These are long running processes that need to be killed manually and occur once every few days. Are these known issues? Does anyone else see the same behavior on Debian Sarge? What is the fix? Is there a monitor script I can use or should I write my own to kill Mailscanner and pyzor processes older than an hour say. Help appreciated -- Donovan Jones ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From b.addis at TIMESMEDIA.CO.NZ Wed Apr 20 01:24:20 2005 From: b.addis at TIMESMEDIA.CO.NZ (Brent Addis) Date: Thu Jan 12 21:29:21 2006 Subject: Stray processes on Debain Sarge Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm running a similar setup on 2 debian sarge boxes without a problem (I run an older exim, I need to migrate I know). Send me a copy of your configs and I will compare. Regards, Brent Addis Group Systems Administrator Times Media Group "He who knows, does not speak. He who speaks, does not know". -- Lao Tsu Donovan Jones wrote: >Hi > >I have 2 mailscanner boxes running on Debian sarge. All software is >currently up to date with whats in sarge, versions are: > >razor 2.670-1 >pyzor 0.4.0+cvs20030 >dcc 1.2.74-2 >f-prot 0.5.14 >spamassassin 3.0.2-1 >mailscanner 4.40.11-1 >exim 4.50-4 > >on both boxes I am having the same problems with stray processes. > >I have hundreds of pyzor processes that have not been killed: > >mf1:~# ps auxww | grep pyzor | wc -l >617 > >each one is keeping a UDP port open (lsof -i output): > >pyzor 30845 Debian-exim 3u IPv4 3426743 UDP *:60561 > >I am not getting spamassassin timeouts and I am getting PYZOR_CHECK >matches in my spamassassin reports so pyzor is working but some >processes don't seem to be killed. > >The other problem is MailScanner processes that chew up 100% CPU time. >These are long running processes that need to be killed manually and >occur once every few days. > >Are these known issues? Does anyone else see the same behavior on Debian >Sarge? What is the fix? Is there a monitor script I can use or should I >write my own to kill Mailscanner and pyzor processes older than an hour >say. > >Help appreciated > >-- >Donovan Jones > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From trystenx at gmail.com Wed Apr 20 01:58:22 2005 From: trystenx at gmail.com (Senthu) Date: Thu Jan 12 21:29:21 2006 Subject: Spam tag Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello there, I recently upgraded my clamav 8.03. After doing this I noticed that all the mails that I sent out from my server is been taged as {SPAM}. Can you please help me on this. Im running:- sendmail 8.12.10 perl 5.8.3 Mailscanner 4.29.7 OS = Solaris 8 I have checked my messages the following messages are shown. i have reinstaller clam Av two times to yesterday and today as i was getting the messages below in no(1). After i reinstall clam av i get messages as below in no(2). I also recieved messages no(3) before installing Clam Av. Please help as i, dont know where is the problem. no(1) MailScanner[9175]: Message j3K0Emah009331 from 219.94.76.122 (senthu@privasia.com) to priv asia.com is spam, SBL+XBL 2) ID 801593 mail.crit] j3K0CZai009304: SYSERR(root): header syntax error, line "X-Priv asia Sdn Bhd-MailScanner-SpamScore: s" 3) Apr 20 08:17:15 explorer@rubesg.com MailScanner[24670]: Spam Checks: Found 1 spam messages Apr 20 08:17:15 explorer@rubesg.com MailScanner[24670]: Spam Actions: message j3K0HCah009418 actions are delete Apr 20 08:17:15 explorer@rubesg.com MailScanner[24670]: Virus and Content Scanning: Starting Apr 20 08:17:17 explorer@rubesg.com MailScanner[24670]: MailScanner child dying of old age Apr 20 08:17:18 explorer@rubesg.com MailScanner[9428]: MailScanner E-Mail Virus Scanner version 4.29.7 starting... Apr 20 08:17:18 explorer@rubesg.com MailScanner[9428]: Using Custom Function file /opt/MailScanner/lib/MailScanner/CustomFunct ions/MyExample.pm ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 08:09:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Rob Poe wrote: > >> I guess the thing about it is this: >> If we're blocking executable files, then how would that rule help? >> >> I'm not being argumentative .. Just curious.. >> >> >> > Rob, > > I run with that rule turned off because it caused too much trouble BUT > I block all executables (pif, bat, exe, ...). Turns out I was never > caught off guard, even with slow antivirus updates. The other important thing to remember is that the "executable" block in filetype.conf will help you a lot here too, for when they evade your filename traps with a bit of social engineering (e.g. _exe instead of .exe). -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 08:10:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: MCP whitelist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I would whitelist them in MailScanner.conf and a ruleset, rather than in SpamAssassin. Should be faster. Add a ruleset to the "MCP Checks" setting, and then your whitelisted addresses will never get MCP-checked at all, which will save you some system load. If you need help writing a ruleset, check out the Book, the Wiki, the mailing list archives, etc... Philip Parsons wrote: > I cannot seem to find a way to add an MCp white list. I see a > reference to it in mcp.spam.assassin.prefs.conf but it does not seem > to be working I have the entries setup this way.. > > whitelist_from noc@xxxxx.com > whitelist_from wsjohnson@xxxxxx.net > whitelist_from brandy@xxxxx.com > whitelist_from *@xxxx.ca > > > Any ideas.. > > Thank you. > Philip Parsons > Team Leader, IT > > Columbia Fuels Inc. > 2669 Wilfert Rd., Victoria BC, V9B 5Z3 > Phone: (250) 391-3638 > Cell: (250) 883-5972 > _http://www.columbiafuels.com_ > _http://www.columbiaenergy.com_ > _http://www.columbiaice.com_ > pparsons@columbiafuels.com > E-mail protection by Mailscanner/SA > Virus protection by Bitdefender/ClamAv > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 08:13:57 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Stray processes on Debain Sarge Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I had a French student who I was helping out the other evening. He had loads of stray Pyzor processes too. He eventually just uninstalled Pyzor altogether, but he had exactly the same symptoms as you. Does Pyzor need regular server-name updates like Razor? I don't use Pyzor myself. Donovan Jones wrote: >Hi > >I have 2 mailscanner boxes running on Debian sarge. All software is >currently up to date with whats in sarge, versions are: > >razor 2.670-1 >pyzor 0.4.0+cvs20030 >dcc 1.2.74-2 >f-prot 0.5.14 >spamassassin 3.0.2-1 >mailscanner 4.40.11-1 >exim 4.50-4 > >on both boxes I am having the same problems with stray processes. > >I have hundreds of pyzor processes that have not been killed: > >mf1:~# ps auxww | grep pyzor | wc -l >617 > >each one is keeping a UDP port open (lsof -i output): > >pyzor 30845 Debian-exim 3u IPv4 3426743 UDP *:60561 > >I am not getting spamassassin timeouts and I am getting PYZOR_CHECK >matches in my spamassassin reports so pyzor is working but some >processes don't seem to be killed. > >The other problem is MailScanner processes that chew up 100% CPU time. >These are long running processes that need to be killed manually and >occur once every few days. > >Are these known issues? Does anyone else see the same behavior on Debian >Sarge? What is the fix? Is there a monitor script I can use or should I >write my own to kill Mailscanner and pyzor processes older than an hour >say. > >Help appreciated > >-- >Donovan Jones > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 08:21:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Spam tag Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You have a space in your definition of %org-name% at the top of MailScanner.conf (I suspect). Senthu wrote: > Hello there, > > I recently upgraded my clamav 8.03. After doing this I > noticed that all the mails that I sent out from my > server is been taged as {SPAM}. Can you please help me > on this. Im running:- > > sendmail 8.12.10 > perl 5.8.3 > Mailscanner 4.29.7 > OS = Solaris 8 > > >I have checked my messages the following messages are shown. i have >reinstaller clam Av two times to yesterday and today as i was getting >the messages below in no(1). After i reinstall clam av i get messages >as below in no(2). I also recieved messages no(3) before installing >Clam Av. Please help as i, dont know where is the problem. > > > >no(1) MailScanner[9175]: Message j3K0Emah009331 from 219.94.76.122 >(senthu@privasia.com) to priv >asia.com is spam, SBL+XBL > >2) ID 801593 mail.crit] j3K0CZai009304: SYSERR(root): header syntax >error, line "X-Priv >asia Sdn Bhd-MailScanner-SpamScore: s" > >3) Apr 20 08:17:15 explorer@rubesg.com MailScanner[24670]: Spam >Checks: Found 1 spam messages >Apr 20 08:17:15 explorer@rubesg.com MailScanner[24670]: Spam Actions: >message j3K0HCah009418 actions are delete >Apr 20 08:17:15 explorer@rubesg.com MailScanner[24670]: Virus and >Content Scanning: Starting >Apr 20 08:17:17 explorer@rubesg.com MailScanner[24670]: MailScanner >child dying of old age >Apr 20 08:17:18 explorer@rubesg.com MailScanner[9428]: MailScanner >E-Mail Virus Scanner version 4.29.7 starting... >Apr 20 08:17:18 explorer@rubesg.com MailScanner[9428]: Using Custom >Function file /opt/MailScanner/lib/MailScanner/CustomFunct >ions/MyExample.pm > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From anders.andersson at LTKALMAR.SE Wed Apr 20 08:35:26 2005 From: anders.andersson at LTKALMAR.SE (Anders Andersson, IT) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rob Poe > Sent: Tuesday, April 19, 2005 7:38 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Microsoft's own email filtering > > MS Exchange Server: 689.20 > MS Exchange User CAL: 49.56/user > MS Outlook 2003: 99.40/seat Accordign to my contact Outlook is included for every CAL you buy..... But its still not cheap :( > > The knowledge you still have a better solution than > Microsoft....Priceless!! > > > > >>> MailScanner@ECS.SOTON.AC.UK 4/19/2005 11:12:12 AM >>> > If, for a laugh, you want to see what Micrsosoft run > themselves in the way of virus/spam scanning, take a look at > the first document listed at the bottom of > > http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC3 5AD-8BA1-48B1-91F3-563313EE878A&displaylang=en > > It's a real hoot :-) > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From goudron_et_plumes at YAHOO.FR Wed Apr 20 08:49:22 2005 From: goudron_et_plumes at YAHOO.FR (Nestor Burma) Date: Thu Jan 12 21:29:21 2006 Subject: Widely different results between MailScanner and SA Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, We have been using SpamAssassin for quite some time, with very good results. Two months ago, we set up MailScanner above all that. By and by, it's very good. But we do get some spam that goes through. What is bothering us it that if we give those message to SA (spamassassin -D), SA properly tags them as Spam, sometimes with hugely different results. For example : MS + SA gives X-MailScanner-SpamCheck: not a spam, SpamAssassin (score=4.174, required 5, BAYES_95 2.06, HTML_40_50 0.04, HTML_MESSAGE 0.00, RCVD_IN_NJABL_DUL 0.09, RCVD_IN_SORBS_DUL 1.99) While Spammassassin -D gives X-Spam-Status: Yes, score=13.0 required=5.0 tests=AWL,BAYES_99,HTML_40_50, HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL, RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,RCVD_IN_XBL autolearn=no version=3.0.2 So where is/are our mistake(s) in MS configuration ? Thanks, NB. __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Wed Apr 20 09:01:18 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:21 2006 Subject: maillog logging level Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Billy Pumphrey > Sent: den 19 april 2005 21:45 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > > When I set it up I either ran the one in the mailscanner book: > Chkconfig --level all sendmail off > Chkconfig --level 345 MailScanner on > Service sendmail stop > Service MailScanner start > > Or the one on the site > http://www.sng.ecs.soton.ac.uk/mailscanner/install/linux.shtml > > service sendmail stop > chkconfig sendmail off > chkconfig --level 2345 MailScanner on > service MailScanner start > > > I do not recall which one that I did, but that did confuse me a little > because they are different. I tried researching exactly what > this does but > I did not get very far. They are assentially the same (less the Capital letter, and that one setup MS to run at runlevel 2 as well... the --level is just someone being explicit:-). > I did run what you just said and here is what I found: > > If I do service MailScanner stop > Then service sendmail status > Sendmail is stopped > > UPDATE UPDATE > I feel stupid :), and linux just kicks my behind. My mistake on what > information I have been giving you, I am sorry :(. I cannot pass mail > through the machine. How I have been testing was by sending > a email to my > external email address, that address gets forwarded to my > work address where > mailscanner would then process it. What I forgot was that I > had changed my > setup. I no longer was forwarding my email, but I setup a > POP3 account on > my outlook and it received the email that way. > (hope that makes sense) > > In other words, the email was never passing through mailscanner. > > So I believe my sendmail chkconfig to be correct. Now I am > really lost > on what to check. ?? Ok, so you don't pass any mail through the system, and don't get any logs of this nonevent? So... "service MailScanner start", then use the connection testing examples in the wiki http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot :mta:connexion ... If that works OK, then arrange for mail to be passed through it... The same as you did for the "other machine"... Be it by FW rules, MX record or whatever. Or have you done that, and it still doesn't work? -- Glenn > > > -----Original Message----- > > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > > Sent: Tuesday, April 19, 2005 10:53 AM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: maillog logging level > > > > Did you kill the sendmail service and stop it from starting when the > > system boots? > > As the installation script tells you, you need to do this after > > installation (I kept it separate for clarity and also > because a lot of > > RPM-based systems do not have the "service" command). > > chkconfig MailScanner on > > chkconfig sendmail off > > service sendmail stop > > service MailScanner start > > > > I would suspect you still have a sendmail process running even after > you > > have done the "service MailScanner stop" as it will be left over the > > "sendmail" service, which is not wanted. > > > > Billy Pumphrey wrote: > > > > >I think that I have a clue! > > > > > >I stopped mailscanner via service MailScanner stop. > > >Then I sent a message to test to see if it would come > through and it > did. > > > > > >So messages are not even going through MailScanner. At > this point I > do > > not > > >know how to trouble shoot why really. I thought that I > configured my > new > > >server (this one) the same as my last one. My setup is that > MailScanner > > is > > >the relay between the internet and my exchange server 10.1.1.2. I > will > > run > > >briefly what I did. > > >Edited mailertable to: > > >Woodmaclaw.com esmtp:[10.1.1.2] > > >www.woodmaclaw.com esmtp:[10.1.1.2] > > > > > >Then I ran the makefile thing (??? Can't recall the command) for > > >mailtertable > > > > > >Other than that I change organization name and such in > MailScanner.conf. > > > > > >------------------------ MailScanner list > ------------------------ To > > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > >'leave mailscanner' in the body of the email. > > >Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > >Support MailScanner development - buy the book off the website! > > > > > > > > > > > > > -- > > Julian Field > > www.MailScanner.info > > Buy the MailScanner book at www.MailScanner.info/store > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > > archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ianb at OPTEQINT.NET Wed Apr 20 09:06:15 2005 From: ianb at OPTEQINT.NET (Ian Barnes) Date: Thu Jan 12 21:29:21 2006 Subject: Deleteing Mails from Sendmails queue Message-ID: Hi, Im using Sendmail with Mailscanner. Now i have a need to delete certain mails from the mail queue. Im writing a basic page that will display the mails and then the admin can just delete the mails in the queue that he chooses. I currently use the following commands to get the queues: Incoming: sendmail -bp -OQueueDirectory=/var/spool/mqueue.in Outgoing: sendmail -bp Now, If i want to delete a message that appears in the list, how can i do it? Thanks, Ian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Jan-Peter.Koopmann at SECEIDOS.DE Wed Apr 20 09:31:33 2005 From: Jan-Peter.Koopmann at SECEIDOS.DE (Jan-Peter Koopmann) Date: Thu Jan 12 21:29:21 2006 Subject: Widely different results between MailScanner and SA Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, > So where is/are our mistake(s) in MS configuration ? Looks like you are using different SA configurations. Check your MailScanner conf to see where MailScanner is searching for the SA config. Check spam.assassin.prefs.conf (which I personally link to my local.cf) to ensure the same rules/scores are used. Under which user does MailScanner run? And your manual SA test? Regards, JP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ianb at OPTEQINT.NET Wed Apr 20 09:34:27 2005 From: ianb at OPTEQINT.NET (Ian Barnes) Date: Thu Jan 12 21:29:21 2006 Subject: Blocking a single user Message-ID: Hi again, I want to blocka certain users email from being accepted onto my network. Now, i dont want to just mark it as spam or high spam, i just want to delete it. Is this possible ? Thanks, Ian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Wed Apr 20 10:48:30 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:29:21 2006 Subject: Deleteing Mails from Sendmails queue Message-ID: On Wed, 2005-04-20 at 09:06 +0100, Ian Barnes wrote: > Hi, > > Im using Sendmail with Mailscanner. Now i have a need to delete certain > mails from the mail queue. Im writing a basic page that will display the > mails and then the admin can just delete the mails in the queue that he > chooses. > > I currently use the following commands to get the queues: > > Incoming: sendmail -bp -OQueueDirectory=/var/spool/mqueue.in > Outgoing: sendmail -bp > > Now, If i want to delete a message that appears in the list, how can i do it? > Firstly - you'll need to make sure that the user you are running as has permissions to the relevant directories and files - then you can run: $ rm /qf /df to remove the message pairs - I don't fancy your chances or removing anything from the Incoming queue before it get's processed by MailScanner (unless you've a huge backlog). Regards, Steve. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 11:21:46 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: Blocking a single user Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Your best bet would be to use your MTA to do this. In sendmail, for example, you could put their addresses in the access db with the "REJECT" value for each address. If you really want MailScanner to do it, then the usual trick is to set Is Definitely Spam = %rules-dir%/your.address.rules Definite Spam Is High Scoring = yes High Scoring Spam Actions = delete And in the "your.address.rules" file, put lines like this: From: deleteme@nasty.com yes And a default rule FromOrTo: default no Ian Barnes wrote: >Hi again, > >I want to blocka certain users email from being accepted onto my network. >Now, i dont want to just mark it as spam or high spam, i just want to delete it. > >Is this possible ? > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Wed Apr 20 11:29:01 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:29:21 2006 Subject: Blocking a single user Message-ID: Hi Ian, On Wed, 2005-04-20 at 09:34 +0100, Ian Barnes wrote: > Hi again, > > I want to blocka certain users email from being accepted onto my network. > Now, i dont want to just mark it as spam or high spam, i just want to delete it. > > Is this possible ? > Yes - you do can do this in two ways: 1) You could do it using a spam blacklist in MailScanner in MailScanner.conf set the value 'Is Definitely Spam = /etc/MailScanner/rules/spam.blacklist.rules' and create the file /etc/MailScanner/rules/spam.blacklist.rules and add: To: yes FromOrTo: default no Then restart MailScanner. 2) You could do it at the MTA level (sendmail) This is probably better as this will save you some bandwidth and processor time. See http://www.sendmail.org/m4/anti_spam.html and look for FEATURE ('blacklist_recipients') for the full details. If you are on RedHat - all you need to do is edit /etc/mail/sendmail.mc and make sure that the line 'FEATURE('blacklist_recipients')' does not have a 'dnl' preceeding it. Then edit /etc/mail/access and add the line: user@domain.com REJECT Then rebuild the maps by running 'make -C /etc/mail'. What should then happen is that as part of the SMTP conversation Sendmail will display reject the message at the 'RCPT TO' stage with a 550 general purpose rejection error and therefore you don't have to actually receive the body of the message. Hope this helps. Kind regards, Steve. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Apr 20 14:03:15 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:21 2006 Subject: Question regarding Filename Rules Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Denis Beauchemin wrote: > >> Rob Poe wrote: >> >>> I guess the thing about it is this: >>> If we're blocking executable files, then how would that rule help? >>> >>> I'm not being argumentative .. Just curious.. >>> >>> >>> >> Rob, >> >> I run with that rule turned off because it caused too much trouble BUT >> I block all executables (pif, bat, exe, ...). Turns out I was never >> caught off guard, even with slow antivirus updates. > > > The other important thing to remember is that the "executable" block in > filetype.conf will help you a lot here too, for when they evade your > filename traps with a bit of social engineering (e.g. _exe instead of > .exe). Julian, I agree with you on this but I don't use filetype.conf because for now there are no viruses that ask people to rename _exe inti .exe. I also tell people to rename their .exe into something else if they want them to pass through my servers. As soon as one virus goes that route I will have to activate filetype.conf but I predict my users won't like it... But implementing security measures has always been PITA for users. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From Denis.Beauchemin at USHERBROOKE.CA Wed Apr 20 14:05:55 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:21 2006 Subject: Stray processes on Debain Sarge Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I had a French student who I was helping out the other evening. He had > loads of stray Pyzor processes too. He eventually just uninstalled Pyzor > altogether, but he had exactly the same symptoms as you. > > Does Pyzor need regular server-name updates like Razor? I don't use > Pyzor myself. I have a cron.daily job that does: pyzor discover Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From rpoe at PLATTESHERIFF.ORG Wed Apr 20 15:00:25 2005 From: rpoe at PLATTESHERIFF.ORG (Rob Poe) Date: Thu Jan 12 21:29:21 2006 Subject: Microsoft's own email filtering Message-ID: Groupwise is still cheaper ;) >>> anders.andersson@LTKALMAR.SE 4/20/2005 2:35:26 AM >>> > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rob Poe > Sent: Tuesday, April 19, 2005 7:38 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Microsoft's own email filtering > > MS Exchange Server: 689.20 > MS Exchange User CAL: 49.56/user > MS Outlook 2003: 99.40/seat Accordign to my contact Outlook is included for every CAL you buy..... But its still not cheap :( > > The knowledge you still have a better solution than > Microsoft....Priceless!! > > > > >>> MailScanner@ECS.SOTON.AC.UK 4/19/2005 11:12:12 AM >>> > If, for a laugh, you want to see what Micrsosoft run > themselves in the way of virus/spam scanning, take a look at > the first document listed at the bottom of > > http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC3 5AD-8BA1-48B1-91F3-563313EE878A&displaylang=en > > It's a real hoot :-) > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pparsons at COLUMBIAFUELS.COM Wed Apr 20 16:11:16 2005 From: pparsons at COLUMBIAFUELS.COM (Philip Parsons) Date: Thu Jan 12 21:29:21 2006 Subject: MCP whitelist Message-ID: I have checked out the Wiki and the Faq but all I can find is the link to http://www.sng.ecs.soton.ac.uk/mailscanner/install/mcp/ which does not mention anything about a adding a rule set ?? And when you say Add a ruleset to the "MCP Checks" setting, and then your whitelisted addresses will never get MCP-checked at all, I do not get it do you mean MCP Checks = no or yes point that to a ruleset ??? Some examples would be great.. Thanks.. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Wednesday, April 20, 2005 12:11 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: MCP whitelist I would whitelist them in MailScanner.conf and a ruleset, rather than in SpamAssassin. Should be faster. Add a ruleset to the "MCP Checks" setting, and then your whitelisted addresses will never get MCP-checked at all, which will save you some system load. If you need help writing a ruleset, check out the Book, the Wiki, the mailing list archives, etc... Philip Parsons wrote: > I cannot seem to find a way to add an MCp white list. I see a > reference to it in mcp.spam.assassin.prefs.conf but it does not seem > to be working I have the entries setup this way.. > > whitelist_from noc@xxxxx.com > whitelist_from wsjohnson@xxxxxx.net > whitelist_from brandy@xxxxx.com > whitelist_from *@xxxx.ca > > > Any ideas.. > > Thank you. > Philip Parsons > Team Leader, IT > > Columbia Fuels Inc. > 2669 Wilfert Rd., Victoria BC, V9B 5Z3 > Phone: (250) 391-3638 > Cell: (250) 883-5972 > _http://www.columbiafuels.com_ > _http://www.columbiaenergy.com_ > _http://www.columbiaice.com_ > pparsons@columbiafuels.com > E-mail protection by Mailscanner/SA > Virus protection by Bitdefender/ClamAv > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 16:19:03 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: MCP whitelist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] In MailScanner.conf, set "MCP Checks = %rules-dir%/mcp.checks.rules". Then in that file (which will probably be in /etc/MailScanner/rules/mcp.checks.rules unless you have changed the definition at the top of MailScanner.conf), you need to put lines like this: From: noc@xxxxx.com no From: wsjohnson@xxxxx.net no From: brandy@xxxx.com no To: abuse@* no To: postmaster@* no To: *@dont.mcp.me.com no FromOrTo: default yes For each line, if the address pattern and message direction match the message being checked, then the last entry on the line says what the value of "MCP Checks" will be. There is a default rule to say "yes, do MCP check everyone else". Philip Parsons wrote: >I have checked out the Wiki and the Faq but all I can find is the link >to http://www.sng.ecs.soton.ac.uk/mailscanner/install/mcp/ which does >not mention anything about a adding a rule set ?? And when you say Add >a ruleset to the "MCP Checks" setting, and then your whitelisted >addresses will never get MCP-checked at all, I do not get it do you mean >MCP Checks = no or yes point that to a ruleset ??? Some examples would >be great.. Thanks.. > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: Wednesday, April 20, 2005 12:11 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: MCP whitelist > >I would whitelist them in MailScanner.conf and a ruleset, rather than in >SpamAssassin. Should be faster. > >Add a ruleset to the "MCP Checks" setting, and then your whitelisted >addresses will never get MCP-checked at all, which will save you some >system load. > >If you need help writing a ruleset, check out the Book, the Wiki, the >mailing list archives, etc... > >Philip Parsons wrote: > > > >>I cannot seem to find a way to add an MCp white list. I see a >>reference to it in mcp.spam.assassin.prefs.conf but it does not seem >>to be working I have the entries setup this way.. >> >>whitelist_from noc@xxxxx.com >>whitelist_from wsjohnson@xxxxxx.net >>whitelist_from brandy@xxxxx.com >>whitelist_from *@xxxx.ca >> >> >>Any ideas.. >> >>Thank you. >>Philip Parsons >>Team Leader, IT >> >>Columbia Fuels Inc. >>2669 Wilfert Rd., Victoria BC, V9B 5Z3 >>Phone: (250) 391-3638 >>Cell: (250) 883-5972 >>_http://www.columbiafuels.com_ >>_http://www.columbiaenergy.com_ >>_http://www.columbiaice.com_ >>pparsons@columbiafuels.com >>E-mail protection by Mailscanner/SA >>Virus protection by Bitdefender/ClamAv >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>*Support MailScanner development - buy the book off the website!* >> >> > > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 16:21:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: MCP whitelist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You can add a ruleset to virtually everything in MailScanner.conf, so you can create incredibly complicated configuration systems if you want to. Different values for different arbitrary groups of email addresses (it even supports full regular expressions) for different configuration settings. Rulesets aren't specific to MCP Checks or anything, they are a general topic and are (I believe) fairly well documented. Have you considered buying the book? It's got loads of useful stuff like this in it. And a bargain at only $39.95. You can buy it (cheapest and fastest) straight off www.mailscanner.info. Philip Parsons wrote: >I have checked out the Wiki and the Faq but all I can find is the link >to http://www.sng.ecs.soton.ac.uk/mailscanner/install/mcp/ which does >not mention anything about a adding a rule set ?? And when you say Add >a ruleset to the "MCP Checks" setting, and then your whitelisted >addresses will never get MCP-checked at all, I do not get it do you mean >MCP Checks = no or yes point that to a ruleset ??? Some examples would >be great.. Thanks.. > > >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: Wednesday, April 20, 2005 12:11 AM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: MCP whitelist > >I would whitelist them in MailScanner.conf and a ruleset, rather than in >SpamAssassin. Should be faster. > >Add a ruleset to the "MCP Checks" setting, and then your whitelisted >addresses will never get MCP-checked at all, which will save you some >system load. > >If you need help writing a ruleset, check out the Book, the Wiki, the >mailing list archives, etc... > >Philip Parsons wrote: > > > >>I cannot seem to find a way to add an MCp white list. I see a >>reference to it in mcp.spam.assassin.prefs.conf but it does not seem >>to be working I have the entries setup this way.. >> >>whitelist_from noc@xxxxx.com >>whitelist_from wsjohnson@xxxxxx.net >>whitelist_from brandy@xxxxx.com >>whitelist_from *@xxxx.ca >> >> >>Any ideas.. >> >>Thank you. >>Philip Parsons >>Team Leader, IT >> >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From suporte at SETINET.COM.BR Wed Apr 20 14:58:21 2005 From: suporte at SETINET.COM.BR (Suporte SETi) Date: Thu Jan 12 21:29:21 2006 Subject: Store files but not store virus Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Today all files blocked by the rules, goes to var/spool/MalScanner/quarantine/xxx I want so.. but the problem is that virus are going too! I can say to NO STORE VIRUS FILES? thanks -------------------------------------------------------------------- Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Apr 20 19:08:01 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:21 2006 Subject: Store files but not store virus Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Suporte SETi wrote: > Today all files blocked by the rules, goes to > var/spool/MalScanner/quarantine/xxx > I want so.. but the problem is that virus are going too! > > I can say to NO STORE VIRUS FILES? > # There is no point quarantining most viruses these days as the infected # messages contain no useful content, so if you set this to "no" then no # infections listed in your "Silent Viruses" setting will be quarantined, # even if you have chosen to quarantine infections in general. This is # currently set to "yes" so the behaviour is the same as it was in # previous versions. # This can also be the filename of a ruleset. Quarantine Silent Viruses = no # Strings listed here will be searched for in the output of the virus scanners. # It is used to list which viruses should be handled differently from other # viruses. If a virus name is given here, then # 1) The sender will not be warned that he sent it # 2) No attempt at true disinfection will take place # (but it will still be "cleaned" by removing the nasty attachments # from the message) # 3) The recipient will not receive the message, # unless the "Still Deliver Silent Viruses" option is set # Other words that can be put in this list are the 5 special keywords # HTML-IFrame : inserting this will stop senders being warned about # HTML Iframe tags, when they are not allowed. # HTML-Codebase : inserting this will stop senders being warned about # HTML Object Codebase/Data tags, when they are not allowed. # HTML-Script : inserting this will stop senders being warned about # HTML Script tags, when they are not allowed. # HTML-Form : inserting this will stop senders being warned about # HTML Form tags, when they are not allowed. # Zip-Password : inserting this will stop senders being warned about # password-protected zip files, when they are not allowed. # This keyword is not needed if you include All-Viruses. # All-Viruses : inserting this will stop senders being warned about # any virus, while still allowing you to warn senders # about HTML-based attacks. This includes Zip-Password # so you don't need to include both. # # The default of "All-Viruses" means that no senders of viruses will be # notified (as the sender address is always forged these days anyway), # but anyone who sends a message that is blocked for other reasons will # still be notified. # # This can also be the filename of a ruleset. Silent Viruses = All-Viruses Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From mark at TIPPINGMAR.COM Wed Apr 20 20:13:32 2005 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:29:21 2006 Subject: OT: Thunderbird and iptables Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Forgive the off-topic post, but what a great place this is to get the ear of a bunch of e-mail administrators. My offsite Thunderbird users, chen checking mail using IMAP, generate messages like the following from iptables: Apr 20 10:29:10 gingham kernel: IN= OUT=eth0 SRC=my.mailserver.ip.address DST=the.remote.ip.address LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=50142 DF PROTO=TCP SPT=36798 DPT=60933 WINDOW=7040 RES=0x00 ACK RST URGP=0 In spite of this, the Thunderbird clients seem to work just fine. Does anyone know why the mailserver tries to respond to the mail client using high ports from and to? If the packets are realted to the IMAP transaction, then why aren't they allowed by iptables, which is configured to allow ESTABLISHED and RELATED packets? If the packets are ACKs then they must be from a different port than the SYN was directed to, because the mailserver is behind a NAT firewall that doesn't forward high port traffic to the mail server by default. It's a Fedora Core 1 server, which uses UW-IMAP. Thanks for any hints. -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Wed Apr 20 20:43:53 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:21 2006 Subject: OT: Thunderbird and iptables Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I think your biggest hint should be to notice that the packet has the RST bit set. I doubt this is part of a connection originated by the server, but instead part of a connection originated, or trying to originate from, the remote. The RST flag generally means that the.remote sent a packet to an unserved port on your mailserver. The other case could be an abrupt close of the socket on the server side, such as a process kill. The RST packet would be generated by your mailserver as a method of warning the connection isn't valid and doesn't have any state tracking. If multiple resets were generated due to multiple offending packets, IPTables may refuse all but the first, as the connection was destroyed by the first RST (I see this all the time on cisco PIX equipment, a late arriving duplicate fin or rst packet gets dropped because there's no matching connection) However, that port pattern looks more like passive-mode FTP than IMAP.. but who knows, I'm no IMAP expert. So, I suppose your questions should be: 1) can the client try to connect to port 36798 on the server? 2) If not, does IMAP advertise secondary ports for the client to connect to (like passive FTP does)? 3) If so, can the remote try to make tcp connections to port 36798 if advertised by the IMAP server? Mark Nienberg wrote: > Forgive the off-topic post, but what a great place this is to get the > ear of a bunch of e-mail administrators. > > My offsite Thunderbird users, chen checking mail using IMAP, generate > messages like the following from iptables: > > Apr 20 10:29:10 gingham kernel: IN= OUT=eth0 > SRC=my.mailserver.ip.address DST=the.remote.ip.address > LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=50142 DF PROTO=TCP > SPT=36798 DPT=60933 WINDOW=7040 RES=0x00 ACK RST URGP=0 > > In spite of this, the Thunderbird clients seem to work just fine. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jfraley at GLENRAVEN.COM Wed Apr 20 20:49:26 2005 From: jfraley at GLENRAVEN.COM (Jon Fraley) Date: Thu Jan 12 21:29:21 2006 Subject: message size Message-ID: I have been asked to report on the message size for messages being processed by MailScanner 4.40.11. I have to be able to break it down by spam and not spam. Is there an easy way to do this? Looking in the logs I see where it gives the size in bytes. I have a question on the following situation: Apr 20 04:22:35 yoda MailScanner[10025]: New Batch: Found 3 messages waiting Apr 20 04:22:35 yoda MailScanner[10025]: New Batch: Scanning 2 messages, 4654 bytes Apr 20 04:22:35 yoda MailScanner[10025]: Spam Checks: Starting Is this the size for both messages? Not sure I understand how the processing goes at this point. Thanks for you help Jon ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Wed Apr 20 21:03:58 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:21 2006 Subject: message size Message-ID: Jon Fraley wrote: > I have been asked to report on the message size for messages being > processed by MailScanner 4.40.11. I have to be able to break it down > by spam and not spam. Is there an easy way to do this? Looking in > the logs I see where it gives the size in bytes. I have a question > on the following situation: > > Apr 20 04:22:35 yoda MailScanner[10025]: New Batch: Found 3 messages > waiting > Apr 20 04:22:35 yoda MailScanner[10025]: New Batch: Scanning 2 > messages, 4654 bytes > Apr 20 04:22:35 yoda MailScanner[10025]: Spam Checks: Starting > > Is this the size for both messages? Not sure I understand how the > processing goes at this point. MS processes messages in batch, so that may be the cummulative size of that batch, but the next run it will be different. I think it does up to 30 messages at a time, and if there's more than that another MailScanner process kicks in to take up the slack. By default there's five MS instances waiting in the wings. If you want to see totals of the messages processed, take a look at mailscanner-mrtg. It builds graphs which will show you all sorts of things like number of spam messages, total size of messages, total size of spam messages, number of virus messages, etc. HTH... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 20 21:02:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:21 2006 Subject: message size Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Jon Fraley wrote: >I have been asked to report on the message size for messages being >processed by MailScanner 4.40.11. I have to be able to break it down by >spam and not spam. Is there an easy way to do this? Looking in the >logs I see where it gives the size in bytes. I have a question on the >following situation: > >Apr 20 04:22:35 yoda MailScanner[10025]: New Batch: Found 3 messages >waiting >Apr 20 04:22:35 yoda MailScanner[10025]: New Batch: Scanning 2 messages, >4654 bytes >Apr 20 04:22:35 yoda MailScanner[10025]: Spam Checks: Starting > >Is this the size for both messages? > This is the total size of both messages. You would be better off getting the size of each message from the MTA logs. This will also give you the message ID for each message. You can then tie this to the spam logging generated by MailScanner, which will tell you if a message ID is spam or not. > Not sure I understand how the >processing goes at this point. > >Thanks for you help > >Jon > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ka at PACIFIC.NET Wed Apr 20 21:16:40 2005 From: ka at PACIFIC.NET (Ken A) Date: Thu Jan 12 21:29:22 2006 Subject: Microsoft's own email filtering Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wow. Take an expensive solution and add 3rd party software and an RBL, but be sure to ask geeky questions of the rbl operators first. I'm sure if you pay them, they'd tell you what the secret questions were... Brilliant. And Exchange can even refuse connections from certain IPs! That's powerful stuff. Earthlink's antispam autoresponder sends from <> too, unless they've fixed it, as do many other dumb autoresponders. Ken Pacific.Net Julian Field wrote: > But they do some lovely things. They block all incoming mail that > doesn't have an envelope sender address. This of course includes error > messages when people have spelled an email address incorrectly. But I > guess everyone at Microsoft is so clever they never mistype addresses. > > Martin Hepworth wrote: > >> Julian >> >> interesting indeed, and looking the the ppt presentation they've got >> eTrust on the desktops! >> >> There stats are consistent with mine...percentage wise.. >> >> More than 8.8 million external e-mail messages per day >> More than 7.5 million e-mail messages blocked per day >> >> >> -- >> Martin Hepworth >> Snr Systems Administrator >> Solid State Logic >> Tel: +44 (0)1865 842300 >> >> >> Julian Field wrote: >> >>> If, for a laugh, you want to see what Micrsosoft run themselves in the >>> way of virus/spam scanning, take a look at the first document listed at >>> the bottom of >>> >>> http://www.microsoft.com/downloads/details.aspx?FamilyID=17DC35AD-8BA1-48B1-91F3-563313EE878A&displaylang=en >>> >>> >>> >>> >>> It's a real hoot :-) >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> ********************************************************************** >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they >> are addressed. If you have received this email in error please notify >> the system manager. >> >> This footnote confirms that this email message has been swept >> for the presence of computer viruses and is believed to be clean. >> >> ********************************************************************** >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Wed Apr 20 22:55:10 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:29:22 2006 Subject: Microsoft's own email filtering Message-ID: > I might be wrong, but at a cursory glance it also looks like > they bounce spam. I reached the same conclusion > Will they ever be rich enough to buy a clue? Unlikely Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 | Fax. +353 59 9146970 Tired of your current host? Save 15% when you move to us! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From listonly at WEBPRESENCEGROUP.NET Thu Apr 21 02:12:02 2005 From: listonly at WEBPRESENCEGROUP.NET (David Thurman) Date: Thu Jan 12 21:29:22 2006 Subject: Debian/mqueue.in issue Message-ID: Hello I have searched the mailing list, google and my old notes, I had to reload a new debian server here and installed ver. Sarge, used the testing version of MS (4.40.11) and SA (3.0.2) and am having MAJOR issues getting sendmail to drop mail into the /var/spool/mqueue.in I set sendmail.conf with: DAEMON_PARMS="-bd -OPrivacyOptions=noetrn -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in"; Did a make, also did a sendmailconfig, stopped, and then started sendmail, also MS but still no luck with mail going to the mqueue.in first. Mail is going directly to /var/spool/mqueue My sendmail.cf shows correct though the /etc/init.d/sendmail doesn't seem to be written to correctly, I even manually edited this file. Still same effect, mail going to the wrong queue. I do see this when I do a ps aux: root 2494 0.0 0.3 6440 2424 ? Ss 13:41 0:00 sendmail: MTA: Queue runner@00:10:00 for /var/spool/mqueue I am at a loss as to where this is coming from, I did read about somehow related to submit.mc but I am starting to get a little confused on this. Any help I can be pointed to or the magic pill would be rewarded with a case of virtual beer of your choice:) Many thanks! -- David Thurman ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at ALPHA.RBRANA.CO.ID Thu Apr 21 03:51:13 2005 From: ius at ALPHA.RBRANA.CO.ID (ius) Date: Thu Jan 12 21:29:22 2006 Subject: more mcp Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, i have a question about MCP. I don't have the MS book yet. How can i notify sender that the email they sent got f*** word and blocked by mcp ? Thanks guys ius ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 21 10:17:50 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: more mcp Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Set "MCP Actions = bounce" and "Bounce MCP As Attachment = yes" and that should do it for you. You might want to set "High Scoring MCP Actions = bounce" as well. ius wrote: > Hi, > > i have a question about MCP. I don't have the MS book yet. > How can i notify sender that the email they sent got f*** word and > blocked by mcp ? > > Thanks guys > ius > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ius at ALPHA.RBRANA.CO.ID Thu Apr 21 10:26:39 2005 From: ius at ALPHA.RBRANA.CO.ID (ius) Date: Thu Jan 12 21:29:22 2006 Subject: more mcp Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Julian. Julian Field wrote: > Set "MCP Actions = bounce" and "Bounce MCP As Attachment = yes" and that > should do it for you. > > You might want to set "High Scoring MCP Actions = bounce" as well. > > ius wrote: > >> Hi, >> >> i have a question about MCP. I don't have the MS book yet. >> How can i notify sender that the email they sent got f*** word and >> blocked by mcp ? >> >> Thanks guys >> ius >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Apr 21 10:32:49 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:22 2006 Subject: SuSE 9.2 rcMailScanner startup script Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dirk Enrique Seiffert said: > I set chkconfig postfix off, so postfix gets called from the rcMailScanner > script. Do you remember which modification you did in the startup script? I am sorry, I don't and I have moved that box now over to FreeBSD (My preferred OS). I remember it was a bit trial and error and involved moving ome of the sleep times (It's a slow box :-( )and I changed one of the status flags on the start up part of the script. It's fairly easy to follow. Sorry I can't help further. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From m.sapsed at BANGOR.AC.UK Thu Apr 21 12:34:35 2005 From: m.sapsed at BANGOR.AC.UK (Martin Sapsed) Date: Thu Jan 12 21:29:22 2006 Subject: Could not parse Outlook Rich Text attachment Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Derril Hedk wrote: > >> Hello, >> >> Some of my customers are receiving the following notice: >> >> Could not parse Outlook Rich Text attachment >> >> as part of a blocked email. I am wondering if there is any way to turn >> this feature off so that it doesn't even try to parse the email? >> >> > 2 answers: > > 1) Try "TNEF Expander = internal" as the internal one, while slower, is > more flexible in what it can parse. > 2) If that doesn't help, then just set "Expand TNEF = no" to disable > TNEF expansion completely. 3) The external TNEF expander referred to by "TNEF Expander = " in MailScanner.conf doesn't exist. Try installing it again or build it by hand. (Speaking from experience on some Solaris systems but can't recall the circumstances which led to building/installing tnef failed...) Cheers, Martin -- Martin Sapsed Microcomputer Support Manager Information Services "Who do you say that I am?" University of Wales, Bangor Jesus of Nazareth ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From pearsoa at SUNBEAM.COM Thu Apr 21 15:52:03 2005 From: pearsoa at SUNBEAM.COM (AP) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: Hey Guys, Is there a way that I can shutdown the reception of mail to the inbound queue while still allowing MailScanner to process what's currently in the inbound queue and still allow the delivery of mail in the post-processing queue? I know that I could turn off port 25 on the Firewall to the specific mail gateway but I would like to do this on the Mail Gateway itself. Here's my reason. We sometimes early in the mornings (3-4am) get directed SPAM attacks that loads up our primary mail gateway. Our inbound queues can get quite large and the primary mail gateway will continue receiving the mail without regard to how large the inbound queue is getting. We can sometimes get 3000-5000 messages in the inbound queue while our secondary mail gateway is practically idle. I was thinking that I could write a mailqin monitoring script that would poll the queue every 5 minutes and if it has reached some kind of threshold, say 500-1000 messages, it would then stop the receiving of inbound mail until MailScanner had processed the queue down to some minimum, say 100 messages, before it would start back the receiving of mail. That way the secondary mail gateway would start taking on some of the load and we could avoid some of the message delays that we get because of the backlog. Our primary and secondary mail gateways are fairly heavy duty boxes, Server class with dual hyper-threaded processors and lots of memory so it is not that the boxes are underpowered it's just that the secondary box is being under utilized. Any thoughts or suggestions would be welcome. If there is a better way to handle this I would be interested to know. Thanks, AP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Thu Apr 21 15:51:52 2005 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:29:22 2006 Subject: config file - using file from older version in newer version Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, Is it okay to use a MS configuration file from an older version (MS 4.37.7) in a newer version of MS (MS 4.39.6)? I'm setting up another server and I'm moving my configuration files for MS, etc. to that new machine. Thanks, Rod -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Thu Apr 21 16:07:09 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:22 2006 Subject: config file - using file from older version in newer version Message-ID: You need to run upgrade_MailScanner_conf found in the bin directory within the MS heirarchy. Stef > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: 21 April 2005 15:52 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: config file - using file from older version in newer version > > Hello, > > Is it okay to use a MS configuration file from an older version (MS > 4.37.7) in a newer version of MS (MS 4.39.6)? I'm setting up > another server and I'm moving my configuration files for MS, > etc. to that new machine. > > Thanks, > Rod > > -- > This message has been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This email has been scanned by the Level 5 Internet > MailCrusader for viruses, spam and dangerous content. > For more information please visit http://www.l5net.net > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 21 16:12:05 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:22 2006 Subject: config file - using file from older version in newer version Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Rodney Green wrote: > Hello, > > Is it okay to use a MS configuration file from an older version (MS > 4.37.7) in a newer version of MS (MS 4.39.6)? I'm setting up another > server and I'm moving my configuration files for MS, etc. to that new > machine. Rod, It's probably not a good idea to use it as is because there are probably new options that will not be found in your conf file. You could copy it over to your new server and then run the upgrade script /usr/sbin/upgrade_MailScanner_conf to get the new options back. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Thu Apr 21 16:14:25 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just kill the incoming MTA process. Read the MailScanner init.d script and you should be able to work out where it puts its PID file. Then when you want to restart the incoming MTA, do a "service MailScanner startin" or equivalent. The init.d script can be given start stop restart reload startin <--- just start the incoming MTA startout <--- just start the outgoing MTA status AP wrote: >Hey Guys, > >Is there a way that I can shutdown the reception of mail to the inbound >queue while still allowing MailScanner to process what's currently in the >inbound queue and still allow the delivery of mail in the post-processing >queue? > >I know that I could turn off port 25 on the Firewall to the specific mail >gateway but I would like to do this on the Mail Gateway itself. > >Here's my reason. We sometimes early in the mornings (3-4am) get directed >SPAM attacks that loads up our primary mail gateway. Our inbound queues >can get quite large and the primary mail gateway will continue receiving >the mail without regard to how large the inbound queue is getting. We can >sometimes get 3000-5000 messages in the inbound queue while our secondary >mail gateway is practically idle. > >I was thinking that I could write a mailqin monitoring script that would >poll the queue every 5 minutes and if it has reached some kind of >threshold, say 500-1000 messages, it would then stop the receiving of >inbound mail until MailScanner had processed the queue down to some >minimum, say 100 messages, before it would start back the receiving of >mail. That way the secondary mail gateway would start taking on some of >the load and we could avoid some of the message delays that we get because >of the backlog. > >Our primary and secondary mail gateways are fairly heavy duty boxes, Server >class with dual hyper-threaded processors and lots of memory so it is not >that the boxes are underpowered it's just that the secondary box is being >under utilized. > >Any thoughts or suggestions would be welcome. If there is a better way to >handle this I would be interested to know. > >Thanks, > >AP > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Thu Apr 21 16:10:59 2005 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:29:22 2006 Subject: config file - using file from older version in newer version Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks Stef, do I just put the config file in place in the /etc/MailScanner directory and then run upgrade_MailScanner_conf? Rod Stef Morrell wrote: > You need to run > > upgrade_MailScanner_conf > > found in the bin directory within the MS heirarchy. > > Stef > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green >>Sent: 21 April 2005 15:52 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: config file - using file from older version in newer version >> >>Hello, >> >>Is it okay to use a MS configuration file from an older version (MS >>4.37.7) in a newer version of MS (MS 4.39.6)? I'm setting up >>another server and I'm moving my configuration files for MS, >>etc. to that new machine. >> >>Thanks, >>Rod >> >>-- >>This message has been scanned for viruses and dangerous >>content by MailScanner, and is believed to be clean. >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) >>and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>-- >>This email has been scanned by the Level 5 Internet >>MailCrusader for viruses, spam and dangerous content. >>For more information please visit http://www.l5net.net >> >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kodak at FRONTIERHOMEMORTGAGE.COM Thu Apr 21 16:17:09 2005 From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: AP <> wrote: > Is there a way that I can shutdown the reception of mail to the > inbound queue while still allowing MailScanner to process what's > currently in the inbound queue and still allow the delivery of mail > in the post-processing queue? > > I know that I could turn off port 25 on the Firewall to the specific > mail gateway but I would like to do this on the Mail Gateway itself. There are lots and lots of ways you could achieve this, but you need to tell us a little bit more about your setup. For example, are you running Linux? FreeBSD? Solaris? Just one method: if you're using linux, you could use iptables to block inbound port 25 on the mail server (or re-direct it to the backup mail server) when your trigger goes off. Most modern *nix varients have some sort of built in firewall that could be manipulated in this fashion. --J(K) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stef at L5NET.NET Thu Apr 21 16:17:42 2005 From: stef at L5NET.NET (Stef Morrell) Date: Thu Jan 12 21:29:22 2006 Subject: config file - using file from older version in newer version Message-ID: General syntax: upgrade_MailScanner_conf old_MailScanner.conf default_new_MailScanner.conf > MailScanner.new It reads the old conf, retaining any altered settings and adds in the default values of any new settings to the output. Check the newly created file, then cp MailScanner.new MailScanner.conf Hmm.. yes, as Denis says, the script might be in /usr/sbin - Depends on what kind of install you have. Stef > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > Sent: 21 April 2005 16:11 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: config file - using file from older version in > newer version > > Thanks Stef, do I just put the config file in place in the > /etc/MailScanner directory and then run upgrade_MailScanner_conf? > > Rod > > Stef Morrell wrote: > > You need to run > > > > upgrade_MailScanner_conf > > > > found in the bin directory within the MS heirarchy. > > > > Stef > > > > > >>-----Original Message----- > >>From: MailScanner mailing list > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green > >>Sent: 21 April 2005 15:52 > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: config file - using file from older version in > newer version > >> > >>Hello, > >> > >>Is it okay to use a MS configuration file from an older version (MS > >>4.37.7) in a newer version of MS (MS 4.39.6)? I'm setting > up another > >>server and I'm moving my configuration files for MS, etc. > to that new > >>machine. > >> > >>Thanks, > >>Rod > >> > >>-- > >>This message has been scanned for viruses and dangerous content by > >>MailScanner, and is believed to be clean. > >> > >>------------------------ MailScanner list > >>------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk > >>with the words: > >>'leave mailscanner' in the body of the email. > >>Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >>-- > >>This email has been scanned by the Level 5 Internet > MailCrusader for > >>viruses, spam and dangerous content. > >>For more information please visit http://www.l5net.net > >> > >> > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > This message has been scanned for viruses and dangerous > content by MailScanner, and is believed to be clean. > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This email has been scanned by the Level 5 Internet > MailCrusader for viruses, spam and dangerous content. > For more information please visit http://www.l5net.net > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rgreen at TRAYERPRODUCTS.COM Thu Apr 21 16:43:41 2005 From: rgreen at TRAYERPRODUCTS.COM (Rodney Green) Date: Thu Jan 12 21:29:22 2006 Subject: config file - using file from older version in newer version Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks everyone! Stef Morrell wrote: > General syntax: > > upgrade_MailScanner_conf old_MailScanner.conf > default_new_MailScanner.conf > MailScanner.new > > It reads the old conf, retaining any altered settings and adds in the > default values of any new settings to the output. Check the newly > created file, then > > cp MailScanner.new MailScanner.conf > > Hmm.. yes, as Denis says, the script might be in /usr/sbin - Depends on > what kind of install you have. > > Stef > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green >>Sent: 21 April 2005 16:11 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: config file - using file from older version in >>newer version >> >>Thanks Stef, do I just put the config file in place in the >>/etc/MailScanner directory and then run upgrade_MailScanner_conf? >> >>Rod >> >>Stef Morrell wrote: >> >>>You need to run >>> >>>upgrade_MailScanner_conf >>> >>>found in the bin directory within the MS heirarchy. >>> >>>Stef >>> >>> >>> >>>>-----Original Message----- >>>>From: MailScanner mailing list >>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rodney Green >>>>Sent: 21 April 2005 15:52 >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: config file - using file from older version in >> >>newer version >> >>>>Hello, >>>> >>>>Is it okay to use a MS configuration file from an older version (MS >>>>4.37.7) in a newer version of MS (MS 4.39.6)? I'm setting >> >>up another >> >>>>server and I'm moving my configuration files for MS, etc. >> >>to that new >> >>>>machine. >>>> >>>>Thanks, >>>>Rod >>>> >>>>-- >>>>This message has been scanned for viruses and dangerous content by >>>>MailScanner, and is believed to be clean. >>>> >>>>------------------------ MailScanner list >>>>------------------------ To unsubscribe, email >> >>jiscmail@jiscmail.ac.uk >> >>>>with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki >> >>(http://wiki.mailscanner.info/) and the >> >>>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>>-- >>>>This email has been scanned by the Level 5 Internet >> >>MailCrusader for >> >>>>viruses, spam and dangerous content. >>>>For more information please visit http://www.l5net.net >>>> >>>> >>> >>> >>>------------------------ MailScanner list >> >>------------------------ To >> >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki >> >>(http://wiki.mailscanner.info/) and the >> >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >> >>-- >>This message has been scanned for viruses and dangerous >>content by MailScanner, and is believed to be clean. >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) >>and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>-- >>This email has been scanned by the Level 5 Internet >>MailCrusader for viruses, spam and dangerous content. >>For more information please visit http://www.l5net.net >> >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Thu Apr 21 16:28:49 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] AP wrote: > Hey Guys, > > Is there a way that I can shutdown the reception of mail to the inbound > queue while still allowing MailScanner to process what's currently in the > inbound queue and still allow the delivery of mail in the post-processing > queue? > > I know that I could turn off port 25 on the Firewall to the specific mail > gateway but I would like to do this on the Mail Gateway itself. > > Here's my reason. We sometimes early in the mornings (3-4am) get directed > SPAM attacks that loads up our primary mail gateway. Our inbound queues > can get quite large and the primary mail gateway will continue receiving > the mail without regard to how large the inbound queue is getting. We can > sometimes get 3000-5000 messages in the inbound queue while our secondary > mail gateway is practically idle. > > I was thinking that I could write a mailqin monitoring script that would > poll the queue every 5 minutes and if it has reached some kind of > threshold, say 500-1000 messages, it would then stop the receiving of > inbound mail until MailScanner had processed the queue down to some > minimum, say 100 messages, before it would start back the receiving of > mail. That way the secondary mail gateway would start taking on some of > the load and we could avoid some of the message delays that we get because > of the backlog. > > Our primary and secondary mail gateways are fairly heavy duty boxes, Server > class with dual hyper-threaded processors and lots of memory so it is not > that the boxes are underpowered it's just that the secondary box is being > under utilized. > > Any thoughts or suggestions would be welcome. If there is a better way to > handle this I would be interested to know. > > Thanks, > > AP > If you are running on a RedHat or equivalent you could just run; service MailScanner stop service MailScanner startout or run the equivalent on the init script with full paths. And then service MailScanner startin when you want incoming again. Maybe a better idea would be to try some type of blacklist at the MTA level like sbl+xbl if it won't kill too much legit mail. That list alone kills 80% of my spam in the US. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From t.d.lee at DURHAM.AC.UK Thu Apr 21 17:02:54 2005 From: t.d.lee at DURHAM.AC.UK (David Lee) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: On Thu, 21 Apr 2005, Julian Field wrote: > AP wrote: > >> Hey Guys, >> >> Is there a way that I can shutdown the reception of mail to the inbound >> queue while still allowing MailScanner to process what's currently in the >> inbound queue and still allow the delivery of mail in the post-processing >> queue? >> > Just kill the incoming MTA process. Read the MailScanner init.d script > and you should be able to work out where it puts its PID file. Then when > you want to restart the incoming MTA, do a "service MailScanner startin" > or equivalent. The init.d script can be given > start > stop > restart > reload > startin <--- just start the incoming MTA > startout <--- just start the outgoing MTA > status Julian: Might it be worth adding a "stopin" and "stopout"? This would complete the symmetry of the above list, and also allow the original enquirer ("AP") to have consistency in how he would stop and start the inbound process, i.e. a consistent pair "service MailScanner stopin" and "service MailScanner startin". (Naturally, some implementation rationalisation could be done so that "stop" would be (re)written to use "stopin" and "stopout"; likewise for the "start*" family.) Just a thought... -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : University of Durham : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham : : Phone: +44 191 334 2752 U.K. : ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 21 17:16:33 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott Silva wrote: >AP wrote: > > >>Hey Guys, >> >>Is there a way that I can shutdown the reception of mail to the inbound >>queue while still allowing MailScanner to process what's currently in the >>inbound queue and still allow the delivery of mail in the post-processing >>queue? >> >>I know that I could turn off port 25 on the Firewall to the specific mail >>gateway but I would like to do this on the Mail Gateway itself. >> >>Here's my reason. We sometimes early in the mornings (3-4am) get directed >>SPAM attacks that loads up our primary mail gateway. Our inbound queues >>can get quite large and the primary mail gateway will continue receiving >>the mail without regard to how large the inbound queue is getting. We can >>sometimes get 3000-5000 messages in the inbound queue while our secondary >>mail gateway is practically idle. >> >>I was thinking that I could write a mailqin monitoring script that would >>poll the queue every 5 minutes and if it has reached some kind of >>threshold, say 500-1000 messages, it would then stop the receiving of >>inbound mail until MailScanner had processed the queue down to some >>minimum, say 100 messages, before it would start back the receiving of >>mail. That way the secondary mail gateway would start taking on some of >>the load and we could avoid some of the message delays that we get because >>of the backlog. >> >>Our primary and secondary mail gateways are fairly heavy duty boxes, Server >>class with dual hyper-threaded processors and lots of memory so it is not >>that the boxes are underpowered it's just that the secondary box is being >>under utilized. >> >>Any thoughts or suggestions would be welcome. If there is a better way to >>handle this I would be interested to know. >> >>Thanks, >> >>AP >> >> >> >If you are running on a RedHat or equivalent you could just run; >service MailScanner stop >service MailScanner startout > > That will not start MailScanner, only the MTA. >or run the equivalent on the init script with full paths. >And then service MailScanner startin > > No, do a "service MailScanner restart" so you get MailScanner itself running again. >when you want incoming again. >Maybe a better idea would be to try some type of blacklist at the MTA >level like sbl+xbl if it won't kill too much legit mail. That list alone >kills 80% of my spam in the US. > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikes at HARTWELLCORP.COM Thu Apr 21 18:21:22 2005 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:29:22 2006 Subject: Microsoft's own email filtering Message-ID: >> Will they ever be rich enough to buy a clue? > > Unlikely They bought one but were unable to get it to install. -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Thu Apr 21 19:48:07 2005 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] AP, If you're concerned about an idle gateway, and these are your DNS MX boxes, I think (?) you can set up your MX records to be equal priority with a short TTL, thus creating a round-robin DNS. Of course, this won't help if this attack is rapid and short lived, but it may delegate some of the mail to the secondary alleviating some of the primary load. I could be wrong here. Please let the list correct me if so. Steve Campbell campbell@cnpapers.com Charleston Newspapers ----- Original Message ----- From: "AP" To: Sent: Thursday, April 21, 2005 10:52 AM Subject: Stop inbound > Hey Guys, > > Is there a way that I can shutdown the reception of mail to the inbound > queue while still allowing MailScanner to process what's currently in the > inbound queue and still allow the delivery of mail in the post-processing > queue? > > I know that I could turn off port 25 on the Firewall to the specific mail > gateway but I would like to do this on the Mail Gateway itself. > > Here's my reason. We sometimes early in the mornings (3-4am) get directed > SPAM attacks that loads up our primary mail gateway. Our inbound queues > can get quite large and the primary mail gateway will continue receiving > the mail without regard to how large the inbound queue is getting. We can > sometimes get 3000-5000 messages in the inbound queue while our secondary > mail gateway is practically idle. > > I was thinking that I could write a mailqin monitoring script that would > poll the queue every 5 minutes and if it has reached some kind of > threshold, say 500-1000 messages, it would then stop the receiving of > inbound mail until MailScanner had processed the queue down to some > minimum, say 100 messages, before it would start back the receiving of > mail. That way the secondary mail gateway would start taking on some of > the load and we could avoid some of the message delays that we get because > of the backlog. > > Our primary and secondary mail gateways are fairly heavy duty boxes, Server > class with dual hyper-threaded processors and lots of memory so it is not > that the boxes are underpowered it's just that the secondary box is being > under utilized. > > Any thoughts or suggestions would be welcome. If there is a better way to > handle this I would be interested to know. > > Thanks, > > AP > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Thu Apr 21 20:05:08 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve Campbell wrote: >AP, > >If you're concerned about an idle gateway, and these are your DNS MX boxes, >I think (?) you can set up your MX records to be equal priority with a short >TTL, thus creating a round-robin DNS. > > They wouldn't need a short TTL just the same priority. Most decent MTAs will use alternate MXs when there are two (Or more) MXs listed with the same priority. Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Apr 21 23:25:58 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Drew Marshall wrote: > Steve Campbell wrote: > >> AP, >> >> If you're concerned about an idle gateway, and these are your DNS MX >> boxes, >> I think (?) you can set up your MX records to be equal priority with a >> short >> TTL, thus creating a round-robin DNS. >> >> > They wouldn't need a short TTL just the same priority. Most decent MTAs > will use alternate MXs when there are two (Or more) MXs listed with the > same priority. I think he meant 'short TTL' so that if one server has a very long outgoing queue, they can change the priority in favour of the other server. Ugo ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From taz at TAZ-MANIA.COM Thu Apr 21 11:53:50 2005 From: taz at TAZ-MANIA.COM (Dennis Willson) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] How about setting up IPTABLES and then blocking port 25 inbound on the mail server itself? When you want to block mail just start IPTables and when you want to receive mail just stop IPTables. Just a thought... Steve Campbell wrote: AP, If you're concerned about an idle gateway, and these are your DNS MX boxes, I think (?) you can set up your MX records to be equal priority with a short TTL, thus creating a round-robin DNS. Of course, this won't help if this attack is rapid and short lived, but it may delegate some of the mail to the secondary alleviating some of the primary load. I could be wrong here. Please let the list correct me if so. Steve Campbell campbell@cnpapers.com Charleston Newspapers ----- Original Message ----- From: "AP" To: Sent: Thursday, April 21, 2005 10:52 AM Subject: Stop inbound Hey Guys, Is there a way that I can shutdown the reception of mail to the inbound queue while still allowing MailScanner to process what's currently in the inbound queue and still allow the delivery of mail in the post-processing queue? I know that I could turn off port 25 on the Firewall to the specific mail gateway but I would like to do this on the Mail Gateway itself. Here's my reason. We sometimes early in the mornings (3-4am) get directed SPAM attacks that loads up our primary mail gateway. Our inbound queues can get quite large and the primary mail gateway will continue receiving the mail without regard to how large the inbound queue is getting. We can sometimes get 3000-5000 messages in the inbound queue while our secondary mail gateway is practically idle. I was thinking that I could write a mailqin monitoring script that would poll the queue every 5 minutes and if it has reached some kind of threshold, say 500-1000 messages, it would then stop the receiving of inbound mail until MailScanner had processed the queue down to some minimum, say 100 messages, before it would start back the receiving of mail. That way the secondary mail gateway would start taking on some of the load and we could avoid some of the message delays that we get because of the backlog. Our primary and secondary mail gateways are fairly heavy duty boxes, Server class with dual hyper-threaded processors and lots of memory so it is not that the boxes are underpowered it's just that the secondary box is being under utilized. Any thoughts or suggestions would be welcome. If there is a better way to handle this I would be interested to know. Thanks, AP ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- ________________________________________________________________________________ [IMAGE]Dennis Willson taz@taz-mania.com taz@scubatech.org www.taz-mania.com Ham: KA6LSW GMRS: WPSJ953 SCUBA: Rescue, Wreck, Night, EANx, Nitrox Blender, UW Photographer, Equip, Altitude Life should not be a journey to the grave with the intention of arriving safely in a nice looking and well preserved body, but rather to skid in broadside, thoroughly used up, totally worn out, and loudly proclaiming, "WOW! WHAT A RIDE!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2.2, Image/GIF 866bytes. ] [ Unable to print this part. ] From mailscanner-list at OKLA.COM Fri Apr 22 02:59:08 2005 From: mailscanner-list at OKLA.COM (Tracy Greggs) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I am going to build a new server for a client of mine and am interested in a dual Opteron with FC3 in 64bit mode, with sendmail and the works. Anyone running something along these lines that could let me know how it's working out for them, particularly if there are any 64bit problems, I would appreciate it. Thanks, Tracy Greggs -- Oklahoma Network Consulting has scanned this message for viruses and dangerous content with MailScanner, and with commercial virus scanners McAfee and F-PROT and is believed to be uninfected. -- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Apr 22 03:03:55 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tracy Greggs wrote: > I am going to build a new server for a client of mine and am interested > in a dual Opteron with FC3 in 64bit mode, with sendmail and the works. > Anyone running something along these lines that could let me know how > it's working out for them, particularly if there are any 64bit problems, > I would appreciate it. > > Thanks, Have you considered a RHEL clone? It would be more appropriate for a production server. I know CentOS has a 64-bit version. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-list at OKLA.COM Fri Apr 22 03:34:35 2005 From: mailscanner-list at OKLA.COM (Tracy Greggs) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I really want to run ColdfusionMX 6.1 on the same server. I know it will run on FC3 in 32bit mode with the 64bit kernel. Currently I am unable to find anyone that has it running on RHEL or a clone. All my googling tends to make me want to run FC3 for this reason. ----- Original Message ----- From: "Ugo Bellavance" To: Sent: Thursday, April 21, 2005 9:03 PM Subject: Re: OT New server > Tracy Greggs wrote: >> I am going to build a new server for a client of mine and am interested >> in a dual Opteron with FC3 in 64bit mode, with sendmail and the works. >> Anyone running something along these lines that could let me know how >> it's working out for them, particularly if there are any 64bit problems, >> I would appreciate it. >> >> Thanks, > > Have you considered a RHEL clone? It would be more appropriate for a > production server. I know CentOS has a 64-bit version. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Oklahoma Network Consulting has scanned this > message for viruses and dangerous content with > MailScanner, and commercial virus scanners McAfee > and F-Prot and is believed to be clean. > --- -- Oklahoma Network Consulting has scanned this message for viruses and dangerous content with MailScanner, and commercial virus scanners McAfee and F-Prot and is believed to be clean. --- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at TRADOC.FR Fri Apr 22 07:17:37 2005 From: john at TRADOC.FR (John Wilcock) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Lee wrote: > > The init.d script can be given > > start > > stop > > restart > > reload > > startin <--- just start the incoming MTA > > startout <--- just start the outgoing MTA > > status > > Julian: Might it be worth adding a "stopin" and "stopout"? This would > complete the symmetry of the above list, and also allow the original > enquirer ("AP") to have consistency in how he would stop and start the > inbound process, i.e. a consistent pair "service MailScanner stopin" and > "service MailScanner startin". (Naturally, some implementation > rationalisation could be done so that "stop" would be (re)written to use > "stopin" and "stopout"; likewise for the "start*" family.) For that matter, there are also times when it can be useful to stop MS but leave the MTA running, or start MS without starting the incoming MTA, or... So as well as stopin and stopout, for true completeness we need startMS and stopMS. John. -- -- Over 2500 webcams from ski resorts around the world - www.snoweye.com -- Translate your technical documents and web pages - www.tradoc.fr ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 07:58:59 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Guys Where would one look to check why the clamav updater has failed? I get the message in my maillog Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 08:03:05 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: unable to write pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi , Just restarted my mailscanner and saw this on the logs unable to write pid to /var/run/sendmail.pid: file in use by another process Anything I should look for? Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 08:06:51 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: unable to write pid Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Don't worry, Just had a look for the pid file and it was not there created one and now the error is gone Sorry to trouble Lance Lance Haig wrote: > Hi , > > Just restarted my mailscanner and saw this on the logs > > unable to write pid to /var/run/sendmail.pid: file in use by another > process > > Anything I should look for? > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From luca.palazzo at NCE-ICT.IT Fri Apr 22 08:07:32 2005 From: luca.palazzo at NCE-ICT.IT (Luca Palazzo) Date: Thu Jan 12 21:29:22 2006 Subject: SURBL error Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hiu, i was trying to change the score of bayes in spam.assassin.prefs and loom for error in the output of "spamassassin --lint -p /etc/MailScanner/spam.assassin.prefs.conf" i've found thes errors : config: SpamAssassin failed to parse line, skipping: urirhssub URIBL_JP_SURBL multi.surbl.org. A 64 and debug: no method found for eval test check_uridnsbl Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: (Can't locate object method "check_uridnsbl" via package "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/site_perl /5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line 2312. ) I've looked around but i did not find any solution? Mailscanner is 4.40.11 (installed from tgz) and SA is 3.0.2 (installed via CPAN). Any idea? Thanks Luca ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 08:21:02 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: Loads of questions from me today Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi guys, The local machine is trying to send a message to the postmaster in the maillog I see that 127.0.0.1 connection refused shows up. How do I allow Mailscanner to send the postmaster email Thanks Lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 22 08:27:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: Loads of questions from me today Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What MTA? If sendmail, then check DaemonPortOptions (I think that's right) as it may not be listening on 127.0.0.1. Lance Haig wrote: > Hi guys, > > The local machine is trying to send a message to the postmaster in the > maillog I see that 127.0.0.1 connection refused shows up. > > How do I allow Mailscanner to send the postmaster email > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Apr 22 08:30:16 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Hi Guys > > Where would one look to check why the clamav updater has failed? > > I get the message in my maillog What's the invisible font here? > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! The actual answer to your problem lies here: http://www.catb.org/%7Eesr/faqs/smart-questions.html OR Try google.com's feature "I'm feeling lucky". OR You could also try checking the maillog or the logs in /var/log/clamav/ (if you use the rpm version) for the error and google for it.. finally if you've tried everything (that includes rtfm twice, at the least) and it still fails you could ask here again with some relevant error message. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 08:33:16 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: Loads of questions from me today Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Julian, Sorry it is Sendmail I will check the DaemonPortOptions Lance Julian Field wrote: > What MTA? > > If sendmail, then check DaemonPortOptions (I think that's right) as it > may not be listening on 127.0.0.1. > > Lance Haig wrote: > >> Hi guys, >> >> The local machine is trying to send a message to the postmaster in the >> maillog I see that 127.0.0.1 connection refused shows up. >> >> How do I allow Mailscanner to send the postmaster email >> >> Thanks >> >> Lance >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 08:43:11 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: Loads of questions from me today Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, This is the current setting DaemonPortOptions=Name=NoMTA, Addr=127.0.0.1, M=E Are they right? Lance Lance Haig wrote: > Hi Julian, > > Sorry it is Sendmail > > I will check the DaemonPortOptions > > Lance > > Julian Field wrote: > >> What MTA? >> >> If sendmail, then check DaemonPortOptions (I think that's right) as it >> may not be listening on 127.0.0.1. >> >> Lance Haig wrote: >> >>> Hi guys, >>> >>> The local machine is trying to send a message to the postmaster in the >>> maillog I see that 127.0.0.1 connection refused shows up. >>> >>> How do I allow Mailscanner to send the postmaster email >>> >>> Thanks >>> >>> Lance >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 22 08:45:27 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal, Sorry forgot to paste :-) This is what shows up in the log ClamAV-autoupdate[6312]: ClamAV updater failed Lance Dhawal Doshy wrote: > Lance Haig wrote: > >> Hi Guys >> >> Where would one look to check why the clamav updater has failed? >> >> I get the message in my maillog > > What's the invisible font here? > >> >> Lance >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > The actual answer to your problem lies here: > http://www.catb.org/%7Eesr/faqs/smart-questions.html > > OR > > Try google.com's feature "I'm feeling lucky". > > OR > > You could also try checking the maillog or the logs in /var/log/clamav/ > (if you use the rpm version) for the error and google for it.. finally > if you've tried everything (that includes rtfm twice, at the least) and > it still fails you could ask here again with some relevant error message. > > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Fri Apr 22 08:46:38 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] John Wilcock said: > David Lee wrote: >> > The init.d script can be given >> > start >> > stop >> > restart >> > reload >> > startin <--- just start the incoming MTA >> > startout <--- just start the outgoing MTA >> > status >> >> Julian: Might it be worth adding a "stopin" and "stopout"? This would >> complete the symmetry of the above list, and also allow the original >> enquirer ("AP") to have consistency in how he would stop and start the >> inbound process, i.e. a consistent pair "service MailScanner stopin" and >> "service MailScanner startin". (Naturally, some implementation >> rationalisation could be done so that "stop" would be (re)written to use >> "stopin" and "stopout"; likewise for the "start*" family.) > > For that matter, there are also times when it can be useful to stop MS > but leave the MTA running, or start MS without starting the incoming > MTA, or... > > So as well as stopin and stopout, for true completeness we need startMS > and stopMS. Or indeed as I have, use seperate scripts. One to start the MTA and one to start MailScanner. (And fortunately a default in FreeBSD, so saves me the job!). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. www.themarshalls.co.uk/policy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 22 08:52:23 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:22 2006 Subject: Microsoft's own email filtering Message-ID: A thought about all this occurred to me last night. In the doc and ppt it mentions that this was trialled first @ hotmail. Now about 18months ago hotmail made a big thing about how they'd now moved over to Brightmail for scanning. I wonder why hotmail moved and M$ corporate stuck with their own thing .... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Michael St. Laurent wrote: >>>Will they ever be rich enough to buy a clue? >> >>Unlikely > > > They bought one but were unable to get it to install. > > -- > Michael St. Laurent > Hartwell Corporation > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 22 08:56:07 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:22 2006 Subject: SURBL error Message-ID: Luca check you have the URIRBL plugin installed in init.pre (usually located in /etc/mail/spamassassin). # URIDNSBL - look up URLs found in the message against several DNS # blocklists. # loadplugin Mail::SpamAssassin::Plugin::URIDNSBL -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Luca Palazzo wrote: > Hiu, > i was trying to change the score of bayes in spam.assassin.prefs and > loom for error in the output of "spamassassin --lint -p > /etc/MailScanner/spam.assassin.prefs.conf" > i've found thes errors : > > > config: SpamAssassin failed to parse line, skipping: urirhssub > URIBL_JP_SURBL multi.surbl.org. A 64 > > and > > debug: no method found for eval test check_uridnsbl > Failed to run URIBL_JP_SURBL SpamAssassin test, skipping: > (Can't locate object method "check_uridnsbl" via package > "Mail::SpamAssassin::PerMsgStatus" at /usr/lib/perl5/site_perl > /5.8.0/Mail/SpamAssassin/PerMsgStatus.pm line 2312. > ) > > I've looked around but i did not find any solution? > > Mailscanner is 4.40.11 (installed from tgz) and SA is 3.0.2 (installed > via CPAN). > > Any idea? > > Thanks > > Luca > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 22 09:32:52 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Lance Haig > Sent: den 22 april 2005 09:45 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ClamAv updater failed > > > Dhawal, > > Sorry forgot to paste :-) > > This is what shows up in the log > > ClamAV-autoupdate[6312]: ClamAV updater failed Does "freshclam -v" show any problems? Do you have any errors in /tmp/ClamAV.update.log (or wherever...)? -- Glenn > Lance > > Dhawal Doshy wrote: > > > Lance Haig wrote: > > > >> Hi Guys > >> > >> Where would one look to check why the clamav updater has failed? > >> > >> I get the message in my maillog > > > > What's the invisible font here? > > > >> > >> Lance > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > > > > > > The actual answer to your problem lies here: > > http://www.catb.org/%7Eesr/faqs/smart-questions.html > > > > OR > > > > Try google.com's feature "I'm feeling lucky". > > > > OR > > > > You could also try checking the maillog or the logs in > /var/log/clamav/ > > (if you use the rpm version) for the error and google for > it.. finally > > if you've tried everything (that includes rtfm twice, at > the least) and > > it still fails you could ask here again with some relevant > error message. > > > > - dhawal > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Q.G.Campbell at NEWCASTLE.AC.UK Fri Apr 22 09:41:39 2005 From: Q.G.Campbell at NEWCASTLE.AC.UK (Quentin Campbell) Date: Thu Jan 12 21:29:22 2006 Subject: BETA 4.41.1-2 running OK Message-ID: Julian Installed BETA 4.41.1-2 on one of our production gateways yesterday lunch time and it is running with a full mail load without evident problems. Our MailScanner configuration is a fairly sophisticated and demanding one. Quentin --- PHONE: +44 191 222 8209 Information Systems and Services (ISS), University of Newcastle, Newcastle upon Tyne, FAX: +44 191 222 8765 United Kingdom, NE1 7RU. ------------------------------------------------------------------------ "Any opinion expressed above is mine. The University can get its own." ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Apr 22 09:59:10 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steen, Glenn wrote: >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Lance Haig >>Sent: den 22 april 2005 09:45 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: ClamAv updater failed >> >> >>Dhawal, >> >>Sorry forgot to paste :-) >> >>This is what shows up in the log >> >>ClamAV-autoupdate[6312]: ClamAV updater failed > > Does "freshclam -v" show any problems? Do you have any errors in > /tmp/ClamAV.update.log (or wherever...)? > > -- Glenn > > If freshclam is working fine, the next thing to check is this parameter in MailScanner.conf.. Monitors for ClamAV Updates = /var/clamav/*.cvd (my value) Monitors for ClamAV Updates = /usr/local/share/clamav/*.cvd (default value) Also clamav-autoupdate (in my case) requires the presence of /usr/local/bin/freshclam (default rpm path being /usr/bin/freshclam), so a softlink should do the trick iff (if and only if) required. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 22 10:04:15 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > Steen, Glenn wrote: > >>> -----Original Message----- >>> From: MailScanner mailing list >>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Lance Haig >>> Sent: den 22 april 2005 09:45 >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Re: ClamAv updater failed >>> >>> >>> Dhawal, >>> >>> Sorry forgot to paste :-) >>> >>> This is what shows up in the log >>> >>> ClamAV-autoupdate[6312]: ClamAV updater failed >> >> >> Does "freshclam -v" show any problems? Do you have any errors in >> /tmp/ClamAV.update.log (or wherever...)? >> >> -- Glenn >> >> > > If freshclam is working fine, the next thing to check is this parameter > in MailScanner.conf.. > > Monitors for ClamAV Updates = /var/clamav/*.cvd (my value) > Monitors for ClamAV Updates = /usr/local/share/clamav/*.cvd (default > value) > > Also clamav-autoupdate (in my case) requires the presence of > /usr/local/bin/freshclam (default rpm path being /usr/bin/freshclam), so > a softlink should do the trick iff (if and only if) required. You must always put the pathname (indicated at the end of the relevant line in virus.scanners.conf) on the end of the command-line for all the updaters. This is essential as it tells the updater where the virus scanner is actually installed. Don't run them without this unless you want really random results. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Apr 22 10:10:20 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > > > You must always put the pathname (indicated at the end of the relevant > line in virus.scanners.conf) on the end of the command-line for all the > updaters. This is essential as it tells the updater where the virus > scanner is actually installed. > > Don't run them without this unless you want really random results. > Didn't know this one.. i kept wondering why a change to $PackageDir in clamav-autoupdate didn't work (and never bothered to ask) thanks, - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 22 10:28:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > Julian Field wrote: > >> >> >> You must always put the pathname (indicated at the end of the relevant >> line in virus.scanners.conf) on the end of the command-line for all the >> updaters. This is essential as it tells the updater where the virus >> scanner is actually installed. >> >> Don't run them without this unless you want really random results. >> > > Didn't know this one.. i kept wondering why a change to $PackageDir in > clamav-autoupdate didn't work (and never bothered to ask) > The whole idea is that you normally run update_virus_scanners to do them all, configuring them in virus.scanners.conf. Please don't tweak my code! (Most of) it is written for a reason :-) -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Apr 22 10:34:39 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:22 2006 Subject: phishing net query.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello All, Does the phishing net have the necessary logic to understand that sub.domain.tld and www.domain.tld mostly have the same nameserver maintainers, so something like the below examples ought to be considered differently. MailScanner has detected a possible fraud attempt from "info.cafepress.com" claiming to be www.cafepress.com. MailScanner has detected a possible fraud attempt from "see.sun.com" claiming to be www.sun.com Of course phishing.safe.sites.conf will take care of this, but can it be done at the MS level, or am i missing it completely? If only my coding skills were as good as my complaining skills. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From stebaume2004 at YAHOO.FR Fri Apr 22 10:53:09 2005 From: stebaume2004 at YAHOO.FR (ste baume) Date: Thu Jan 12 21:29:22 2006 Subject: Stop inbound Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I am currently facing the same problem with my primary mail gateway... As describe before in the thread "Mailscanner treats the mails very slowly", the primary mail received a huge number of spam and start to hang... FYI, the configuration is: - 1 Pentium 4 Xeon 2.4 Ghz HT - 1.5 Gb RAM - 36 Gb HD SCSI U320 (Raid 1) - Postfix 2.2.1 - MS 4.40.11-1 - SA 3.0.2 - Kaspersky 5.0.5 - Bind 9.X In a first time I put a second MX (a clone of the first system) in round-robin. It works perfectly but at the next attack I got the same effect, the two systems hang. Of course the processing time was lowered but remain important. The issue come from SA because if I disable it, the MXs process the whole queue (about 10000 mails) in 20 min instead of 4 hours... I try to disable call to RBL et SURBL in SA but the problem remains the same. I there some known bug in SA??? I search their bugzilla but there is so many things... So putting a second primary mail server in load sharing reduce the time needed to process mail but it seens we received more mail: the more you put, the more you get!!! If someone got another idea.... Stephane __________________________________________________________________ Découvrez le nouveau Yahoo! Mail : 250 Mo d'espace de stockage pour vos mails ! Créez votre Yahoo! Mail sur http://fr.mail.yahoo.com/ ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 22 10:55:17 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: phishing net query.. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dhawal Doshy wrote: > Hello All, > > Does the phishing net have the necessary logic to understand that > sub.domain.tld and www.domain.tld mostly have the same nameserver > maintainers, so something like the below examples ought to be considered > differently. > > MailScanner has detected a possible fraud attempt from > "info.cafepress.com" claiming to be www.cafepress.com. > > MailScanner has detected a possible fraud attempt from "see.sun.com" > claiming to be www.sun.com No, and it can't. How many levels of domain should you consider, for starters? You can put wildcards in phishing.safe.sites.conf already, so you could choose to add *.sun.com or *.cafepress.com if you want to. > > Of course phishing.safe.sites.conf will take care of this, but can it be > done at the MS level, or am i missing it completely? If only my coding > skills were as good as my complaining skills. > > - dhawal > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From waldner at WALDNER.PRIV.AT Fri Apr 22 11:53:43 2005 From: waldner at WALDNER.PRIV.AT (Robert Waldner) Date: Thu Jan 12 21:29:22 2006 Subject: Microsoft's own email filtering Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Thu, 21 Apr 2005 10:21:22 PDT, "Michael St. Laurent" writes: >>> Will they ever be rich enough to buy a clue? >> Unlikely >They bought one but were unable to get it to install. You mean it didn't come with an "install wizard"? cheers,. &rw -- -- "Do not meddle in the affairs of cats, for they -- are subtle and will piss on your computer." -- - Bruce Graham ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/PGP-SIGNATURE 196bytes. ] [ Unable to print this part. ] From lhaig at HAIGMAIL.COM Fri Apr 22 12:16:53 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Glenn, This command showed an error writing to the freshclam.log file I changed the owner and rights and now it can log I will see what happens now Thanks Lance Steen, Glenn wrote: -----Original Message----- From: MailScanner mailing list ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 22 13:29:26 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:22 2006 Subject: Microsoft's own email filtering Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Robert Waldner > Sent: den 22 april 2005 12:54 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Microsoft's own email filtering > > > > On Thu, 21 Apr 2005 10:21:22 PDT, "Michael St. Laurent" writes: > >>> Will they ever be rich enough to buy a clue? > > >> Unlikely > > >They bought one but were unable to get it to install. > > You mean it didn't come with an "install wizard"? Sadly the Wizard was killed during clue extraction (performed to be able to spread said clue in PMs all over the organization:-):-). ... Or so the rumour says... -- Glenn > cheers,. > &rw > -- > -- "Do not meddle in the affairs of cats, for they > -- are subtle and will piss on your computer." > -- - Bruce Graham > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 22 14:08:39 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:22 2006 Subject: BitDefender and Phishing... Message-ID: Is it just me, or has BD started catching phishes too? I've seen a lot of "Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." lately. Seems to be about on par with McAfee. Any one with a decent load (more than the approx 2000 emails/day I get) who has some more solid stats? Change happened a few days back. -- Glenn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Fri Apr 22 13:56:20 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tracy Greggs wrote: > I really want to run ColdfusionMX 6.1 on the same server. I know it will > run on FC3 in 32bit mode with the 64bit kernel. Currently I am unable to > find anyone that has it running on RHEL or a clone. All my googling tends > to make me want to run FC3 for this reason. Maybe look for RHEL 4 or a clone? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From roger at RUDNICK.COM.BR Fri Apr 22 14:26:29 2005 From: roger at RUDNICK.COM.BR (Roger Jochem) Date: Thu Jan 12 21:29:22 2006 Subject: BitDefender and Phishing... Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm seeing it for two weeks or more too... ----- Original Message ----- From: "Steen, Glenn" To: Sent: Friday, April 22, 2005 10:08 AM Subject: BitDefender and Phishing... > Is it just me, or has BD started catching phishes too? > I've seen a lot of > "Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." > lately. Seems to be about on par with McAfee. > > Any one with a decent load (more than the approx 2000 emails/day > I get) who has some more solid stats? Change happened a few days > back. > > -- Glenn > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Fri Apr 22 14:37:06 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:22 2006 Subject: BitDefender and Phishing... Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] 887 since 6th April.. - dhawal Roger Jochem wrote: > I'm seeing it for two weeks or more too... > > ----- Original Message ----- > From: "Steen, Glenn" > To: > Sent: Friday, April 22, 2005 10:08 AM > Subject: BitDefender and Phishing... > > > >>Is it just me, or has BD started catching phishes too? >>I've seen a lot of >>"Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." >>lately. Seems to be about on par with McAfee. >> >>Any one with a decent load (more than the approx 2000 emails/day >>I get) who has some more solid stats? Change happened a few days >>back. >> >>-- Glenn ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 22 14:41:44 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:22 2006 Subject: BitDefender and Phishing... Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > Sent: den 22 april 2005 15:37 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: BitDefender and Phishing... > > > 887 since 6th April.. "A few days" is a relative term:-). Thanks Dahwal (& Roger)... Do you have similar stats for clamav and/or mcafee during the same period? -- Glenn > - dhawal > > Roger Jochem wrote: > > I'm seeing it for two weeks or more too... > > > > ----- Original Message ----- > > From: "Steen, Glenn" > > To: > > Sent: Friday, April 22, 2005 10:08 AM > > Subject: BitDefender and Phishing... > > > > > > > >>Is it just me, or has BD started catching phishes too? > >>I've seen a lot of > >>"Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." > >>lately. Seems to be about on par with McAfee. > >> > >>Any one with a decent load (more than the approx 2000 emails/day > >>I get) who has some more solid stats? Change happened a few days > >>back. > >> > >>-- Glenn > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 22 15:02:16 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:22 2006 Subject: BitDefender and Phishing... Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn > Sent: den 22 april 2005 15:42 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: BitDefender and Phishing... > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > > Sent: den 22 april 2005 15:37 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: BitDefender and Phishing... > > > > > > 887 since 6th April.. > "A few days" is a relative term:-). > Thanks Dahwal (& Roger)... > Do you have similar stats for clamav and/or mcafee during the > same period? (Replying to myself... How quaint:) I saw the first "hit" on a Regions bank phish on the 15:th, and have received a whopping 9 hits since then (both McAfee and BD), while I've had 11 hits with clamav (2 charterone frauds that clamav is the only one to find). Due to me cavalierly rejecting anything HELOing with my IP adddress or domain name, I don't see that much viruses anymore:-), hence my question... Cheers -- Glenn (who still has a PHB that won't let him use MS phishing net) > > -- Glenn > > > - dhawal > > > > Roger Jochem wrote: > > > I'm seeing it for two weeks or more too... > > > > > > ----- Original Message ----- > > > From: "Steen, Glenn" > > > To: > > > Sent: Friday, April 22, 2005 10:08 AM > > > Subject: BitDefender and Phishing... > > > > > > > > > > > >>Is it just me, or has BD started catching phishes too? > > >>I've seen a lot of > > >>"Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." > > >>lately. Seems to be about on par with McAfee. > > >> > > >>Any one with a decent load (more than the approx 2000 emails/day > > >>I get) who has some more solid stats? Change happened a few days > > >>back. > > >> > > >>-- Glenn > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Fri Apr 22 15:38:03 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: At 08:56 AM 4/22/2005, you wrote: >Tracy Greggs wrote: >>I really want to run ColdfusionMX 6.1 on the same server. I know it will >>run on FC3 in 32bit mode with the 64bit kernel. Currently I am unable to >>find anyone that has it running on RHEL or a clone. All my googling tends >>to make me want to run FC3 for this reason. > >Maybe look for RHEL 4 or a clone? CentOS 4 is RHEL 4.0 and 64-bit. Look into http://www.centos.org -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-list at OKLA.COM Fri Apr 22 20:58:15 2005 From: mailscanner-list at OKLA.COM (Tracy Greggs) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] CFMX won't run on RHEL or CentOS. Tracy ----- Original Message ----- From: "DNSAdmin" To: Sent: Friday, April 22, 2005 9:38 AM Subject: Re: OT New server > At 08:56 AM 4/22/2005, you wrote: >>Tracy Greggs wrote: >>>I really want to run ColdfusionMX 6.1 on the same server. I know it will >>>run on FC3 in 32bit mode with the 64bit kernel. Currently I am unable to >>>find anyone that has it running on RHEL or a clone. All my googling >>>tends >>>to make me want to run FC3 for this reason. >> >>Maybe look for RHEL 4 or a clone? > > CentOS 4 is RHEL 4.0 and 64-bit. Look into http://www.centos.org > > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > http://www.sng.ecs.soton.ac.uk/mailscanner/ > Configuration by Glenn Parsons dnsadmin-at-1bigthink.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Oklahoma Network Consulting has scanned this > message for viruses and dangerous content with > MailScanner, and commercial virus scanners McAfee > and F-Prot and is believed to be clean. > --- -- Oklahoma Network Consulting has scanned this message for viruses and dangerous content with MailScanner, and commercial virus scanners McAfee and F-Prot and is believed to be clean. --- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Fri Apr 22 22:24:01 2005 From: michele at BLACKNIGHT.IE (Blacknight) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Tracy Greggs wrote: > CFMX won't run on RHEL or CentOS. > Yes it will! One of our clients is running it ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dean at SAHRA.ARIZONA.EDU Sat Apr 23 01:18:12 2005 From: dean at SAHRA.ARIZONA.EDU (Dean Jones) Date: Thu Jan 12 21:29:22 2006 Subject: whitelist processing question. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hi, I have searched a bit for this answer but no luck.. What order do the spam.whitelist rules get processed? say i want to NOT whitelist a certain ip address from my range (secondary MX). but i DO want to whitelist all of the other IP addresses.. Will this work? From: 192.168.1.10 no From: 192.168.1. yes does it match the first rule and exit? if so i have something misconfigured cause even my secondary is getting whitelisted and spammers like to send through it. but i'd like it there for redundancy in case my primary breaks. thanks. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-list at OKLA.COM Sat Apr 23 03:33:22 2005 From: mailscanner-list at OKLA.COM (Tracy Greggs) Date: Thu Jan 12 21:29:22 2006 Subject: OT New server Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It is not officially supported, further investigation suggests that I probably can make it work on RHEL4 with some tweaking. Looks like I will test drive this on CentOS 4. Thanks for the input. Tracy ----- Original Message ----- From: "Blacknight" To: Sent: Friday, April 22, 2005 4:24 PM Subject: Re: OT New server > Tracy Greggs wrote: >> CFMX won't run on RHEL or CentOS. >> > Yes it will! > One of our clients is running it > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Oklahoma Network Consulting has scanned this > message for viruses and dangerous content with > MailScanner, and commercial virus scanners McAfee > and F-Prot and is believed to be clean. > --- -- Oklahoma Network Consulting has scanned this message for viruses and dangerous content with MailScanner, and commercial virus scanners McAfee and F-Prot and is believed to be clean. --- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Mike.Young at ATOSORIGIN.COM Sat Apr 23 04:33:15 2005 From: Mike.Young at ATOSORIGIN.COM (Young, Mike) Date: Thu Jan 12 21:29:22 2006 Subject: Installed MailScanner on Solaris 8 - Postfix doesn't start with M ailScanner Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello Everyone, I have installed MailScanner on a Solaris 8 system with postfix, SpamAssassin, and Sophos Antivirus. When I start MailScanner, in the logs I see SpamAssassin started, but postfix doesn't start. There is no process listening on port 25. I can start postfix by itself. I have made the changes recommended at http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml, but it makes no difference (yet). I know that page is for Linux, but it's the closest I've come to a MailScanner/postfix howto. Here are settings from MailScanner.conf: Run As User = postfix Run As Group = postfix Incoming Queue Dir = /var/spool/postfix/hold Outgoing Queue Dir = /var/spool/postfix/incoming Incoming Work Dir = /var/spool/MailScanner/incoming Quarantine Dir = /var/spool/MailScanner/quarantine MTA = postfix Sendmail = /usr/sbin/postfix Sendmail2 = /usr/sbin/postfix Anyone have experience with this? Once I get postfix starting with MailScanner, I can move on to the A/V configuration. Thanks, Mike. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Apr 23 09:43:55 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: rules du jour Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I have seen this error on my cron daily e-mail that the post master recieves /etc/cron.daily/rules_du_jour is either not there or is 0 bytes My Rules dujour is in the following path /etc/mail/spamassassin/RulesDuJour where would I change the path setting that runs in the cron job. Mailscanner.conf? Latest Mailscanner on SUSE 9.2pro Thanks lance ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Sat Apr 23 10:22:22 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:22 2006 Subject: Loads of questions from me today Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I found a solution to this problem not sure if it is ok to do this though I changed the following line in the sendmail.cf file # SMTP client options O ClientPortOptions=Family=inet, Address=127.0.0.1 Lance Lance Haig wrote: > Hi guys, > > The local machine is trying to send a message to the postmaster in the > maillog I see that 127.0.0.1 connection refused shows up. > > How do I allow Mailscanner to send the postmaster email > > Thanks > > Lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From patrickchan at GOODMARK.COM.CN Sat Apr 23 10:09:46 2005 From: patrickchan at GOODMARK.COM.CN (Patrick Chan) Date: Thu Jan 12 21:29:22 2006 Subject: Install Problem Message-ID: [ The following text is in the "gb2312" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi all, I am using Redhat 9.0. I install MailScanner 4.31.6 but I can't install by using the script install.sh it seems that the package perl-MIME-tools cannot be installed Can anyone give me a help? Below is the error after running install.sh: ......(skipped) Failed 1/10 test scripts, 90.00% okay. 3/223 subtests failed, 98.65% okay. make: *** [test_dynamic] Error 29 error: Bad exit status from /var/tmp/rpm-tmp.84572 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.84572 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-MIME-tools-5.411-pl4.3.noarch.rpm. Maybe it did not build correctly? ......(skipped) error: Failed dependencies: perl-MIME-tools >= 5.411 is needed by mailscanner-4.31.6-1 From MailScanner at ecs.soton.ac.uk Sat Apr 23 11:22:26 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: whitelist processing question. Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dean Jones wrote: > hi, > > I have searched a bit for this answer but no luck.. > What order do the spam.whitelist rules get processed? First to last, just like a firewall rule list. > say i want to NOT whitelist a certain ip address from my range > (secondary MX). > but i DO want to whitelist all of the other IP addresses.. > Will this work? > > From: 192.168.1.10 no > From: 192.168.1. yes Should do, yes. > > does it match the first rule and exit? Yes. > if so i have something misconfigured cause even my secondary is getting > whitelisted and spammers like to send through it. > but i'd like it there for redundancy in case my primary breaks. Add a default rule as well. Doesn't matter where the default rule goes, it is used when none of the other rules match. > > > thanks. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 23 11:26:34 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: Install Problem Message-ID: [ The following text is in the "GB2312" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Shame you missed out the important part where it told us what tests failed... Patrick Chan wrote: > Hi all, > I am using Redhat 9.0. I install MailScanner 4.31.6 > but I can't install by using the script install.sh > it seems that the package perl-MIME-tools cannot be installed > Can anyone give me a help? > Below is the error after running install.sh: > ......(skipped) > Failed 1/10 test scripts, 90.00% okay. 3/223 subtests failed, 98.65% okay. > make: *** [test_dynamic] Error 29 > error: Bad exit status from /var/tmp/rpm-tmp.84572 (%build) > RPM build errors: > Bad exit status from /var/tmp/rpm-tmp.84572 (%build) > Missing file > /usr/src/redhat/RPMS/noarch/perl-MIME-tools-5.411-pl4.3.noarch.rpm. > Maybe it did not build correctly? > ......(skipped) > error: Failed dependencies: > perl-MIME-tools >= 5.411 is needed by mailscanner-4.31.6-1 -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 23 11:25:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: rules du jour Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Cron will run the script in cron.daily, which needs to point to your RulesDuJour script. It is not connected with MailScanner.conf at all. Lance Haig wrote: > Hi, > > I have seen this error on my cron daily e-mail that the post master > recieves > > /etc/cron.daily/rules_du_jour is either not there or is 0 bytes > > My Rules dujour is in the following path > /etc/mail/spamassassin/RulesDuJour > > where would I change the path setting that runs in the cron job. > Mailscanner.conf? > > Latest Mailscanner on SUSE 9.2pro > > Thanks > > lance > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 23 11:24:42 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:22 2006 Subject: Installed MailScanner on Solaris 8 - Postfix doesn't start with M ailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Young, Mike wrote: > Hello Everyone, > > I have installed MailScanner on a Solaris 8 system with postfix, > SpamAssassin, and Sophos Antivirus. When I start MailScanner, in the > logs I see SpamAssassin started, > There is no part of SpamAssassin to "start" that is used by MailScanner. If you mean you are starting spamd, then don't bother as you are just wasting system resources. MailScanner doesn't use spamd, it uses a more efficient method. > but postfix doesn't start. There is no process listening on port 25. > I can start postfix by itself. I have made the changes recommended at > _http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml_, > but it makes no difference (yet). I know that page is for Linux, but > it's the closest I've come to a MailScanner/postfix howto. > What does you MailScanner init.d script look like? > Here are settings from MailScanner.conf: > > Run As User = postfix > > Run As Group = postfix > > Incoming Queue Dir = /var/spool/postfix/hold > > Outgoing Queue Dir = /var/spool/postfix/incoming > > Incoming Work Dir = /var/spool/MailScanner/incoming > > Quarantine Dir = /var/spool/MailScanner/quarantine > > MTA = postfix > > Sendmail = /usr/sbin/postfix > > Sendmail2 = /usr/sbin/postfix > > Anyone have experience with this? Once I get postfix starting with > MailScanner, I can move on to the A/V configuration. > > Thanks, > > Mike. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From btaber at DIVERSECG.COM Sat Apr 23 20:17:49 2005 From: btaber at DIVERSECG.COM (Brian Taber) Date: Thu Jan 12 21:29:23 2006 Subject: postfix installation instruction addition Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Using the new mothod of interfacing MailScanner with postfix via hold queue is great, but there needs to be one addition to the instructions. With the instructions now, all email is getting scanned twice, once from header checks in smtpd service and then by header check in pickup service, so disable header checks from pickup service In master.cf: pickup fifo n - n 5 1 pickup -o receive_override_options=no_header_body_checks Also a good thing is the wakeup time of 5 (as shown above), since the normal wakeup time is 60. Brian ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Sat Apr 23 21:21:42 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:23 2006 Subject: BitDefender and Phishing... Message-ID: When you say you're rejecting anything from your IP or your domain, do you mean with an entry in /etc/mail/access or a milter? (if you're using sendmail, that is) -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn Sent: Friday, April 22, 2005 9:02 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: BitDefender and Phishing... > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn > Sent: den 22 april 2005 15:42 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: BitDefender and Phishing... > > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > > Sent: den 22 april 2005 15:37 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: BitDefender and Phishing... > > > > > > 887 since 6th April.. > "A few days" is a relative term:-). > Thanks Dahwal (& Roger)... > Do you have similar stats for clamav and/or mcafee during the same > period? (Replying to myself... How quaint:) I saw the first "hit" on a Regions bank phish on the 15:th, and have received a whopping 9 hits since then (both McAfee and BD), while I've had 11 hits with clamav (2 charterone frauds that clamav is the only one to find). Due to me cavalierly rejecting anything HELOing with my IP adddress or domain name, I don't see that much viruses anymore:-), hence my question... Cheers -- Glenn (who still has a PHB that won't let him use MS phishing net) > > -- Glenn > > > - dhawal > > > > Roger Jochem wrote: > > > I'm seeing it for two weeks or more too... > > > > > > ----- Original Message ----- > > > From: "Steen, Glenn" > > > To: > > > Sent: Friday, April 22, 2005 10:08 AM > > > Subject: BitDefender and Phishing... > > > > > > > > > > > >>Is it just me, or has BD started catching phishes too? > > >>I've seen a lot of > > >>"Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." > > >>lately. Seems to be about on par with McAfee. > > >> > > >>Any one with a decent load (more than the approx 2000 emails/day I > > >>get) who has some more solid stats? Change happened a few days > > >>back. > > >> > > >>-- Glenn > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Sun Apr 24 16:35:23 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:23 2006 Subject: BitDefender and Phishing... Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Alex Neuman > van der Hans > Sent: den 23 april 2005 22:22 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: BitDefender and Phishing... > > > When you say you're rejecting anything from your IP or your > domain, do you > mean with an entry in /etc/mail/access or a milter? (if you're using > sendmail, that is) Nope, Postfix with a fairly standard (well...:-) practice of rejecting "HELO frauds" via access restrictions like (in main.cf): smtpd_helo_restrictions = permit_mynetworks, check_helo_access hash:/etc/postfix/deny_domain_spoof ... and in deny_domain_spoof ap1.se REJECT 194.14.216.2 REJECT (there's actually more here, but those are "internal"... and those two take care of most, if not all, frauds) I used to do that in the check_sender_access (well, it actually still does), but this catches far more. "Downside" is that MS just catches less than 5 viruses a day, where it used to be up to 30... And spam is down somewhat too. So my stats "lie" a bit about how much we really get (not good PHB strategy:-). Works great for me since I don't have/never will have "roaming users". -- Glenn > > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Steen, Glenn > Sent: Friday, April 22, 2005 9:02 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: BitDefender and Phishing... > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Steen, Glenn > > Sent: den 22 april 2005 15:42 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: BitDefender and Phishing... > > > > > > > -----Original Message----- > > > From: MailScanner mailing list > > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dhawal Doshy > > > Sent: den 22 april 2005 15:37 > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: BitDefender and Phishing... > > > > > > > > > 887 since 6th April.. > > "A few days" is a relative term:-). > > Thanks Dahwal (& Roger)... > > Do you have similar stats for clamav and/or mcafee during the same > > period? > (Replying to myself... How quaint:) > I saw the first "hit" on a Regions bank phish on the 15:th, and have > received a whopping 9 hits since then (both McAfee and BD), > while I've had > 11 hits with clamav (2 charterone frauds that clamav is the > only one to > find). > Due to me cavalierly rejecting anything HELOing with my IP adddress or > domain name, I don't see that much viruses anymore:-), hence > my question... > > Cheers > -- Glenn (who still has a PHB that won't let him use MS phishing net) > > > > > -- Glenn > > > > > - dhawal > > > > > > Roger Jochem wrote: > > > > I'm seeing it for two weeks or more too... > > > > > > > > ----- Original Message ----- > > > > From: "Steen, Glenn" > > > > To: > > > > Sent: Friday, April 22, 2005 10:08 AM > > > > Subject: BitDefender and Phishing... > > > > > > > > > > > > > > > >>Is it just me, or has BD started catching phishes too? > > > >>I've seen a lot of > > > >>"Bitdefender: Found virus Trojan.Spy.HTML.Bankfraud.DQ ..." > > > >>lately. Seems to be about on par with McAfee. > > > >> > > > >>Any one with a decent load (more than the approx 2000 > emails/day I > > > >>get) who has some more solid stats? Change happened a few days > > > >>back. > > > >> > > > >>-- Glenn > > > > > > ------------------------ MailScanner list ------------------------ > > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the > > archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Sun Apr 24 18:34:53 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:23 2006 Subject: Installed MailScanner on Solaris 8 - Postfix doesn't start with M ailScanner Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 23 april 2005 12:25 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Installed MailScanner on Solaris 8 - Postfix > doesn't start with M ailScanner > > > Young, Mike wrote: > > > Hello Everyone, > > > > I have installed MailScanner on a Solaris 8 system with postfix, > > SpamAssassin, and Sophos Antivirus. When I start > MailScanner, in the > > logs I see SpamAssassin started, > > > There is no part of SpamAssassin to "start" that is used by > MailScanner. > If you mean you are starting spamd, then don't bother as you are just > wasting system resources. MailScanner doesn't use spamd, it > uses a more > efficient method. > > > but postfix doesn't start. There is no process listening > on port 25. > > I can start postfix by itself. I have made the changes > recommended at > > _http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml_, > > but it makes no difference (yet). I know that page is for > Linux, but > > it's the closest I've come to a MailScanner/postfix howto. > > > What does you MailScanner init.d script look like? > > > Here are settings from MailScanner.conf: > > > > Run As User = postfix > > > > Run As Group = postfix > > > > Incoming Queue Dir = /var/spool/postfix/hold > > > > Outgoing Queue Dir = /var/spool/postfix/incoming > > > > Incoming Work Dir = /var/spool/MailScanner/incoming > > > > Quarantine Dir = /var/spool/MailScanner/quarantine > > > > MTA = postfix > > > > Sendmail = /usr/sbin/postfix > > > > Sendmail2 = /usr/sbin/postfix Um, those two should be set to /usr(sbin/sendmail, I believe. That would be the "convenience sendmail" interface for postfix. -- Glenn > > > > Anyone have experience with this? Once I get postfix starting with > > MailScanner, I can move on to the A/V configuration. > > > > Thanks, > > > > Mike. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > *Support MailScanner development - buy the book off the website!* > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Mike.Young at ATOSORIGIN.COM Sun Apr 24 18:43:30 2005 From: Mike.Young at ATOSORIGIN.COM (Young, Mike) Date: Thu Jan 12 21:29:23 2006 Subject: Installed MailScanner on Solaris 8 - Postfix doesn't start wi th M ailScanner Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Everyone, I figured it out. Starting with "some new version or another" (don't remember which), postfix runs independently of MailScanner. However, postfix is configured so that all inbound mail goes to it's "hold" queue, where it effectively forgets about it. MailScanner picks it up from there, does "its thing", then drops it in the postfix outbound queue, where postfix happily finds and delivers it. Works like a charm. Kinda nifty, actually. Thanks for the help. Cheers, Mike. -----Original Message----- From: Steen, Glenn [mailto:Glenn.Steen@AP1.SE] Sent: Sunday, April 24, 2005 12:35 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Installed MailScanner on Solaris 8 - Postfix doesn't start with M ailScanner > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field > Sent: den 23 april 2005 12:25 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Installed MailScanner on Solaris 8 - Postfix > doesn't start with M ailScanner > > > Young, Mike wrote: > > > Hello Everyone, > > > > I have installed MailScanner on a Solaris 8 system with postfix, > > SpamAssassin, and Sophos Antivirus. When I start > MailScanner, in the > > logs I see SpamAssassin started, > > > There is no part of SpamAssassin to "start" that is used by > MailScanner. > If you mean you are starting spamd, then don't bother as you are just > wasting system resources. MailScanner doesn't use spamd, it > uses a more > efficient method. > > > but postfix doesn't start. There is no process listening > on port 25. > > I can start postfix by itself. I have made the changes > recommended at > > _http://www.sng.ecs.soton.ac.uk/mailscanner/install/postfix.shtml_, > > but it makes no difference (yet). I know that page is for > Linux, but > > it's the closest I've come to a MailScanner/postfix howto. > > > What does you MailScanner init.d script look like? > > > Here are settings from MailScanner.conf: > > > > Run As User = postfix > > > > Run As Group = postfix > > > > Incoming Queue Dir = /var/spool/postfix/hold > > > > Outgoing Queue Dir = /var/spool/postfix/incoming > > > > Incoming Work Dir = /var/spool/MailScanner/incoming > > > > Quarantine Dir = /var/spool/MailScanner/quarantine > > > > MTA = postfix > > > > Sendmail = /usr/sbin/postfix > > > > Sendmail2 = /usr/sbin/postfix Um, those two should be set to /usr(sbin/sendmail, I believe. That would be the "convenience sendmail" interface for postfix. -- Glenn > > > > Anyone have experience with this? Once I get postfix starting with > > MailScanner, I can move on to the A/V configuration. > > > > Thanks, > > > > Mike. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) > > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > *Support MailScanner development - buy the book off the website!* > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dean at MYSTERIOUSPLANET.CO.UK Sun Apr 24 23:07:31 2005 From: dean at MYSTERIOUSPLANET.CO.UK (Dean Liversidge) Date: Thu Jan 12 21:29:23 2006 Subject: Debian/mqueue.in issue Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Thurman wrote: >I have searched the mailing list, google and my old notes, I had to reload a >new debian server here and installed ver. Sarge, used the testing version of >MS (4.40.11) and SA (3.0.2) and am having MAJOR issues getting sendmail to >drop mail into the /var/spool/mqueue.in > >I set sendmail.conf with: > >DAEMON_PARMS="-bd -OPrivacyOptions=noetrn -ODeliveryMode=queueonly >-OQueueDirectory=/var/spool/mqueue.in"; > >Did a make, also did a sendmailconfig, stopped, and then started sendmail, >also MS but still no luck with mail going to the mqueue.in first. > >Mail is going directly to /var/spool/mqueue > > > My setup isn't a clean build, but a fairly recent build, thats updated to the latest packages, so i may not see the same issues... Check to see if all the sendmail processes are stopping correctly before starting again.. Maybe there is stray one loose... I've seen it before where an old process hasn't stopped, so hasnt reloaded the new config > /etc/init.d/sendmail stop if needed > killall sendmail then start again > /etc/init.d/sendmail start You shouldn't need the '-bd' in the prams, the runlevel script puts -bd in the command line (MTAL_PARMS="$MTAL_PARMS -bd $DAEMON_PARMS";) DAEMON_MODE="Daemon"; DAEMON_PARMS="-OPrivacyOptions=noetrn -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in"; >My sendmail.cf shows correct though the /etc/init.d/sendmail doesn't seem to >be written to correctly, I even manually edited this file. Still same >effect, mail going to the wrong queue. > >I do see this when I do a ps aux: > >root 2494 0.0 0.3 6440 2424 ? Ss 13:41 0:00 sendmail: >MTA: Queue runner@00:10:00 for /var/spool/mqueue > >I am at a loss as to where this is coming from, I did read about somehow >related to submit.mc but I am starting to get a little confused on this. > > I'm not quite sure what you mean with 'written to correctly' ? You will still get a process showing for mqueue, as that process the queue mail after mailscanner has played about with it. You'll not see mqueue in the ps list, it just shows 'accepting connections' To see whats happening, push your log level up, I use 12, as I like to see aliases being processed for fault tracing: e.g. sendmail.conf: MISC_PARMS="-OLogLevel=12"; > sendmailconfig Also stop and start sendmail, rather than restart it, not sure why, but when i let sendmailconfig restart i didn't get the logging i expected?? Then check maillog for the line showing the mta process starting, and you can then check the PID with ps if you want to: hell:/etc/mail# grep mqueue.in /var/log/mail.log |tail -1 Apr 24 22:48:32 hell sm-mta[24607]: started as: /usr/sbin/sendmail-mta -Am -L sm-mta -bd -OPrivacyOptions=noetrn -ODeliveryMode=queueonly -OQueueDirectory=/var/spool/mqueue.in -OLogLevel=12 hell:/etc/mail# ps fax |grep 24607 24607 ? Ss 0:00 sendmail: MTA: accepting connections ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From charles at AIB.NET Mon Apr 25 04:44:02 2005 From: charles at AIB.NET (Charles) Date: Thu Jan 12 21:29:23 2006 Subject: sendmail queuewarn and queuereturn not working after used MailScanner? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dear all, I found that after used MailScanner, the sendmai's queuewarn / queuereturn function stop working. I've set the sendmail queuewarn time to 5min, and verified this works by sending a test e-mail to a host which has no smtp service running. If I start sendmail alone, after I sent the test e-mail, the warning e-mail from sendmail is returned in 5 minutes and said that it will keep trying. But if I start MailScanner, after sent the test e-mail there is no warning e-mail returned and the job is just sit in the queue!! The config is Fedora Core 2, MailScanner 4.40.11, sendmail 8.13.4, MailScanner & sendmail in same machine. Actually there is same problem at our production server, but I didn't aware it for quite some time! (RedHat 8.0, MailScanner 4.29.7, sendmail 8.12.8, MailScanner & sendmail in same machine) Is it by design or I still need other changes to make sendmail's queuewarn and queuereturn works again? Thanks, Charles ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From itdept at FRACTALWEB.COM Mon Apr 25 05:21:19 2005 From: itdept at FRACTALWEB.COM (Fractal IT Dept.) Date: Thu Jan 12 21:29:23 2006 Subject: zip archive depth as ruleset? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi group, I now need to set zip archive depth checking to 0 for one domain, but would like to leave it as 5 for everyone else. Can this be done through a ruleset? If so, what is proper syntax? Thanks, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 25 08:32:16 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:23 2006 Subject: zip archive depth as ruleset? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just exactly the same as any other ruleset. Just make the value at the end of the line the depth you want instead of, for example, yes or no. Fractal IT Dept. wrote: > Hi group, > > I now need to set zip archive depth checking to 0 for one domain, but > would like to leave it as 5 for everyone else. Can this be done > through a ruleset? If so, what is proper syntax? > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From linux at LEUTE.SERVER.DE Mon Apr 25 12:09:15 2005 From: linux at LEUTE.SERVER.DE (Muenz, Michael) Date: Thu Jan 12 21:29:23 2006 Subject: MailScanner stops working after dying of old child Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I had a working MailScanner setup version 4.35.11 since it was released. Last weak I've updated to 4.40.11 and all works fine till Friday. This was the last message from MailScanner in the logs: Apr 22 22:00:43 pns MailScanner[18317]: MailScanner child dying of old age Apr 22 22:00:44 pns MailScanner[28564]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 22 22:00:44 pns MailScanner[28564]: Using locktype = flock After that Postfix delivered all mails to deferred queue but MailScanner didn't anything. A restart of MailScanner fixed all, but there were no errors that I can post. My Postfix version is 2.0.20 and all modules are up2date. With earlier versions I never had any problems. Any ideas? - Michael ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Mon Apr 25 12:11:06 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:23 2006 Subject: HTML Table SPAM? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did any figure out how to stop these? I've tried to learn these types of messages, but it still doesn't help. -Devon On 3/28/05, Devon Harding wrote: Well, Im running SA 3.0.2, Net::DNS version 0.48, Razor2::Client::Agent version 2.61 (upgrading to 2.67 as we speak..) Whats the procedure in training bayes to detect the samples as spam? On Mon, 28 Mar 2005 18:40:37 -0500, Matt Kettler < mkettler@evi-inc.com> wrote: > Devon Harding wrote: > > >Here is my RBL's and they still seem to get through. What can I do to stop em'? > > > > > > My strongest recommendation would be to use a version of SpamAssassin > which has SURBL capabilities. > > 3.0 ships with it by default, although if your Net::DNS perl module > isn't fairly recent it will disable the URI based blacklists and only do > normal RBLs. > > 2.6x can have this functionality added with the > Mail::SpamAssassin::SpamCopURI patch. (They call it a plugin, but it's > dependent on patch to EvalTests.pm that the "make install" process does > automatically.) > > I'd also recommend using Razor version 2.67. Older versions of razor may > not support e8 signatures, or may have bugs in e8. > > Lastly, if you've got bayes going, be sure to train some of the samples > as spam. > > Between the three approaches SA seems to catch all of these on my > network without much trouble (so far). > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at OMEGADATA.NO Mon Apr 25 12:12:40 2005 From: john at OMEGADATA.NO (John Berntsen) Date: Thu Jan 12 21:29:23 2006 Subject: MailScanner stops working after dying of old child Message-ID: I had the same problem, and that was because of razor leaving a file in the postfix hold queue i think, so if you are using razor, tell it to log to a different place. Med vennlig hilsen / Regards John Berntsen -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Muenz, Michael Sent: 25. april 2005 13:09 To: MAILSCANNER@JISCMAIL.AC.UK Subject: MailScanner stops working after dying of old child Hi, I had a working MailScanner setup version 4.35.11 since it was released. Last weak I've updated to 4.40.11 and all works fine till Friday. This was the last message from MailScanner in the logs: Apr 22 22:00:43 pns MailScanner[18317]: MailScanner child dying of old age Apr 22 22:00:44 pns MailScanner[28564]: MailScanner E-Mail Virus Scanner version 4.40.11 starting... Apr 22 22:00:44 pns MailScanner[28564]: Using locktype = flock After that Postfix delivered all mails to deferred queue but MailScanner didn't anything. A restart of MailScanner fixed all, but there were no errors that I can post. My Postfix version is 2.0.20 and all modules are up2date. With earlier versions I never had any problems. Any ideas? - Michael ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From linux at LEUTE.SERVER.DE Mon Apr 25 12:33:57 2005 From: linux at LEUTE.SERVER.DE (Muenz, Michael) Date: Thu Jan 12 21:29:23 2006 Subject: MailScanner stops working after dying of old child Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, > I had the same problem, and that was because of razor > leaving a file in the postfix hold queue i think, so if you > are using razor, tell it to log to a different place. no Razor is not running. Only SA, but I don't need it. Hmm .. I'll disable it. I'm a bit confused because this error occured two times but not with ervery dying of an old child. - Michael ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Carl.Boberg at NRM.SE Mon Apr 25 14:11:40 2005 From: Carl.Boberg at NRM.SE (Carl Boberg) Date: Thu Jan 12 21:29:23 2006 Subject: 64-bit anyone? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Just wondering if anybody has a MS installation running on an intel x64-bit os, like RedHat? Experiences, problems and such? Cheers -------------------------------- Carl Boberg System & Network Administrator Swedish Museum of Naturalhistory Frescativägen 40 104 05 Stockholm Sweden Tel nr: 08-5195 5116 Mobile: 0701-82 4055 E-mail: carl.boberg@nrm.se -------------------------------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Mon Apr 25 16:48:49 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:23 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Lance Haig wrote: > Hi Guys > > Where would one look to check why the clamav updater has failed? > > I get the message in my maillog > > Lance > I get this in the logs often, but ClamAV always seems to be up to date. I had figured the error was from the clamav update script in MailScanner not properly handling the case of the files already being up to date. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From itdept at FRACTALWEB.COM Mon Apr 25 17:07:18 2005 From: itdept at FRACTALWEB.COM (Fractal IT Dept.) Date: Thu Jan 12 21:29:23 2006 Subject: zip archive depth as ruleset? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Just exactly the same as any other ruleset. Just make the value at the > end of the line the depth you want instead of, for example, yes or no. Julian, As always, it works like a charm. Thanks! Cheers, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Mon Apr 25 17:43:25 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:23 2006 Subject: ClamAv updater failed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Scott, Thanks I checked the configuration of the freshclam.conf and the clamav.conf after changing the path there the error went away Lance Scott Silva wrote: Lance Haig wrote: Hi Guys Where would one look to check why the clamav updater has failed? I get the message in my maillog Lance I get this in the logs often, but ClamAV always seems to be up to date. I had figured the error was from the clamav update script in MailScanner not properly handling the case of the files already being up to date. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From john at KATY.COM Mon Apr 25 17:25:53 2005 From: john at KATY.COM (John Schmerold) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Has anyone tried following approach to configuring a cluster of MailScanner boxes? 1. Get an account at dyndns.org - They are good guys & don't ask for a bunch of money 2. Define your mx record to be mx1.dnsalias.net 3. Setup as many MailScanner boxes as your daily volume dictates (Let's say you're setting up 2 units) 4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient on box #2 (see http://www.dyndns.org/support/clients/dyndns.html for info regarding ddclient) It seems to me that this should help the huge spam attacks people are seeing. Will this work, is there a better way? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From G.Pentland at SOTON.AC.UK Mon Apr 25 17:54:43 2005 From: G.Pentland at SOTON.AC.UK (Pentland G.) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: A large Spam attack will likely be from a small group of hosts (or just one) so this won't help much as they will have cached the DNS lookup. Also the propagation time will probably kill this approach. There are two answers: 1. Network load balancing, either in hardware, or software like... http://lcic.org/load_balancing.html 2. Milter-Limit... this is a sendmail hack that effectively blacklists any host that sends more then a given number of emails in a time frame... Just my 2 cents... Gary John Schmerold wrote: > Has anyone tried following approach to configuring a cluster of > MailScanner boxes? 1. Get an account at dyndns.org - They > are good guys & don't ask for a bunch of money 2. Define your mx > record to be mx1.dnsalias.net 3. Setup as many MailScanner boxes as > your daily volume dictates (Let's say you're setting up 2 units) 4. > On the hour, run ddclient on box #1, on the 1/2 hour run ddclient on > box #2 (see http://www.dyndns.org/support/clients/dyndns.html for > info regarding ddclient) It seems to me that this should help the > huge spam attacks people are seeing. Will this work, is there a > better way? > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Mon Apr 25 17:59:21 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: John normal way of doing this is to have mutliple MX records for the domain with the same value. That way dns will round robin between the computers and if one fails others will pick up the work load automatically. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 John Schmerold wrote: > Has anyone tried following approach to configuring a cluster of > MailScanner boxes? > 1. Get an account at dyndns.org - They are good guys & don't ask for a > bunch of money > 2. Define your mx record to be mx1.dnsalias.net > 3. Setup as many MailScanner boxes as your daily volume dictates (Let's > say you're setting up 2 units) > 4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient on > box #2 > (see http://www.dyndns.org/support/clients/dyndns.html for > info regarding ddclient) > It seems to me that this should help the huge spam attacks people are > seeing. Will this work, is there a better way? > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From G.Pentland at soton.ac.uk Mon Apr 25 18:11:14 2005 From: G.Pentland at soton.ac.uk (Pentland G.) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: I would agree with Martin except to say that it doesn't guarantee an "even" spread of load. I have 3 MX hosts available to the world and one gets around 50% -> 60% of the load, with the other two each getting just over 20%, fortunately my hosts can handle it :-) It all depends how complicated you want to make your life. Gary Martin Hepworth wrote: > John > > normal way of doing this is to have mutliple MX records for the > domain with the same value. That way dns will round robin between the > computers and if one fails others will pick up the work load > automatically. > > > John Schmerold wrote: >> Has anyone tried following approach to configuring a cluster of >> MailScanner boxes? 1. Get an account at dyndns.org - They are good >> guys & don't ask for a bunch of money >> 2. Define your mx record to be mx1.dnsalias.net >> 3. Setup as many MailScanner boxes as your daily volume dictates >> (Let's say you're setting up 2 units) >> 4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient >> on box #2 (see >> http://www.dyndns.org/support/clients/dyndns.html for info regarding >> ddclient) It seems to me that this should help the huge spam attacks >> people are seeing. Will this work, is there a better way? >> >> ------------------------ MailScanner list ------------------------ To >> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >> mailscanner' in the body of the email. Before posting, read the Wiki >> (http://wiki.mailscanner.info/) and the archives >> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept for the > presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > mailscanner' in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Mon Apr 25 18:27:22 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Another way of doing it would be to use the round robin feature of 'A' records.. point the 'A' record like this: mail IN A IP_ADDRESS_1 mail IN A IP_ADDRESS_2 mail IN A IP_ADDRESS_3 And the 'MX' like this: IN MX 10 mail.domain.tld. works really well imo. (except dnsstuff complaining about a single mx) - dhawal Pentland G. wrote: > I would agree with Martin except to say that it doesn't guarantee an > "even" spread of load. > > I have 3 MX hosts available to the world and one gets around 50% -> 60% > of the load, with the other two each getting just over 20%, fortunately > my hosts can handle it :-) > > It all depends how complicated you want to make your life. > > Gary > > Martin Hepworth wrote: > >>John >> >>normal way of doing this is to have mutliple MX records for the >>domain with the same value. That way dns will round robin between the >>computers and if one fails others will pick up the work load >>automatically. >> >> >>John Schmerold wrote: >> >>>Has anyone tried following approach to configuring a cluster of >>>MailScanner boxes? 1. Get an account at dyndns.org - They are good >>>guys & don't ask for a bunch of money >>>2. Define your mx record to be mx1.dnsalias.net >>>3. Setup as many MailScanner boxes as your daily volume dictates >>>(Let's say you're setting up 2 units) >>>4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient >>> on box #2 (see >>>http://www.dyndns.org/support/clients/dyndns.html for info regarding >>>ddclient) It seems to me that this should help the huge spam attacks >>>people are seeing. Will this work, is there a better way? >>> ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ralloway at WINBEAM.COM Mon Apr 25 18:25:58 2005 From: ralloway at WINBEAM.COM (Richard D Alloway) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: Or, you could use 1 MX record and have multiple A records for that 1 MX record. I have 6 MailScanner machines and fairly evenly spread the load across them this way (in semi-zonefile format): mydomain.com IN MX 0 smtp-gateway.mydomain.com smtp-gateway.mydomain.com IN A 192.168.0.1 smtp-gateway-1.mydomain.com IN A 192.168.0.1 smtp-gateway.mydomain.com IN A 192.168.0.2 smtp-gateway-2.mydomain.com IN A 192.168.0.2 smtp-gateway.mydomain.com IN A 192.168.0.3 smtp-gateway-3.mydomain.com IN A 192.168.0.3 smtp-gateway.mydomain.com IN A 192.168.0.4 smtp-gateway-4.mydomain.com IN A 192.168.0.4 smtp-gateway.mydomain.com IN A 192.168.0.5 smtp-gateway-5.mydomain.com IN A 192.168.0.5 smtp-gateway.mydomain.com IN A 192.168.0.6 smtp-gateway-6.mydomain.com IN A 192.168.0.6 In order to satisfy the forward/reverse lookups of some servers: 192.168.0.1 IN PTR smtp-gateway-1.mydomain.com 192.168.0.2 IN PTR smtp-gateway-2.mydomain.com 192.168.0.3 IN PTR smtp-gateway-3.mydomain.com 192.168.0.4 IN PTR smtp-gateway-4.mydomain.com 192.168.0.5 IN PTR smtp-gateway-5.mydomain.com 192.168.0.6 IN PTR smtp-gateway-6.mydomain.com We have no problems and no complaints doing this this way. -Richard D Alloway, Esq Chief Technical Officer Winbeam On Mon, 25 Apr 2005, Pentland G. wrote: > I would agree with Martin except to say that it doesn't guarantee an > "even" spread of load. > > I have 3 MX hosts available to the world and one gets around 50% -> 60% > of the load, with the other two each getting just over 20%, fortunately > my hosts can handle it :-) > > It all depends how complicated you want to make your life. > > Gary > > Martin Hepworth wrote: >> John >> >> normal way of doing this is to have mutliple MX records for the >> domain with the same value. That way dns will round robin between the >> computers and if one fails others will pick up the work load >> automatically. >> >> >> John Schmerold wrote: >>> Has anyone tried following approach to configuring a cluster of >>> MailScanner boxes? 1. Get an account at dyndns.org - They are good >>> guys & don't ask for a bunch of money >>> 2. Define your mx record to be mx1.dnsalias.net >>> 3. Setup as many MailScanner boxes as your daily volume dictates >>> (Let's say you're setting up 2 units) >>> 4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient >>> on box #2 (see >>> http://www.dyndns.org/support/clients/dyndns.html for info regarding >>> ddclient) It seems to me that this should help the huge spam attacks >>> people are seeing. Will this work, is there a better way? >>> >>> ------------------------ MailScanner list ------------------------ To >>> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>> mailscanner' in the body of the email. Before posting, read the Wiki >>> (http://wiki.mailscanner.info/) and the archives >>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> ********************************************************************** >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they >> are addressed. If you have received this email in error please notify >> the system manager. >> >> This footnote confirms that this email message has been swept for the >> presence of computer viruses and is believed to be clean. >> >> ********************************************************************** >> >> ------------------------ MailScanner list ------------------------ To >> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >> mailscanner' in the body of the email. Before posting, read the Wiki >> (http://wiki.mailscanner.info/) and the archives >> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 25 18:30:55 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:23 2006 Subject: 64-bit anyone? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Running it on AMD x86_64 with RHEL 4, no problems. Carl Boberg wrote: >Hi, >Just wondering if anybody has a MS installation running on an intel x64-bit os, like RedHat? >Experiences, problems and such? > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Mon Apr 25 18:33:45 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Gary, Do you find that the one that gets most of the spam is the last one listed in the zone file? Pentland G. wrote: >I would agree with Martin except to say that it doesn't guarantee an >"even" spread of load. > >I have 3 MX hosts available to the world and one gets around 50% -> 60% >of the load, with the other two each getting just over 20%, fortunately >my hosts can handle it :-) > >It all depends how complicated you want to make your life. > >Gary > >Martin Hepworth wrote: > > >>John >> >>normal way of doing this is to have mutliple MX records for the >>domain with the same value. That way dns will round robin between the >>computers and if one fails others will pick up the work load >>automatically. >> >> >>John Schmerold wrote: >> >> >>>Has anyone tried following approach to configuring a cluster of >>>MailScanner boxes? 1. Get an account at dyndns.org - They are good >>>guys & don't ask for a bunch of money >>>2. Define your mx record to be mx1.dnsalias.net >>>3. Setup as many MailScanner boxes as your daily volume dictates >>>(Let's say you're setting up 2 units) >>>4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient >>> on box #2 (see >>>http://www.dyndns.org/support/clients/dyndns.html for info regarding >>>ddclient) It seems to me that this should help the huge spam attacks >>>people are seeing. Will this work, is there a better way? >>> >>> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kodak at FRONTIERHOMEMORTGAGE.COM Mon Apr 25 18:38:16 2005 From: kodak at FRONTIERHOMEMORTGAGE.COM (Jason Balicki) Date: Thu Jan 12 21:29:23 2006 Subject: 64-bit anyone? Message-ID: Carl Boberg <> wrote: > Hi, > Just wondering if anybody has a MS installation running on an intel > x64-bit os, like RedHat? Experiences, problems and such? I'm running on an AMD 64 bit box with CentOS 4 (RHEL clone) and except for that one bit where Cthulhu demanded the fresh blood of all my employees everything is fine. Don't get much outgoing mail these days, though. --J(K) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jrudd at UCSC.EDU Mon Apr 25 20:58:01 2005 From: jrudd at UCSC.EDU (John Rudd) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: That doesn't help you as much if one goes down, and you're talking about clients trying to submit messages via SMTP. They'll get errors when they hit the "send" button if they try the wrong IP address (I don't know of any email clients that gracefully fail over in that situation). If they wait a few seconds and try again, they'll get through ... but, IME, that wont keep you from getting a flood of complaints when you've got a large user base. We use a load balancer and an array of identically configured mailscanner boxes. And instead of limiting submission rates via a milter, we use the sendmail built-in features for connetion control and rate control, as well as 2 DNSBLs, and sendmail's Greet Delay. On Apr 25, 2005, at 10:27, Dhawal Doshy wrote: > Another way of doing it would be to use the round robin feature of 'A' > records.. > > point the 'A' record like this: > mail IN A IP_ADDRESS_1 > mail IN A IP_ADDRESS_2 > mail IN A IP_ADDRESS_3 > > And the 'MX' like this: > IN MX 10 mail.domain.tld. > > works really well imo. (except dnsstuff complaining about a single mx) > > - dhawal > > Pentland G. wrote: >> I would agree with Martin except to say that it doesn't guarantee an >> "even" spread of load. >> >> I have 3 MX hosts available to the world and one gets around 50% -> >> 60% >> of the load, with the other two each getting just over 20%, >> fortunately >> my hosts can handle it :-) >> >> It all depends how complicated you want to make your life. >> >> Gary >> >> Martin Hepworth wrote: >> >>> John >>> >>> normal way of doing this is to have mutliple MX records for the >>> domain with the same value. That way dns will round robin between the >>> computers and if one fails others will pick up the work load >>> automatically. >>> >>> >>> John Schmerold wrote: >>> >>>> Has anyone tried following approach to configuring a cluster of >>>> MailScanner boxes? 1. Get an account at dyndns.org - They are good >>>> guys & don't ask for a bunch of money >>>> 2. Define your mx record to be mx1.dnsalias.net >>>> 3. Setup as many MailScanner boxes as your daily volume dictates >>>> (Let's say you're setting up 2 units) >>>> 4. On the hour, run ddclient on box #1, on the 1/2 hour run ddclient >>>> on box #2 (see >>>> http://www.dyndns.org/support/clients/dyndns.html for info regarding >>>> ddclient) It seems to me that this should help the huge spam attacks >>>> people are seeing. Will this work, is there a better way? >>>> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From suporte at SETINET.COM.BR Mon Apr 25 19:20:31 2005 From: suporte at SETINET.COM.BR (Suporte SETi) Date: Thu Jan 12 21:29:23 2006 Subject: Fw: Stop inbound Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] What is: "MailScanner: Message contained archive nested too deeply" Thanks -------------------------------------------------------------------- Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From G.Pentland at SOTON.AC.UK Mon Apr 25 23:13:39 2005 From: G.Pentland at SOTON.AC.UK (Pentland G.) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: Julian, As you know my site... The one with more load is the one that was built first and hence available through the firewall first, not in the zone file first. Maybe spammers cache/log IP addresses? Never got to the bottom of it but don't really mind, if it is struggling I just shut it down for ten minutes as any real mail will queue or choose another MX and I'll lose a few hundred spams without bothering with the CPU time to check them. Gary Julian Field wrote: > Gary, > > Do you find that the one that gets most of the spam is the last one > listed in the zone file? > > Pentland G. wrote: > >> I would agree with Martin except to say that it doesn't guarantee an >> "even" spread of load. >> >> I have 3 MX hosts available to the world and one gets around 50% -> >> 60% of the load, with the other two each getting just over 20%, >> fortunately my hosts can handle it :-) >> >> It all depends how complicated you want to make your life. >> >> Gary >> >> Martin Hepworth wrote: >> >> >>> John >>> >>> normal way of doing this is to have mutliple MX records for the >>> domain with the same value. That way dns will round robin between >>> the computers and if one fails others will pick up the work load >>> automatically. >>> >>> >>> John Schmerold wrote: >>> >>> >>>> Has anyone tried following approach to configuring a cluster of >>>> MailScanner boxes? 1. Get an account at dyndns.org - They are good >>>> guys & don't ask for a bunch of money 2. Define your mx record to >>>> be mx1.dnsalias.net 3. Setup as many MailScanner boxes as your >>>> daily volume dictates (Let's say you're setting up 2 units) >>>> 4. On the hour, run ddclient on box #1, on the 1/2 hour run >>>> ddclient on box #2 (see >>>> http://www.dyndns.org/support/clients/dyndns.html for info >>>> regarding ddclient) It seems to me that this should help the huge >>>> spam attacks people are seeing. Will this work, is there a better >>>> way? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Tue Apr 26 00:18:22 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:29:23 2006 Subject: Cluster of MailScanners Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > > Pentland G. wrote: > >> I would agree with Martin except to say that it doesn't guarantee an >> "even" spread of load. >> >> I have 3 MX hosts available to the world and one gets around 50% -> >> 60% of the load, with the other two each getting just over 20%, >> fortunately my hosts can handle it :-) >> >> It all depends how complicated you want to make your life. >> >> Gary Julian Field wrote: > Gary, > > Do you find that the one that gets most of the spam is the last one > listed in the zone file? At least bind returns the records in random order. So there should be no concept of being first or last in the zonefile. Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Tue Apr 26 00:37:23 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:29:23 2006 Subject: Rules du jour troubles Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I get this mail every night; what do I need to do to fix it? EvilNumber has changed on mailgate Version line: # Version: 02.00.01 # The evilnumber set has been renamed to match SARE's updated standards, the new name is 70_sare_evilnum0.cf. Please remove evilnumber local language files Tim Jackson's (et al) bogus virus warnings has changed on mailgate Version line: # bogus-virus-warnings.cf version 1.157 (2005-03-31) **WARNING**: spamassassin --lint failed. Rolling configuration files back, not restarting SpamAssassin. Rollback command is: mv -f /usr/share/spamassassin/evilnumbers.cf /usr/share/spamassassin/RulesDuJour/evilnumbers.cf.2; mv -f /usr/share/spamassassin/RulesDuJour/evilnumbers.cf.20050425-0316 /usr/share/spamassassin/evilnumbers.cf; mv -f /usr/share/spamassassin/bogus-virus-warnings.cf /usr/share/spamassassin/RulesDuJour/bogus-virus-warnings.cf.2; mv -f /usr/share/spamassassin/RulesDuJour/bogus-virus-warnings.cf.20050425-0316 /usr/share/spamassassin/bogus-virus-warnings.cf; Lint output: warning: description for SARE_MULT_BMASTGR is over 50 chars warning: description for SARE_RECV_IP_061050 is over 50 chars warning: description for VIRUS_WARNING251 is over 50 chars warning: description for VIRUS_WARNING326 is over 50 chars warning: description for VIRUS_WARNING308 is over 50 chars warning: description for SARE_RECV_IP_222064 is over 50 chars etc I haven't changed any texts, so why does lint suddenly complain? Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 26 00:46:29 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:23 2006 Subject: Rules du jour troubles Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Leif Neland wrote: > I get this mail every night; what do I need to do to fix it? > Erm, all you need to do is what the message below tells you to do.. Use 70_sare_evilnum0.cf instead of 70_sare_evilnum.cf. > > EvilNumber has changed on mailgate > > Version line: # Version: 02.00.01 # The evilnumber set has been > renamed to > match SARE's updated standards, the new name is 70_sare_evilnum0.cf. > Please > remove evilnumber local language files In more detail, you'll want to take these steps. 1) update your RDJ config file to reflect the new name. Find the reference to 70_sare_evilnum.cf and add the 0 to it's name. 2) cd /etc/mail/spamassassin 3) wget http://www.rulesemporium.com/rules/70_sare_evilnum0.cf 4) rm 70_sare_evilnum.cf ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From kyle at MLUG.MISSOURI.EDU Tue Apr 26 02:20:59 2005 From: kyle at MLUG.MISSOURI.EDU (Kyle Krieg) Date: Thu Jan 12 21:29:23 2006 Subject: Mailscanner + Fedora 3 x86_64 + sendmail (Solved) Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ok, the saga continues! I'm going to get this to work! :) I've tried to install the BETA version 4.41.1-2 on x86_64 Fedora 3 system. Thinking everything with the install has been put behind me, but I've got more issues with Fedora3 and the install. Attached is the error log for perl-Archive-Zip-1.14-1, since it errors out with the following errors : Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/testex.t 15 15 100.00% 1-15 Failed 1/5 test scripts, 80.00% okay. 15/163 subtests failed, 90.80% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.59067 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.59067 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.14-1.noarch.rpm. Maybe it did not build correctly? When I try and to start MailScanner, I get the following : [root@skywalker init.d]# ./MailScanner start Starting MailScanner daemons: incoming sendmail: [ OK ] outgoing sendmail: [ OK ] MailScanner: Can't locate Archive/Zip.pm in @INC (@INC contains: /usr/lib/MailScanner /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi /usr/lib/perl5/5.8.5 /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/MailScanner/5.8.5/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.5 /usr/lib/MailScanner/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.4 /usr/lib/MailScanner/5.8.3 /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1 /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at /usr/lib/MailScanner/MailScanner/Message.pm line 47. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/Message.pm line 47. Compilation failed in require at /usr/sbin/MailScanner line 74. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 74. [ OK ] I've tried to find perl-Archive-Zip-1.14.-1.noarch.rpm from the net, and I did find it on freshrpms.net. I tried to install it and it gave me an error about not having MODULE_COMPAT_5.8.6 installed. So I remembered I could install perl modules by the command line by cpan. I installed Archive::Zip via cpan and MailScanner started like clockwork! Presto! I'm doing some tests as we speak, but all is good so far. I've only sent a hand full of messages so far with MailScanner, so my config might be a little weird, but it is sending messages. So if your running x86_64 on a Fedora 3 core system with everything installed and all your yum updates are good, you might have an issue installing Archive-Zip, but you can install it with cpan and everything seems to be fine after this. Anyone else experiencing this?? Kyle Kyle Krieg wrote: I just got back from on the road and tried uninstalling perl-Compress-Zlib again and ran the new install.sh script with the same errors. The link below has zlib-1.2.2.2-1 for an rpm. I have zlib-1.2.1.2-1 on my FC3 machine. I'm a little confused with this. Is perl-Compress-Zlib and zlib-1.2.2.2-1 the same and I can upgrade to zlib-1.2.2.2-1 to solve my problems with installing per-Compress-Zlib? Attached is the install.sh log and what errored out... Peter Russell wrote: Raymon Dijkxhoorn have provided alternate zlib that work fine on FC3 and RHEL4 (i pasted some of his post in below) - these were required to compile clamav (which i guess we were all doing before installing MS and therefore didnt have this problem) Is there any reason you would use FC3 over CentOS 4 for a mailscanner machine? http://mailscanner.prolocation.net/ Or the direct links: http://mailscanner.prolocation.net/zlib/zlib-1.2.2.2-1.i386.rpm http://mailscanner.prolocation.net/zlib/zlib-devel-1.2.2.2-1.i386.rpm Julian Field wrote: It is probably having trouble with Compress-Zlib. Try uninstalling perl-Compress-Zlib (rpm -e perl-Compress-Zlib) and then running install.sh again. perl-Archive-Zip itself doesn't do anything platform-dependent I think, it's Compress-Zlib that does the hard work. Kyle Krieg wrote: I used your new install.sh script, and looks like it had a small problem with perl-Archive-Zip. Here is the output from the install...it's only failing on this one package.... Julian Field wrote: You have 2 packages installed both called "perl-5.8.5-9". Just 2 different architectures. That should break RPM :-( Please do rpm -ql perl | grep bin The install.sh script I just sent you works around this problem. Kyle Krieg wrote: Here is the output from the commands you asked for. My install was Fedora 3 base (full install) and the current yum updates. My yum updates are pointing to livna server. Thanks!! Kyle [root@skywalker framadmn]# rpm -qi perl Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 11:55:57 AM CDT Install Date: Sun 20 Mar 2005 08:52:50 PM CST Build Host: tweety.build.redh at.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 28442178 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:33 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. Name : perl Relocations: (not relocatable) Version : 5.8.5 Vendor: Red Hat, Inc. Release : 9 Build Date: Tue 12 Oct 2004 12:01:58 PM CDT Install Date: Sun 20 Mar 2005 08:52:55 PM CST Build Host: dolly.build.redha t.com Group : Development/Languages Source RPM: perl-5.8.5-9.src.rpm Size : 34190638 License: Artistic or GPL Signature : DSA/SHA1, Wed 20 Oct 2004 12:36:57 PM CDT, Key ID b44269d04f2a6fd2 Packager : Red Hat, Inc. *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * *MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be * MailScanner has detected a possible fraud attempt from "bugzilla.redhat.com" claiming to be URL : http://www.perl.org/ Summary : The Perl programming language. Description : Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. A large proportion of the CGI scripts on the web are written in Perl. You need the perl package installed on your system so that your system can handle Perl scripts. Install this package if you want to program in Perl or enable your system to handle Perl scripts. [root@skywalker framadmn]# rpm -qa | grep '^perl' perl-LDAP-0.31-5 perl-Compress-Zlib-1.33-6 perl-Net-CIDR-0.10-1 perl-XML-NamespaceSupport-1.08-6 perl-XML-LibXML-1.58-1 perl-RPM-Specfile-1.17-2 perl-Convert-TNEF-0.17-3 perl-5.8.5-9 perl-libwww-perl-5.79-5 perl-Time-HiRes-1.55-3 perl-BSD-Resource-1.23-6 perl-HTML-Tagset-3.03-30 perl-Devel-Symdump-2.03-19 perl-HTML-Parser-3.35-6 perl-Convert-ASN1-0.18-3 perl-XML-LibXML-Common-0.13-7 perl-Convert-BinHex-1.119-2 perl-MailTools-1.66-1 perl-TimeDate-1.1301-3 perl-Bit-Vector-6.3-3 perl-RPM2-0.66-7 perl-5.8.5-9 perl-URI-1.30-4 perl-XML-Dumper-0.71-2 perl-Digest-SHA1-2.07-5 perl-XML-Twig-3.13-6 perl-Filter-Simple-0.79-4 perl-Cyrus-2.2.10-3.fc3 perl-DateManip-5.42a-3 perl-XML-Encoding-1.01-26 perl-XML-Grove-0.46alpha-27 perl-IO-stringy-2.110-1 perl-File-MMagic-1.21-2 perl-TermReadKey-2.20-17 perl-DBD-MySQL-2.9003-5 perl-XML-Parser-2.34-5 perl-Net-DNS-0.48-1 perl-Crypt-SSLeay-0.51-5 perl-NKF-2.04-3 perl-Archive-Tar-1.08-3 perl-Frontier-RPC-0.06-38 perl-Inline-0.44-14 perl-Filter-1.30-6 perl-DBI-1.40-5 perl-libxml-perl-0.07-30 perl-Digest-HMAC-1.01-13 perl-Parse-Yapp-1.05-32 perl-Date-Calc-5.3-9 perl-MIME-tools-5.417-1 perl-Text-Kakasi-1.05-11 perl-DBD-Pg-1.31-6 perl-Parse-RecDescent-1.94-4 perl-PDL-2.4.1-5 perl-libxml-enno-1.02-31 perl-XML-SAX-0.12-7 perl-SGMLSpm-1.03ii-14 perl-suidperl-5.8.5-9.1 [root@skywalker framadmn]# rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl perl 5.8.5 i386 perl 5.8.5 x86_64 [root@skywalker framadmn]# which perl /usr/bin/perl [root@skywalker framadmn]# perl -v This is perl, v5.8.5 built for x86_64-linux-thread-multi Copyright 1987-2004, Larry Wall Perl may be copied only under the terms of either the Artistic License or the GNU General Public License, which may be found in the Perl 5 source kit. Complete documentation for Perl, including FAQ lists, should be found on this system using `man perl' or `perldoc perl'. If you have access to the Internet, point your browser at http://www.perl.com/, the Perl Home Page. [root@skywalker framadmn]# Julian Field wrote: I think it actually built stuff okay, but has calculated the architecture wrongly. Please can you send me the output of rpm -qi perl rpm -qa | grep '^perl' rpm -q --queryformat='%{NAME} %{VERSION} %{ARCH}\n' perl which perl perl -v For some reason it is picking up both i386 and x86_64 as the architecture, when it should just be x86_64 (which is what RHEL4 returns). That bunch of commands should give me an idea what is happening. Kyle Krieg wrote: Below is the output of the rpmbuild -bc perl-Archive-Zip.spec. Thanks for looking into this Julian. I've been using Mailscanner for 2 years now on a RH 8.0 machine with no issues. I've also show the following errors when using the install.sh script. Looks like to me, the install scripts it looking for packages in the i386x86_64 directory, which is not there. All the packages are in either /usr/src/redhat/RPMS/x86_64, /usr/src/redhat/RPMS/noarch or /usr/src/redhat/SPECS for the perl-Archive-Zip.spec files. There are two outputs below, the first from the rpmbuild -bc perl-Archive-Zip.spec and another from when I try and reinstall MailScanner from the install.sh script. I've cut out most of it and only given the errors that I think are important, but have the whole install log, if you would like it see it. Kyle ************************************************ -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ________________________________________________________________________ Attempting to build and install perl-Compress-Zlib-1.33-2 Detected Compress-Zlib, building appropriately... Installing perl-Compress-Zlib-1.33-2.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.15945 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Compress-Zlib-1.33 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Compress-Zlib-1.33.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Compress-Zlib-1.33 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.15945 + umask 022 + cd /usr/src/redhat/BUILD + cd Compress-Zlib-1.33 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Compress-Zlib-1.33-2-root/usr Parsing config.in... Building Zlib enabled Looks Good. Up/Downgrade complete. Checking if your kit is complete... Looks good Writing Makefile for Compress::Zlib + make cp Zlib.pm blib/lib/Compress/Zlib.pm AutoSplitting blib/lib/Compress/Zlib.pm (blib/lib/auto/Compress/Zlib) /usr/bin/perl /usr/lib/perl5/5.8.5/ExtUtils/xsubpp -typemap /usr/lib/perl5/5.8.5/ExtUtils/typemap -typemap typemap Zlib.xs > Zlib.xsc && mv Zlib.xsc Zlib.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" Zlib.c Zlib.xs: In function `XS_Compress__Zlib__inflateStream_inflate': Zlib.xs:982: warning: comparison is always false due to limited range of data type Zlib.xs: In function `XS_Compress__Zlib__inflateStream_inflateSync': Zlib.xs:1017: warning: comparison is always false due to limited range of data type gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" adler32.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" compress.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" crc32.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" gzio.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" uncompr.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" deflate.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" trees.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" zutil.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" inflate.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" infblock.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" inftrees.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" infcodes.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" infutil.c gcc -c -I./zlib-src -D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/include/gdbm -O2 -g -pipe -m64 -DVERSION=\"1.33\" -DXS_VERSION=\"1.33\" -fPIC "-I/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/CORE" inffast.c Running Mkbootstrap for Compress::Zlib () chmod 644 Zlib.bs rm -f blib/arch/auto/Compress/Zlib/Zlib.so gcc -shared Zlib.o adler32.o compress.o crc32.o gzio.o uncompr.o deflate.o trees.o zutil.o inflate.o infblock.o inftrees.o infcodes.o infutil.o inffast.o -o blib/arch/auto/Compress/Zlib/Zlib.so chmod 755 blib/arch/auto/Compress/Zlib/Zlib.so cp Zlib.bs blib/arch/auto/Compress/Zlib/Zlib.bs chmod 644 blib/arch/auto/Compress/Zlib/Zlib.bs Manifying blib/man3/Compress::Zlib.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/01version..... t/01version.....ok 1/1 t/01version.....ok t/02zlib........ t/02zlib........ok 1/239 t/02zlib........ok 2/239 t/02zlib........ok 3/239 t/02zlib........ok 4/239 t/02zlib........ok 5/239 t/02zlib........ok 6/239 t/02zlib........ok 7/239 t/02zlib........ok 8/239 t/02zlib........ok 9/239 t/02zlib........ok 10/239 t/02zlib........ok 11/239 t/02zlib........ok 12/239 t/02zlib........ok 13/239 t/02zlib........ok 14/239 t/02zlib........ok 15/239 t/02zlib........ok 16/239 t/02zlib........ok 17/239 t/02zlib........ok 18/239 t/02zlib........ok 19/239 t/02zlib........ok 20/239 t/02zlib........ok 21/239 t/02zlib........ok 22/239 t/02zlib........ok 23/239 t/02zlib........ok 24/239 t/02zlib........ok 25/239 t/02zlib........ok 26/239 t/02zlib........ok 27/239 t/02zlib........ok 28/239 t/02zlib........ok 29/239 t/02zlib........ok 30/239 t/02zlib........ok 31/239 t/02zlib........ok 32/239 t/02zlib........ok 33/239 t/02zlib........ok 34/239 t/02zlib........ok 35/239 t/02zlib........ok 36/239 t/02zlib........ok 37/239 t/02zlib........ok 38/239 t/02zlib........ok 39/239 t/02zlib........ok 40/239 t/02zlib........ok 41/239 t/02zlib........ok 42/239 t/02zlib........ok 43/239 t/02zlib........ok 44/239 t/02zlib........ok 45/239 t/02zlib........ok 46/239 t/02zlib........ok 47/239 t/02zlib........ok 48/239 t/02zlib........ok 49/239 t/02zlib........ok 50/239 t/02zlib........ok 51/239 t/02zlib........ok 52/239 t/02zlib........ok 53/239 t/02zlib........ok 54/239 t/02zlib........ok 55/239 t/02zlib........ok 56/239 t/02zlib........ok 57/239 t/02zlib........ok 58/239 t/02zlib........ok 59/239 t/02zlib........ok 60/239 t/02zlib........ok 61/239 t/02zlib........ok 62/239 t/02zlib........ok 63/239 t/02zlib........ok 64/239 t/02zlib........ok 65/239 t/02zlib........ok 66/239 t/02zlib........ok 67/239 t/02zlib........ok 68/239 t/02zlib........ok 69/239 t/02zlib........ok 70/239 t/02zlib........ok 71/239 t/02zlib........ok 72/239 t/02zlib........ok 73/239 t/02zlib........ok 74/239 t/02zlib........ok 75/239 t/02zlib........ok 76/239 t/02zlib........ok 77/239 t/02zlib........ok 78/239 t/02zlib........ok 79/239 t/02zlib........ok 80/239 t/02zlib........ok 81/239 t/02zlib........ok 82/239 t/02zlib........ok 83/239 t/02zlib........ok 84/239 t/02zlib........ok 85/239 t/02zlib........ok 86/239 t/02zlib........ok 87/239 t/02zlib........ok 88/239 t/02zlib........ok 89/239 t/02zlib........ok 90/239 t/02zlib........ok 91/239 t/02zlib........ok 92/239 t/02zlib........ok 93/239 t/02zlib........ok 94/239 t/02zlib........ok 95/239 t/02zlib........ok 96/239 t/02zlib........ok 97/239 t/02zlib........ok 98/239 t/02zlib........ok 99/239 t/02zlib........ok 100/239 t/02zlib........ok 101/239 t/02zlib........ok 102/239 t/02zlib........ok 103/239 t/02zlib........ok 104/239 t/02zlib........ok 105/239 t/02zlib........ok 106/239 t/02zlib........ok 107/239 t/02zlib........ok 108/239 t/02zlib........ok 109/239 t/02zlib........ok 110/239 t/02zlib........ok 111/239 t/02zlib........ok 112/239 t/02zlib........ok 113/239 t/02zlib........ok 114/239 t/02zlib........ok 115/239 t/02zlib........ok 116/239 t/02zlib........ok 117/239 t/02zlib........ok 118/239 t/02zlib........ok 119/239 t/02zlib........ok 120/239 t/02zlib........ok 121/239 t/02zlib........ok 122/239 t/02zlib........ok 123/239 t/02zlib........ok 124/239 t/02zlib........ok 125/239 t/02zlib........ok 126/239 t/02zlib........ok 127/239 t/02zlib........ok 128/239 t/02zlib........ok 129/239 t/02zlib........ok 130/239 t/02zlib........ok 131/239 t/02zlib........ok 132/239 t/02zlib........ok 133/239 t/02zlib........ok 134/239 t/02zlib........ok 135/239 t/02zlib........ok 136/239 t/02zlib........ok 137/239 t/02zlib........ok 138/239 t/02zlib........ok 139/239 t/02zlib........ok 140/239 t/02zlib........ok 141/239 t/02zlib........ok 142/239 t/02zlib........ok 143/239 t/02zlib........ok 144/239 t/02zlib........ok 145/239 t/02zlib........ok 146/239 t/02zlib........ok 147/239 t/02zlib........ok 148/239 t/02zlib........ok 149/239 t/02zlib........ok 150/239 t/02zlib........ok 151/239 t/02zlib........ok 152/239 t/02zlib........ok 153/239 t/02zlib........ok 154/239 t/02zlib........ok 155/239 t/02zlib........ok 156/239 t/02zlib........ok 157/239 t/02zlib........ok 158/239 t/02zlib........ok 159/239 t/02zlib........ok 160/239 t/02zlib........ok 161/239 t/02zlib........ok 162/239 t/02zlib........ok 163/239 t/02zlib........ok 164/239 t/02zlib........ok 165/239 t/02zlib........ok 166/239 t/02zlib........ok 167/239 t/02zlib........ok 168/239 t/02zlib........ok 169/239 t/02zlib........ok 170/239 t/02zlib........ok 171/239 t/02zlib........ok 172/239 t/02zlib........ok 173/239 t/02zlib........ok 174/239 t/02zlib........ok 175/239 t/02zlib........ok 176/239 t/02zlib........ok 177/239 t/02zlib........ok 178/239 t/02zlib........ok 179/239 t/02zlib........ok 180/239 t/02zlib........ok 181/239 t/02zlib........ok 182/239 t/02zlib........ok 183/239 t/02zlib........ok 184/239 t/02zlib........ok 185/239 t/02zlib........ok 186/239 t/02zlib........ok 187/239 t/02zlib........ok 188/239 t/02zlib........ok 189/239 t/02zlib........ok 190/239 t/02zlib........ok 191/239 t/02zlib........ok 192/239 t/02zlib........ok 193/239 t/02zlib........ok 194/239 t/02zlib........ok 195/239 t/02zlib........ok 196/239 t/02zlib........ok 197/239 t/02zlib........ok 198/239 t/02zlib........ok 199/239 t/02zlib........ok 200/239 t/02zlib........ok 201/239 t/02zlib........ok 202/239 t/02zlib........ok 203/239 t/02zlib........ok 204/239 t/02zlib........ok 205/239 t/02zlib........ok 206/239 t/02zlib........ok 207/239 t/02zlib........ok 208/239 t/02zlib........ok 209/239 t/02zlib........ok 210/239 t/02zlib........ok 211/239 t/02zlib........ok 212/239 t/02zlib........ok 213/239 t/02zlib........ok 214/239 t/02zlib........ok 215/239 t/02zlib........ok 216/239 t/02zlib........ok 217/239 t/02zlib........ok 218/239 t/02zlib........ok 219/239 t/02zlib........ok 220/239 t/02zlib........ok 221/239 t/02zlib........ok 222/239 t/02zlib........ok 223/239 t/02zlib........ok 224/239 t/02zlib........ok 225/239 t/02zlib........ok 226/239 t/02zlib........ok 227/239 t/02zlib........ok 228/239 t/02zlib........ok 229/239 t/02zlib........ok 230/239 t/02zlib........ok 231/239 t/02zlib........ok 232/239 t/02zlib........ok 233/239 t/02zlib........ok 234/239 t/02zlib........ok 235/239 t/02zlib........ok 236/239 t/02zlib........ok 237/239 t/02zlib........ok 238/239 t/02zlib........ok 239/239 t/02zlib........ok t/03examples.... t/03examples....ok 1/13 t/03examples....ok 2/13 t/03examples....ok 3/13 t/03examples....ok 4/13 t/03examples....ok 5/13 t/03examples....ok 6/13 t/03examples....ok 7/13 t/03examples....ok 8/13 t/03examples....ok 9/13 t/03examples....ok 10/13 t/03examples....ok 11/13 t/03examples....ok 12/13 t/03examples....ok 13/13 t/03examples....ok t/04encoding.... t/04encoding....ok 1/15 t/04encoding....ok 2/15 t/04encoding....ok 3/15 t/04encoding....ok 4/15 t/04encoding....ok 5/15 t/04encoding....ok 6/15 t/04encoding....ok 7/15 t/04encoding....ok 8/15 t/04encoding....ok 9/15 t/04encoding....ok 10/15 t/04encoding....ok 11/15 t/04encoding....ok 12/15 t/04encoding....ok 13/15 t/04encoding....ok 14/15 t/04encoding....ok 15/15 t/04encoding....ok t/05gzsetp...... t/05gzsetp......ok 1/11 t/05gzsetp......ok 2/11 t/05gzsetp......ok 3/11 t/05gzsetp......ok 4/11 t/05gzsetp......ok 5/11 t/05gzsetp......ok 6/11 t/05gzsetp......ok 7/11 t/05gzsetp......ok 8/11 t/05gzsetp......ok 9/11 t/05gzsetp......ok 10/11 t/05gzsetp......ok 11/11 t/05gzsetp......ok t/06gzdopen..... t/06gzdopen.....ok 1/23 t/06gzdopen.....ok 2/23 t/06gzdopen.....ok 3/23 t/06gzdopen.....ok 4/23 t/06gzdopen.....ok 5/23 t/06gzdopen.....ok 6/23 t/06gzdopen.....ok 7/23 t/06gzdopen.....ok 8/23 t/06gzdopen.....ok 9/23 t/06gzdopen.....ok 10/23 t/06gzdopen.....ok 11/23 t/06gzdopen.....ok 12/23 t/06gzdopen.....ok 13/23 t/06gzdopen.....ok 14/23 t/06gzdopen.....ok 15/23 t/06gzdopen.....ok 16/23 t/06gzdopen.....ok 17/23 t/06gzdopen.....ok 18/23 t/06gzdopen.....ok 19/23 t/06gzdopen.....ok 20/23 t/06gzdopen.....ok 21/23 t/06gzdopen.....ok 22/23 t/06gzdopen.....ok 23/23 t/06gzdopen.....ok All tests successful. Files=6, Tests=302, 1 wallclock secs ( 0.48 cusr + 0.15 csys = 0.63 CPU) + exit 0 Executing(%install): /bin/sh -e /var/tmp/rpm-tmp.54310 + umask 022 + cd /usr/src/redhat/BUILD + cd Compress-Zlib-1.33 + LANG=C + export LANG + unset DISPLAY + rm -rf /var/tmp/perl-Compress-Zlib-1.33-2-root ++ perl -V:installarchlib + eval 'installarchlib='\''/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi'\'';' ++ installarchlib=/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi + mkdir -p /var/tmp/perl-Compress-Zlib-1.33-2-root//usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi + make install Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.so Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.bs Files found in blib/arch: installing files in blib/lib into architecture dependent library tree Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/Compress/Zlib.pm Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/autosplit.ix Installing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/share/man/man3/Compress::Zlib.3pm Writing /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/.packlist Appending installation info to /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/perllocal.pod + '[' -x /usr/lib/rpm/brp-compress ']' + /usr/lib/rpm/brp-compress + find /var/tmp/perl-Compress-Zlib-1.33-2-root/usr -type f -print + sed 's@^/var/tmp/perl-Compress-Zlib-1.33-2-root@@g' + grep -v perllocal.pod + grep -v '\.packlist' ++ cat Compress-Zlib-1.33-filelist + '[' '/usr/share/man/man3/Compress::Zlib.3pm.gz /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/Compress/Zlib.pm /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/autosplit.ix /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.so /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.bsX' = X ']' + /usr/lib/rpm/find-debuginfo.sh /usr/src/redhat/BUILD/Compress-Zlib-1.33 extracting debug info from /var/tmp/perl-Compress-Zlib-1.33-2-root/usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/Zlib.so cpio: Compress-Zlib-1.33/: No such file or directory 723 blocks + /usr/lib/rpm/redhat/brp-compress + /usr/lib/rpm/redhat/brp-strip /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-static-archive /usr/bin/strip + /usr/lib/rpm/redhat/brp-strip-comment-note /usr/bin/strip /usr/bin/objdump Processing files: perl-Compress-Zlib-1.33-2 Provides: Zlib.so()(64bit) perl(Compress::Zlib) = 1.33 Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(VersionedDependencies) <= 3.0.3-1 Requires: libc.so.6()(64bit) libc.so.6(GLIBC_2.2.5)(64bit) perl >= 0:5.004 perl(AutoLoader) perl(Carp) perl(DynaLoader) perl(Exporter) perl(IO::Handle) perl(constant) perl(strict) perl(warnings) Processing files: perl-Compress-Zlib-debuginfo-1.33-2 Provides: Zlib.so.debug()(64bit) Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/perl-Compress-Zlib-1.33-2-root warning: Installed (but unpackaged) file(s) found: /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi/perllocal.pod /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi/auto/Compress/Zlib/.packlist Wrote: /usr/src/redhat/RPMS/x86_64/perl-Compress-Zlib-1.33-2.x86_64.rpm Wrote: /usr/src/redhat/RPMS/x86_64/perl-Compress-Zlib-debuginfo-1.33-2.x86_64.rpm Executing(%clean): /bin/sh -e /var/tmp/rpm-tmp.72190 + umask 022 + cd /usr/src/redhat/BUILD + cd Compress-Zlib-1.33 + rm -rf /var/tmp/perl-Compress-Zlib-1.33-2-root + exit 0 Executing(--clean): /bin/sh -e /var/tmp/rpm-tmp.72190 + umask 022 + cd /usr/src/redhat/BUILD + rm -rf Compress-Zlib-1.33 + exit 0 Do not worry too much about errors from the next command. It is quite likely that some of the Perl modules are already installed on your system. The important ones are HTML-Parser and MIME-tools. Preparing... (100%) # (100%) ## (100%) ### (100%) #### (100%) ##### (100%) ###### (100%) ####### (100%) ######## (100%) ######### (100%) ########## (100%) ########### (100%) ############ (100%) ############# (100%) ############## (100%) ############### (100%) ################ (100%) ################# (100%) ################## (100%) ################### (100%) #################### (100%) ##################### (100%) ###################### (100%) ####################### (100%) ######################## (100%) ######################### (100%) ########################## (100%) ########################### (100%) ############################ (100%) ############################# (100%) ############################## (100%) ############################### (100%) ################################ (100%) ################################# (100%) ################################## (100%) ################################### (100%) #################################### (100%) ##################################### (100%) ###################################### (100%) ################################ ####### (100%) ######################################## (100%) ######################################### (100%) ########################################## (100%) ########################################### (100%) ########################################### [100%] 1:perl-Compress-Zlib ( 20%) # ( 20%) ## ( 20%) ### ( 20%) #### ( 20%) ##### ( 20%) ###### ( 20%) ####### ( 20%) ######## ( 20%) ######### ( 61%) ########## ( 61%) ########### ( 61%) ############ ( 61%) ############# ( 61%) ############## ( 61%) ############### ( 61%) ################ ( 61%) ################# ( 61%) ################## ( 61%) ################### ( 61%) #################### ( 61%) ##################### ( 61%) ###################### ( 61%) ####################### ( 61%) ######################## ( 61%) ######################### ( 61%) ########################## ( 61%) ########################### ( 94%) ############################ ( 94%) ############################# ( 94%) ############################## ( 94%) ############################### ( 94%) ################################ ( 94%) ################################# ( 94%) ################################## ( 94%) ################################### ( 94%) #################################### ( 94%) ##################################### ( 94%) ###################################### ( 94%) ################################ ####### ( 94%) ######################################## ( 94%) ######################################### ( 94%) ########################################## (100%) ########################################### (100%) ########################################### [100%] Attempting to build and install perl-Archive-Zip-1.14-1 Installing perl-Archive-Zip-1.14-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.82128 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Archive-Zip-1.14 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Archive-Zip-1.14.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Archive-Zip-1.14 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.82128 + umask 022 + cd /usr/src/redhat/BUILD + cd Archive-Zip-1.14 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Archive-Zip-1.14-1-root/usr Checking if your kit is complete... Looks good Writing Makefile for Archive::Zip + make cp lib/Archive/Zip.pod blib/lib/Archive/Zip.pod cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm cp crc32 blib/script/crc32 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/crc32 Manifying blib/man3/Archive::Zip::Tree.3pm Manifying blib/man3/Archive::Zip.3pm Manifying blib/man3/Archive::Zip::FAQ.3pm Manifying blib/man3/Archive::Zip::MemberRead.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/test.............. t/test..............ok 1/123 t/test..............ok 2/123 t/test..............ok 3/123 t/test..............ok 4/123 t/test..............ok 5/123 t/test..............ok 6/123 t/test..............ok 7/123 t/test..............ok 8/123 t/test..............ok 9/123 t/test..............ok 10/123 t/test..............ok 11/123 t/test..............ok 12/123 t/test..............ok 13/123 t/test..............ok 14/123 t/test..............ok 15/123 t/test..............ok 16/123 t/test..............ok 17/123 t/test..............ok 18/123 t/test..............ok 19/123 t/test..............ok 20/123 t/test..............ok 21/123 t/test..............ok 22/123 t/test..............ok 23/123 t/test..............ok 24/123 t/test..............ok 25/123 t/test..............ok 26/123 t/test..............ok 27/123 t/test..............ok 28/123 t/test..............ok 29/123 t/test..............ok 30/123 t/test..............ok 31/123 t/test..............ok 32/123 t/test..............ok 33/123 t/test..............ok 34/123 t/test..............ok 35/123 t/test..............ok 36/123 t/test..............ok 37/123 t/test..............ok 38/123 t/test..............ok 39/123 t/test..............ok 40/123 t/test..............ok 41/123 t/test..............ok 42/123 t/test..............ok 43/123 t/test..............ok 44/123 t/test..............ok 45/123 t/test..............ok 46/123 t/test..............ok 47/123 t/test..............ok 48/123 t/test..............ok 49/123 t/test..............ok 50/123 t/test..............ok 51/123 t/test..............ok 52/123 t/test..............ok 53/123 t/test..............ok 54/123 t/test..............ok 55/123 t/test..............ok 56/123 t/test..............ok 57/123 t/test..............ok 58/123 t/test..............ok 59/123 t/test..............ok 60/123 t/test..............ok 61/123 t/test..............ok 62/123 t/test..............ok 63/123 t/test..............ok 64/123 t/test..............ok 65/123 t/test..............ok 66/123 t/test..............ok 67/123 t/test..............ok 68/123 t/test..............ok 69/123 t/test..............ok 70/123 t/test..............ok 71/123 t/test..............ok 72/123 t/test..............ok 73/123 t/test..............ok 74/123 t/test..............ok 75/123 t/test..............ok 76/123 t/test..............ok 77/123 t/test..............ok 78/123 t/test..............ok 79/123 t/test..............ok 80/123 t/test..............ok 81/123 t/test..............ok 82/123 t/test..............ok 83/123 t/test..............ok 84/123 t/test..............ok 85/123 t/test..............ok 86/123 t/test..............ok 87/123 t/test..............ok 88/123 t/test..............ok 89/123 t/test..............ok 90/123 t/test..............ok 91/123 t/test..............ok 92/123 t/test..............ok 93/123 t/test..............ok 94/123 t/test..............ok 95/123 t/test..............ok 96/123 t/test..............ok 97/123 t/test..............ok 98/123 t/test..............ok 99/123 t/test..............ok 100/123 t/test..............ok 101/123 t/test..............ok 102/123 t/test..............ok 103/123 t/test..............ok 104/123 t/test..............ok 105/123 t/test..............ok 106/123 t/test..............ok 107/123 t/test..............ok 108/123 t/test..............ok 109/123 t/test..............ok 110/123 t/test..............ok 111/123 t/test..............ok 112/123 t/test..............ok 113/123 t/test..............ok 114/123 t/test..............ok 115/123 t/test..............ok 116/123 t/test..............ok 117/123 t/test..............ok 118/123 t/test..............ok 119/123 t/test..............ok 120/123 t/test..............ok 121/123 t/test..............ok 122/123 t/test..............ok 123/123 t/test..............ok t/testex............ t/testex............NOK 1# Test 1 got: "256" (t/testex.t at line 37) # Expected: "0" # t/testex.t line 37 is: ok( runPerlCommand( 'examples/copy.pl', INPUTZIP, OUTPUTZIP ), 0 ); t/testex............NOK 2# Test 2 got: "256" (t/testex.t at line 39) # Expected: "0" # t/testex.t line 39 is: ok( runPerlCommand( 'examples/extract.pl', OUTPUTZIP, ZFILENAME ), 0 ); t/testex............NOK 3# Test 3 got: "256" (t/testex.t at line 41) # Expected: "0" # t/testex.t line 41 is: ok( runPerlCommand( 'examples/mfh.pl', INPUTZIP ), 0 ); t/testex............NOK 4# Test 4 got: "256" (t/testex.t at line 43) # Expected: "0" # t/testex.t line 43 is: ok( runPerlCommand( 'examples/zip.pl', OUTPUTZIP, INPUTZIP, FILENAME ), 0 ); t/testex............NOK 5# Test 5 got: "256" (t/testex.t at line 46) # Expected: "0" # t/testex.t line 46 is: ok( $status, 0 ); t/testex............NOK 6# Test 6 got: "256" (t/testex.t at line 51) # Expected: "0" # t/testex.t line 51 is: ok( $status, 0 ); t/testex............NOK 7# Test 7 got: "256" (t/testex.t at line 56) # Expected: "0" # t/testex.t line 56 is: ok( $status, 0 ); t/testex............NOK 8# Test 8 got: "" (t/testex.t at line 57) # Expected: "testdir/testing.txt:100\n" # t/testex.t line 57 is: ok( $output, ZFILENAME . ":100\n" ); t/testex............NOK 9# Test 9 got: "256" (t/testex.t at line 66) # Expected: "0" # t/testex.t line 66 is: ok( runPerlCommand( 'examples/selfex.pl', OUTPUTZIP, FILENAME ), 0 ); t/testex............NOK 10# Test 10 got: "256" (t/testex.t at line 68) # Expected: "0" # t/testex.t line 68 is: ok( runPerlCommand(OUTPUTZIP), 0 ); t/testex............NOK 11# Test 11 got: (t/testex.t at line 72) # Expected: "1" (extracted/testdir/testing.txt exists) # t/testex.t line 72 is: ok( -f $fn, 1, "$fn exists" ); t/testex............NOK 12# Test 12 got: "256" (t/testex.t at line 81) # Expected: "0" (updateTree.pl create) # t/testex.t line 81 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl create" ); t/testex............NOK 13# Test 13 got: (t/testex.t at line 82) # Expected: "1" (zip created) # t/testex.t line 82 is: ok( -f OUTPUTZIP, 1, "zip created" ); t/testex............NOK 14# Test 14 got: "256" (t/testex.t at line 83) # Expected: "0" (updateTree.pl update) # t/testex.t line 83 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl update" ); t/testex............NOK 15# Test 15 got: (t/testex.t at line 84) # Expected: "1" (zip updated) # t/testex.t line 84 is: ok( -f OUTPUTZIP, 1, "zip updated" ); t/testex............FAILED tests 1-15 Failed 15/15 tests, 0.00% okay t/testMemberRead.... t/testMemberRead....ok 1/7 t/testMemberRead....ok 2/7 t/testMemberRead....ok 3/7 t/testMemberRead....ok 4/7 t/testMemberRead....ok 5/7 t/testMemberRead....ok 6/7 t/testMemberRead....ok 7/7 t/testMemberRead....ok t/testTree.......... t/testTree..........ok 1/6 t/testTree..........ok 2/6 t/testTree..........ok 3/6 t/testTree..........ok 4/6 t/testTree..........ok 5/6 t/testTree..........ok 6/6 t/testTree..........ok t/testUpdate........ t/testUpdate........ok 1/12 t/testUpdate........ok 2/12 t/testUpdate........ok 3/12 t/testUpdate........ok 4/12 t/testUpdate........ok 5/12 t/testUpdate........ok 6/12 t/testUpdate........ok 7/12 t/testUpdate........ok 8/12 t/testUpdate........ok 9/12 t/testUpdate........ok 10/12 t/testUpdate........ok 11/12 t/testUpdate........ok 12/12 t/testUpdate........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/testex.t 15 15 100.00% 1-15 Failed 1/5 test scripts, 80.00% okay. 15/163 subtests failed, 90.80% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.82128 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.82128 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.14-1.noarch.rpm. Maybe it did not build correctly? Installing tnef decoder ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2: "Attached Text" ] Attempting to build and install perl-Archive-Zip-1.14-1 Installing perl-Archive-Zip-1.14-1.src.rpm Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.85538 + umask 022 + cd /usr/src/redhat/BUILD + LANG=C + export LANG + unset DISPLAY + cd /usr/src/redhat/BUILD + rm -rf Archive-Zip-1.14 + /usr/bin/gzip -dc /usr/src/redhat/SOURCES/Archive-Zip-1.14.tar.gz + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd Archive-Zip-1.14 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.59067 + umask 022 + cd /usr/src/redhat/BUILD + cd Archive-Zip-1.14 + LANG=C + export LANG + unset DISPLAY + CFLAGS='-O2 -g -pipe -m64' + perl Makefile.PL PREFIX=/var/tmp/perl-Archive-Zip-1.14-1-root/usr Checking if your kit is complete... Looks good Writing Makefile for Archive::Zip + make cp lib/Archive/Zip.pod blib/lib/Archive/Zip.pod cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm cp crc32 blib/script/crc32 /usr/bin/perl "-MExtUtils::MY" -e "MY->fixin(shift)" blib/script/crc32 Manifying blib/man3/Archive::Zip::Tree.3pm Manifying blib/man3/Archive::Zip.3pm Manifying blib/man3/Archive::Zip::FAQ.3pm Manifying blib/man3/Archive::Zip::MemberRead.3pm + make test PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/test.............. t/test..............ok 1/123 t/test..............ok 2/123 t/test..............ok 3/123 t/test..............ok 4/123 t/test..............ok 5/123 t/test..............ok 6/123 t/test..............ok 7/123 t/test..............ok 8/123 t/test..............ok 9/123 t/test..............ok 10/123 t/test..............ok 11/123 t/test..............ok 12/123 t/test..............ok 13/123 t/test..............ok 14/123 t/test..............ok 15/123 t/test..............ok 16/123 t/test..............ok 17/123 t/test..............ok 18/123 t/test..............ok 19/123 t/test..............ok 20/123 t/test..............ok 21/123 t/test..............ok 22/123 t/test..............ok 23/123 t/test..............ok 24/123 t/test..............ok 25/123 t/test..............ok 26/123 t/test..............ok 27/123 t/test..............ok 28/123 t/test..............ok 29/123 t/test..............ok 30/123 t/test..............ok 31/123 t/test..............ok 32/123 t/test..............ok 33/123 t/test..............ok 34/123 t/test..............ok 35/123 t/test..............ok 36/123 t/test..............ok 37/123 t/test..............ok 38/123 t/test..............ok 39/123 t/test..............ok 40/123 t/test..............ok 41/123 t/test..............ok 42/123 t/test..............ok 43/123 t/test..............ok 44/123 t/test..............ok 45/123 t/test..............ok 46/123 t/test..............ok 47/123 t/test..............ok 48/123 t/test..............ok 49/123 t/test..............ok 50/123 t/test..............ok 51/123 t/test..............ok 52/123 t/test..............ok 53/123 t/test..............ok 54/123 t/test..............ok 55/123 t/test..............ok 56/123 t/test..............ok 57/123 t/test..............ok 58/123 t/test..............ok 59/123 t/test..............ok 60/123 t/test..............ok 61/123 t/test..............ok 62/123 t/test..............ok 63/123 t/test..............ok 64/123 t/test..............ok 65/123 t/test..............ok 66/123 t/test..............ok 67/123 t/test..............ok 68/123 t/test..............ok 69/123 t/test..............ok 70/123 t/test..............ok 71/123 t/test..............ok 72/123 t/test..............ok 73/123 t/test..............ok 74/123 t/test..............ok 75/123 t/test..............ok 76/123 t/test..............ok 77/123 t/test..............ok 78/123 t/test..............ok 79/123 t/test..............ok 80/123 t/test..............ok 81/123 t/test..............ok 82/123 t/test..............ok 83/123 t/test..............ok 84/123 t/test..............ok 85/123 t/test..............ok 86/123 t/test..............ok 87/123 t/test..............ok 88/123 t/test..............ok 89/123 t/test..............ok 90/123 t/test..............ok 91/123 t/test..............ok 92/123 t/test..............ok 93/123 t/test..............ok 94/123 t/test..............ok 95/123 t/test..............ok 96/123 t/test..............ok 97/123 t/test..............ok 98/123 t/test..............ok 99/123 t/test..............ok 100/123 t/test..............ok 101/123 t/test..............ok 102/123 t/test..............ok 103/123 t/test..............ok 104/123 t/test..............ok 105/123 t/test..............ok 106/123 t/test..............ok 107/123 t/test..............ok 108/123 t/test..............ok 109/123 t/test..............ok 110/123 t/test..............ok 111/123 t/test..............ok 112/123 t/test..............ok 113/123 t/test..............ok 114/123 t/test..............ok 115/123 t/test..............ok 116/123 t/test..............ok 117/123 t/test..............ok 118/123 t/test..............ok 119/123 t/test..............ok 120/123 t/test..............ok 121/123 t/test..............ok 122/123 t/test..............ok 123/123 t/test..............ok t/testex............ t/testex............NOK 1# Test 1 got: "256" (t/testex.t at line 37) # Expected: "0" # t/testex.t line 37 is: ok( runPerlCommand( 'examples/copy.pl', INPUTZIP, OUTPUTZIP ), 0 ); t/testex............NOK 2# Test 2 got: "256" (t/testex.t at line 39) # Expected: "0" # t/testex.t line 39 is: ok( runPerlCommand( 'examples/extract.pl', OUTPUTZIP, ZFILENAME ), 0 ); t/testex............NOK 3# Test 3 got: "256" (t/testex.t at line 41) # Expected: "0" # t/testex.t line 41 is: ok( runPerlCommand( 'examples/mfh.pl', INPUTZIP ), 0 ); t/testex............NOK 4# Test 4 got: "256" (t/testex.t at line 43) # Expected: "0" # t/testex.t line 43 is: ok( runPerlCommand( 'examples/zip.pl', OUTPUTZIP, INPUTZIP, FILENAME ), 0 ); t/testex............NOK 5# Test 5 got: "256" (t/testex.t at line 46) # Expected: "0" # t/testex.t line 46 is: ok( $status, 0 ); t/testex............NOK 6# Test 6 got: "256" (t/testex.t at line 51) # Expected: "0" # t/testex.t line 51 is: ok( $status, 0 ); t/testex............NOK 7# Test 7 got: "256" (t/testex.t at line 56) # Expected: "0" # t/testex.t line 56 is: ok( $status, 0 ); t/testex............NOK 8# Test 8 got: "" (t/testex.t at line 57) # Expected: "testdir/testing.txt:100\n" # t/testex.t line 57 is: ok( $output, ZFILENAME . ":100\n" ); t/testex............NOK 9# Test 9 got: "256" (t/testex.t at line 66) # Expected: "0" # t/testex.t line 66 is: ok( runPerlCommand( 'examples/selfex.pl', OUTPUTZIP, FILENAME ), 0 ); t/testex............NOK 10# Test 10 got: "256" (t/testex.t at line 68) # Expected: "0" # t/testex.t line 68 is: ok( runPerlCommand(OUTPUTZIP), 0 ); t/testex............NOK 11# Test 11 got: (t/testex.t at line 72) # Expected: "1" (extracted/testdir/testing.txt exists) # t/testex.t line 72 is: ok( -f $fn, 1, "$fn exists" ); t/testex............NOK 12# Test 12 got: "256" (t/testex.t at line 81) # Expected: "0" (updateTree.pl create) # t/testex.t line 81 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl create" ); t/testex............NOK 13# Test 13 got: (t/testex.t at line 82) # Expected: "1" (zip created) # t/testex.t line 82 is: ok( -f OUTPUTZIP, 1, "zip created" ); t/testex............NOK 14# Test 14 got: "256" (t/testex.t at line 83) # Expected: "0" (updateTree.pl update) # t/testex.t line 83 is: ok( runPerlCommand( 'examples/updateTree.pl', OUTPUTZIP, TESTDIR ), 0, "updateTree.pl update" ); t/testex............NOK 15# Test 15 got: (t/testex.t at line 84) # Expected: "1" (zip updated) # t/testex.t line 84 is: ok( -f OUTPUTZIP, 1, "zip updated" ); t/testex............FAILED tests 1-15 Failed 15/15 tests, 0.00% okay t/testMemberRead.... t/testMemberRead....ok 1/7 t/testMemberRead....ok 2/7 t/testMemberRead....ok 3/7 t/testMemberRead....ok 4/7 t/testMemberRead....ok 5/7 t/testMemberRead....ok 6/7 t/testMemberRead....ok 7/7 t/testMemberRead....ok t/testTree.......... t/testTree..........ok 1/6 t/testTree..........ok 2/6 t/testTree..........ok 3/6 t/testTree..........ok 4/6 t/testTree..........ok 5/6 t/testTree..........ok 6/6 t/testTree..........ok t/testUpdate........ t/testUpdate........ok 1/12 t/testUpdate........ok 2/12 t/testUpdate........ok 3/12 t/testUpdate........ok 4/12 t/testUpdate........ok 5/12 t/testUpdate........ok 6/12 t/testUpdate........ok 7/12 t/testUpdate........ok 8/12 t/testUpdate........ok 9/12 t/testUpdate........ok 10/12 t/testUpdate........ok 11/12 t/testUpdate........ok 12/12 t/testUpdate........ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/testex.t 15 15 100.00% 1-15 Failed 1/5 test scripts, 80.00% okay. 15/163 subtests failed, 90.80% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.59067 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.59067 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-Archive-Zip-1.14-1.noarch.rpm. Maybe it did not build correctly? *************************************************** [root@skywalker init.d]# ./MailScanner start Starting MailScanner daemons: incoming sendmail: [ OK ] outgoing sendmail: [ OK ] MailScanner: Can't locate Archive/Zip.pm in @INC (@INC contains: /usr/lib/MailScanner /usr/lib64/perl5/5.8.5/x86_64-linux-thread-multi /usr/lib/perl5/5.8.5 /usr/lib64/perl5/site_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/site_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/site_perl/5.8.5 /usr/lib/perl5/site_perl/5.8.4 /usr/lib/perl5/site_perl/5.8.3 /usr/lib/perl5/site_perl/5.8.2 /usr/lib/perl5/site_perl/5.8.1 /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib64/perl5/vendor_perl/5.8.5/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.4/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.3/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.2/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.1/x86_64-linux-thread-multi /usr/lib64/perl5/vendor_perl/5.8.0/x86_64-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.5 /usr/lib/perl5/vendor_perl/5.8.4 /usr/lib/perl5/vendor_perl/5.8.3 /usr/lib/perl5/vendor_perl/5.8.2 /usr/lib/perl5/vendor_perl/5.8.1 /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl . /usr/lib/MailScanner/5.8.5/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.5 /usr/lib/MailScanner/x86_64-linux-thread-multi /usr/lib/MailScanner/5.8.4 /usr/lib/MailScanner/5.8.3 /usr/lib/MailScanner/5.8.2 /usr/lib/MailScanner/5.8.1 /usr/lib/MailScanner/5.8.0 /usr/lib/MailScanner) at /usr/lib/MailScanner/MailScanner/Message.pm line 47. BEGIN failed--compilation aborted at /usr/lib/MailScanner/MailScanner/Message.pm line 47. Compilation failed in require at /usr/sbin/MailScanner line 74. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 74. [ OK ] ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 26 08:53:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:23 2006 Subject: Fw: Stop inbound Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] A message came in which contained archives that were nested (i.e. one archive within another archive within another....) beyond your "Maximum Archive Depth" setting. Suporte SETi wrote: > What is: > > > "MailScanner: Message contained archive nested too deeply" > > > > > Thanks > > > > -------------------------------------------------------------------- > Esta mensagem foi verificada pelo sistema de anti-vírus e anti-spam. > Seti Segurança e Tecnologia na Internet - suporte@setinet.com.br > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From R.A.Gardener at SHU.AC.UK Tue Apr 26 09:53:27 2005 From: R.A.Gardener at SHU.AC.UK (Ray Gardener) Date: Thu Jan 12 21:29:23 2006 Subject: sophossavi errors on Red Hat Enterprise version 4 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I recently upgraded one of my servers to RHEL version 4. After bringing this into use I noticed a problem with load on the server going up dramatically. On inspection I saw a mailscanner process consuming 1.4GB of memory. This was causing the system to page memory frantically!!!. Looking in the log files I saw indications that sophossavi was seeing some of the mail as a denial of service attack and noticed that certain files from my incoming spool file were not been processed. However some of the files were been processed. I switched the scanner type from sophossavi to sophos and these files were cleared and the problems with memory and load haven't reoccurred. Thinking that there was some problem with Savi-Perl I downloaded the latest version and recompiled it. It ran make OK; but on "make test" I got the following message below. [At the end of this message are the details of my system and version of mailscanner] Obviously I am OK using sophos but would like sophossavi to work - Has anyone got this working under RHEL 4 or had similar problem (with hopefully a fix)? _________________________________________________________________________ PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t t/use....Can't load '/home/cisrag/SAVI-Perl-0.30/blib/arch/auto/SAVI/SAVI.so' for module SAVI: libsavi.so.3: cannot open shared object file: No such file or directory at /usr/lib/perl5/5.8.5/i386-linux-thread-multi/DynaLoader.pm line 230. at t/use.t line 8 Compilation failed in require at t/use.t line 8. BEGIN failed--compilation aborted at t/use.t line 8. t/use....dubious Test returned status 255 (wstat 65280, 0xff00) DIED. FAILED test 1 Failed 1/1 tests, 0.00% okay Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/use.t 255 65280 1 2 200.00% 1 Failed 1/1 test scripts, 0.00% okay. 1/1 subtests failed, 0.00% okay. ------------------------------------------------------------------------- System details uname -a Linux coffee.shu.ac.uk 2.6.9-5.0.5.ELsmp #1 SMP Fri Apr 8 14:29:47 EDT 2005 i686 i686 i386 GNU/Linux 2Gb memory dual Xeon system Running Red hat Enterprise Edition version 4 MailScanner version is 4.40.11 -- Ray Gardener CIS Sheffield Hallam University Telephone: 0114 225 4926 Email: R.A.Gardener@shu.ac.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From oger at SGSI.UCL.AC.BE Tue Apr 26 09:45:53 2005 From: oger at SGSI.UCL.AC.BE (Fred. Oger) Date: Thu Jan 12 21:29:23 2006 Subject: Quarantine queue format Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I have a Mailscanner-4.38-10-1 running version over postfix with spam / viruses quarantined. How can I resend the quanrantined files ? Here my mailscanner.conf pertinent part : Quarantine Dir = /var/spool/MailScanner/quarantine MTA = postfix Quarantine Whole Message = yes Quarantine Whole Messages As Queue Files = yes My problem is the file stored in the quarantine folder aren't in the format described in the doc. eg: # ls -l /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F -rw------- 1 postfix postfix 14768 Apr 26 05:20 F29183F8 -rw------- 1 postfix postfix 11930 Apr 26 05:20 msg-10453-17.html So how can I resend this mail to the user ? Regards, Fred. Oger ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.6KB. ] [ Unable to print this part. ] From dh at UPTIME.AT Tue Apr 26 14:33:34 2005 From: dh at UPTIME.AT ([ISO-8859-1] David Höhn) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Ed Bruce wrote: THis is a bad idea. Why? You _will_ poisin your bayes database. Your Companies MX has a very specific way it deals with email and as such it most likely will be targeted by a particular "flavour" of spam. Depending on your employees preferences and so on. My advice, always, do NOT do that. test this out before pointing our company's MX > record to this box. I have a test domain pointing to this MTA. > What do you need to test? That is the main question. That yoursetup works? That MailScanner + Spamassassin works? Because thet is something thousands of others have already tested for you :) - -d - -- nee anata wo mitsukete soshite nidoto wasurezu donna ni munega itakutemo soba ni iru no zutto...zutto...zutto Key fingerprint = FD77 F0B7 5C65 F546 EB08 A4EC 3CCA 1A32 7E24 291E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (Darwin) iD8DBQFCbkMuPMoaMn4kKR4RA60BAJ9iX3iooZNqxlVaWzqjLpvZ9F65ZwCeMbBY OqYe5l44cxWFWEtkht6Y7HM= =IOkD -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Apr 26 14:28:30 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Strange request but I've finally got a new install of MailScanner working on a new system. I want to test it out and need to get lots of email and SPAM. Any suggestions for high volume mailing lists? Any known particularly bad places to register your email, knowning you will quickly start getting spammed? I've copied the bayes from the old system, I've upgraded to Postfix 2.2, now using MailScanner 4.40.11, etc. and really want to test this out before pointing our company's MX record to this box. I have a test domain pointing to this MTA. thanks, Ed -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mike at CAMAROSS.NET Tue Apr 26 14:34:33 2005 From: mike at CAMAROSS.NET (Mike Kercher) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: Ed Bruce <> scribbled on Tuesday, April 26, 2005 8:29 AM: > Strange request but I've finally got a new install of MailScanner > working on a new system. I want to test it out and need to get lots > of email and SPAM. Any suggestions for high volume mailing lists? Any > known particularly bad places to register your email, knowning you > will quickly start getting spammed? I've copied the bayes from the > old system, I've upgraded to Postfix 2.2, now using MailScanner > 4.40.11, etc. and really want to test this out before pointing our > company's MX record to this box. I have a test domain pointing to > this MTA. > > thanks, > Ed Start here...you'll get spammed! http://www.bizrate.com/mkt.xpml?eml_id=121233&cs_id=6154307 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From campbell at cnpapers.com Tue Apr 26 14:49:19 2005 From: campbell at cnpapers.com (Steve Campbell) Date: Thu Jan 12 21:29:23 2006 Subject: OT - Help needed with Header interpretation Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I work at a newspaper. We have stringent deadlines to follow here, and allow ads to be emailed to some of our clerks for submission. We have one customer who insists they are sending emails containing ads 3 days before we received them, which means they are past deadline upon their arrival here. I have looked at all of our maillogs to view the envelopes and reviewed each header of any of this customer's emails, and the headers show what appears to be, at most, a twenty second delay from the earliest time in the header until delivery. Some have multiple relays, all of which follow the time line. Unless they are being queued somewhere at their site, can someone verify to me that the earliest date in a header is, in fact, the time that the email was sent from their client - Or maybe give me some reason to believe this customer? I realize that machine clocks may be different, but 3 days is a little unreasonable. This is not any type of legal matter here, and no one will be held responsible for their responses, so please feel free to express your opinions. Thanks for any input, postive or negative. Steve Campbell campbell@cnpapers.com Charleston Newspapers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Apr 26 14:51:44 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Höhn wrote: > Ed Bruce wrote: > > > THis is a bad idea. > Why? > You _will_ poisin your bayes database. Your Companies MX has a very > specific way it deals with email and as such it most likely will be > targeted by a particular "flavour" of spam. Depending on your employees > preferences and so on. My advice, always, do NOT do that. > > test this out before pointing our company's MX > > >record to this box. I have a test domain pointing to this MTA. > > What do you need to test? That is the main question. That yoursetup > works? That MailScanner + Spamassassin works? Because thet is something > thousands of others have already tested for you :) > > -d > > -- > nee anata wo mitsukete soshite nidoto wasurezu > donna ni munega itakutemo soba ni iru no > zutto...zutto...zutto > Key fingerprint = FD77 F0B7 5C65 F546 EB08 A4EC 3CCA 1A32 7E24 291E I am using a test domain that will get dropped once we go live. Once we go live I will then get a copy of the "good" bayes database from our current system. I know that MailScanner works once it is configured correctly and thats the rub. I won't know that I've made a mistake until the spam starts slipping by the checks and I've got a CEO that breathes fire when he gets even one spam email and everytime I've upgraded MailScanner something has broken, usually my fault but not always, and lots of spam gets past MailScanner and the CEO goes ballistic. So MailScanner works, yes, but only if every single piece of it is configured correctly. I just spent my morning trying to figure out why email wasn't being scanned for spam and virii. Well I had forgot to uncomment the header_checks line in main.cf. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Apr 26 14:59:30 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks, I know that avoiding getting on spammers lists is best, but we've got people here that seem to attract spam likes flies to rotten fruit. I cut down our spam by 50% by changing one user's email address and blocking the old address at the MTA. We went from 1000 spam emails/day to 500 because of that one change. Mike Kercher wrote: >Ed Bruce <> scribbled on Tuesday, April 26, 2005 8:29 AM: > > > >>Strange request but I've finally got a new install of MailScanner >>working on a new system. I want to test it out and need to get lots >>of email and SPAM. Any suggestions for high volume mailing lists? Any >>known particularly bad places to register your email, knowning you >>will quickly start getting spammed? I've copied the bayes from the >>old system, I've upgraded to Postfix 2.2, now using MailScanner >>4.40.11, etc. and really want to test this out before pointing our >>company's MX record to this box. I have a test domain pointing to >>this MTA. >> >>thanks, >>Ed >> >> > >Start here...you'll get spammed! > >http://www.bizrate.com/mkt.xpml?eml_id=121233&cs_id=6154307 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ebruce at HPMICH.COM Tue Apr 26 15:20:04 2005 From: ebruce at HPMICH.COM (Ed Bruce) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Mike Kercher wrote: > > >Start here...you'll get spammed! > >http://www.bizrate.com/mkt.xpml?eml_id=121233&cs_id=6154307 > > > Perfect just got my first spam message already :) and it wasn't caught. -- This message has been scanned for viruses and dangerous content by Secure Resource, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 26 16:37:02 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] David Höhn wrote: > Ed Bruce wrote: > > > THis is a bad idea. > Why? > You _will_ poisin your bayes database. Your Companies MX has a very > specific way it deals with email and as such it most likely will be > targeted by a particular "flavour" of spam. Depending on your employees > preferences and so on. My advice, always, do NOT do that. > > test this out before pointing our company's MX Bah. That's completely bogus. While this argument is VERY true for ham, it's completely NOT true for spam. I forward the following statements as fundamental truths of spam 1) spam is high volume, thus any given message reaches a large number of people. 2) In order to increase volume, most spam is indiscriminate, and sent to as many addresses as possible. 3) Since most spam is indiscriminate, most flavors of spam do not have a "target" audience other than "everyone". 4) Also since spam is indiscriminate, spammers resell their lists to each other. If you are targeted by any spammers at all, you will eventually be targeted by them all. Thus, over time, we are all targeted by the same indiscriminate spammers. My spam looks very much like yours Dan. I get the same basic mix of 419, drugs, porn, "get a free gadget", refinance, lottery, watch replica, and "recent tragedy memorial coin" spams as everyone else. Sure there's some small variance in the rare oddities. I get the occasional oddball spam offering custom machined steel parts, custom cast glass, custom cut lithium copper foil, etc. However, these differences between the spam profile of any two people are very small. These differences are certainly not even remotely significant enough to cause bayes poisoning. In order to do that, I'd have to get a significant number of spams which very closely resemble your nonspam. That's highly unlikely. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dh at UPTIME.AT Tue Apr 26 16:46:20 2005 From: dh at UPTIME.AT (David H.) Date: Thu Jan 12 21:29:23 2006 Subject: [OT] Bogus? Discuss it properly was(Re: Any suggestions to get spammed) Message-ID: [ The following text is in the "UTF-8" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Matt Kettler wrote: > David Höhn wrote: > > >>Ed Bruce wrote: >> >> >>THis is a bad idea. >>Why? >>You _will_ poisin your bayes database. Your Companies MX has a very >>specific way it deals with email and as such it most likely will be >>targeted by a particular "flavour" of spam. Depending on your employees >>preferences and so on. My advice, always, do NOT do that. >> >>test this out before pointing our company's MX > > > > Bah. That's completely bogus. > Well if it is, then show me empirical proof. We have tested numerous runs for big customers and form them it is true. > While this argument is VERY true for ham, it's completely NOT true for spam. > It seems to be true here. Maybe because the number of employees or "receivers" is very high and rather diverse. > I forward the following statements as fundamental truths of spam > > 1) spam is high volume, thus any given message reaches a large number of > people. Not necessarily true. It is unlikely that German SPAM reaches a large number of US citizens. There _are_ Spammers that operate locally. > 2) In order to increase volume, most spam is indiscriminate, and sent to > as many addresses as possible. See above. That might be true for a lot of simple spammer schemes, but "professionals" tend to be more selective. Simply because that means more money. > 3) Since most spam is indiscriminate, most flavors of spam do not have a > "target" audience other than "everyone". Well I cannotr quite follow that statement at all. But as I said, I am very well willing to discuss this off list. Once more, it is an observation, _I_ have made and that is how I stated it. I would appreciate it, if that isn't simply disregarded as "bogus" without proper discussion. Thank you :) - -d -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.3.6 (Darwin) iD8DBQFCbmJMPMoaMn4kKR4RAiw6AJ97Qa9LSDKiEQDD6QwZb0KdfFxikwCfZftd /yiVSoV5mpMeeigomaBAlq0= =CmHx -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 26 17:00:07 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:23 2006 Subject: [OT] Bogus? Discuss it properly was(Re: Any suggestions to get spammed) Message-ID: David H. wrote: >>I forward the following statements as fundamental truths of spam >> >>1) spam is high volume, thus any given message reaches a large number of >>people. > > Not necessarily true. It is unlikely that German SPAM reaches a large number > of US citizens. There _are_ Spammers that operate locally. > > Lots of people got the NAZI spam around 1 year ago, possibly the exception that proves the rule. BUT it's a shame it doesn't work the other around, ie .co.uk .fr etc domains getting spammed about US only credit/mortgate 'deals'. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Tue Apr 26 17:01:37 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:23 2006 Subject: sophossavi errors on Red Hat Enterprise version 4 Message-ID: Ray from my misty memory I remember Julian (or someone) commenting on this and finding out that Sophos themselves have a problem with 64bit Linux kernels, and are working to fox it sometime. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Ray Gardener wrote: > Hi, > > I recently upgraded one of my servers to RHEL version 4. After bringing > this into use I noticed a problem with load on the server going up > dramatically. On inspection I saw a mailscanner process consuming 1.4GB of > memory. This was causing the system to page memory frantically!!!. > Looking in the log files I saw indications that sophossavi was seeing some > of the mail as a denial of service attack and noticed that certain files > from my incoming spool file were not been processed. However some of the > files were been processed. I switched the scanner type from sophossavi to > sophos and these files were cleared and the problems with memory and load > haven't reoccurred. Thinking that there was some problem with Savi-Perl I > downloaded the latest version and recompiled it. It ran make OK; but on > "make test" I got the following message below. [At the end of this message > are the details of my system and version of mailscanner] Obviously I am OK > using sophos but would like sophossavi to work - Has anyone got this > working under RHEL 4 or had similar problem (with hopefully a fix)? > > _________________________________________________________________________ > PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" > "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t > t/use....Can't load > '/home/cisrag/SAVI-Perl-0.30/blib/arch/auto/SAVI/SAVI.so' for module SAVI: > libsavi.so.3: cannot open shared object file: No such file or directory at > /usr/lib/perl5/5.8.5/i386-linux-thread-multi/DynaLoader.pm line 230. > at t/use.t line 8 > Compilation failed in require at t/use.t line 8. > BEGIN failed--compilation aborted at t/use.t line 8. > t/use....dubious > Test returned status 255 (wstat 65280, 0xff00) > DIED. FAILED test 1 > Failed 1/1 tests, 0.00% okay > Failed Test Stat Wstat Total Fail Failed List of Failed > ------------------------------------------------------------------------------- > t/use.t 255 65280 1 2 200.00% 1 > Failed 1/1 test scripts, 0.00% okay. 1/1 subtests failed, 0.00% okay. > ------------------------------------------------------------------------- > > System details > uname -a > Linux coffee.shu.ac.uk 2.6.9-5.0.5.ELsmp #1 SMP Fri Apr 8 14:29:47 EDT > 2005 i686 i686 i386 GNU/Linux > 2Gb memory dual Xeon system > Running Red hat Enterprise Edition version 4 > > MailScanner version is 4.40.11 > > > -- > Ray Gardener > CIS > Sheffield Hallam University > Telephone: 0114 225 4926 > Email: R.A.Gardener@shu.ac.uk > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Tue Apr 26 17:10:34 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ed Bruce wrote: > Thanks, I know that avoiding getting on spammers lists is best, but > we've got people here that seem to attract spam likes flies to rotten > fruit. I cut down our spam by 50% by changing one user's email address > and blocking the old address at the MTA. We went from 1000 spam > emails/day to 500 because of that one change. > But if you don't SPANK that user, he/she will just get back up to speed in a month or so. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Tue Apr 26 18:21:23 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:23 2006 Subject: {SPAM} MailScanner - Content Filtering Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Daniel Straka wrote: >I keep getting the following POS message delivered to our domain. Must >be too new for the MS blacklist filters and the reply-to field is always >spoofed and changing, worst of all its cc'd to bunches of users so even >if only a few get through MS, they end-up delivered to hundreds of >mailboxes. > >Ideally, I'd like to do content filtering on "over $380,000 for" and >delete them. Is there anyway for MS to do this? > > If you're using SpamAssassin it's easy. Body rules are just simple regular expressions: body L_OVER_380K /\bover \$380\,000 for\b/i score L_OVER_380K 5.0 You can add it to a .cf file in /etc/mail/spamassassin, or append it to spam.assassin.prefs.conf. (spam.assassin.prefs.conf should allow this, as it's only a privileged option, not an administrator option) ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Tue Apr 26 18:53:37 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:23 2006 Subject: Rules du jour troubles Message-ID: Matt Kettler wrote: > In more detail, you'll want to take these steps. > 1) update your RDJ config file to reflect the new name. Find the > reference to 70_sare_evilnum.cf and add the 0 to it's name. > 2) cd /etc/mail/spamassassin > 3) wget http://www.rulesemporium.com/rules/70_sare_evilnum0.cf > 4) rm 70_sare_evilnum.cf Well, some things changed in RDJ. I was getting similar messages for some time and was confused by them too. The error message said to change the "language files". Didn't have any, so I left it alone and after a week or so that particular message stopped. I got curious this morning though so started looking closer and noticed that there's a newer version of rules_du_jur out than I was running and now instead of rules_du_jur and my_rules_du_jur in /root/bin, the new system wants a config file in /etc/rulesdujour. Also said my_rules_du_jour is deprecated. So I started updating my system, but am confused a little. Some places on the web site indicate to configure everything in the script, and others say to use a config file. Here's what I've done so far: 1: copied latest rules_du_jour to /root/bin/ 2: created the /etc/rulesdujour directory 3: copied the rules_du_jur script there as a starting point, renaming it config. 4: Deleted everything before the line: TRUSTED_RULESETS="TRIPWIRE EVILNUMBERS SARE_RANDOM"; (That's the default list - I did modify a bit, to taste). It's not entirely clear what else goes in there. There's the "Rules File Registry" section in the script. I think that should go in the config file but am not sure. If it's in the config file, does it also remain in the script? Seems that would be a hassle to have to update it in two places. Same with the "Local Settings" section. Does that go in both the script and config file? The web page (http://www.exit0.us/index.php?pagename=RulesDuJourRuleSets) sats: "Note: To those wishing to add these rulesets to your local installation of RulesDuJour: copy and paste the ruleset information you wish to install into the rules_du_jour script between "Begin Rules File Registry" and "End Rules File Registry". Then add the rule name (eg: TRIPWIRE) to the TRUSTED_RULESETS configuration line." So that says put 'em in the script, but I'd think they'd go in the config file. Also, the script says to "Configure Local settings in your config file" while http://www.exit0.us/index.php?pagename=RulesDuJour says this: "Configure RulesDuJour local settings (SA_DIR, MAIL_ADDRESS, SA_RESTART in the script)" So where are they configured? Both places? Do I need to update both when new rulesets come out, or just the config file? Does one update the TRUSTED_RULESETS line in both the script and the config file too? So it sounds like RDJ is in a state of upgrade flux. Sorry if this is getting too off topic but I'm sure many MailScanner users are also using RDJ and would appreciate a clarification. Or maybe I'm the only dummy here. Does anybody have a generic config file and script that they could share showing exactly what needs to be in each file? TIA... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mikes at HARTWELLCORP.COM Tue Apr 26 19:03:49 2005 From: mikes at HARTWELLCORP.COM (Michael St. Laurent) Date: Thu Jan 12 21:29:23 2006 Subject: Any suggestions to get spammed Message-ID: Ed Bruce <> wrote: > Strange request but I've finally got a new install of MailScanner > working on a new system. I want to test it out and need to get lots of > email and SPAM. Any suggestions for high volume mailing lists? Any > known particularly bad places to register your email, knowning you > will quickly start getting spammed? I've copied the bayes from the old > system, I've upgraded to Postfix 2.2, now using MailScanner 4.40.11, > etc. and really want to test this out before pointing our company's MX > record to this box. I have a test domain pointing to this MTA. Go to Google and post something to Usenet that has your email address in it. -- Michael St. Laurent Hartwell Corporation ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Tue Apr 26 20:49:41 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:29:23 2006 Subject: New on Redhat 9 (problems) Message-ID: Perl Version 5.8.5 Redhat 9 Mailscanner 4.40.11 I'm performing a fresh install of Mailscanner on a Redhat 9 box and am getting the following errors when running the ./install.sh ignore-perl script. I’ve installed on FreeBSD before, but this is my first run at it on a Linux system. I’ve installed all of the perl modules listed below using CPAN so I’m stumped. Thanks for the help, -Brendna First errors… t/getdate....ok 114/128Confused test output: test 114 answered after test 118 t/getdate....ok 115/128Confused test output: test 115 answered after test 119 t/getdate....ok 116/128Confused test output: test 116 answered after test 120 t/getdate....ok 117/128Confused test output: test 117 answered after test 121 t/getdate....ok 118/128Confused test output: test 118 answered after test 122 t/getdate....ok 119/128Confused test output: test 119 answered after test 123 t/getdate....ok 120/128Confused test output: test 120 answered after test 124 t/getdate....ok 121/128Confused test output: test 121 answered after test 125 t/getdate....ok 122/128Confused test output: test 122 answered after test 126 t/getdate....ok 123/128Confused test output: test 123 answered after test 127 t/getdate....FAILED tests 1-5 Failed 5/128 tests, 96.09% okay t/lang.......ok Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/date.t 123 123 100.00% 1-123 t/format.t 150 18 12.00% 8-9 25 28-29 34 58-59 75 78-79 84 108-109 125 128-129 134 t/getdate.t 128 5 3.91% 1-5 Failed 3/4 test scripts, 25.00% okay. 146/404 subtests failed, 63.86% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.94578 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. Maybe it did not build correctly? Then error: Failed dependencies: perl(Date::Format) is needed by perl-MailTools-1.50-1 perl(Date::Parse) is needed by perl-MailTools-1.50-1 And error: Failed dependencies: perl(Mail::Field) is needed by perl-MIME-tools-5.417-1 perl(Mail::Field) >= 1.05 is needed by perl-MIME-tools-5.417-1 perl(Mail::Header) >= 1.06 is needed by perl-MIME-tools-5.417-1 perl(Mail::Internet) >= 1.28 is needed by perl-MIME-tools-5.417-1 perl-MailTools is needed by perl-MIME-tools-5.417-1 Then error: Failed dependencies: perl(MIME::Body) is needed by perl-Convert-TNEF-0.17-1 And Finally: error: Failed dependencies: perl-MIME-tools >= 5.412 is needed by mailscanner-4.40.11-1 Thanks again, -Brendan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Tue Apr 26 20:55:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:23 2006 Subject: New on Redhat 9 (problems) Message-ID: [ The following text is in the "windows-1252" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Go into /etc/sysconfig/i18n and remove all mention of utf8. Then log out, log back in and give it another try. chardlist wrote: > Perl Version 5.8.5 > > Redhat 9 > > Mailscanner 4.40.11 > > I'm performing a fresh install of Mailscanner on a Redhat 9 box and am > getting the following errors when running the ./install.sh ignore-perl > script. > > I^Òve installed on FreeBSD before, but this is my first run at it on a > Linux system. I^Òve installed all of the perl modules listed below > using CPAN so I^Òm stumped. > > Thanks for the help, > > -Brendna > > > First errors^Å > > t/getdate....ok 114/128Confused test output: test 114 answered after > test 118 > > t/getdate....ok 115/128Confused test output: test 115 answered after > test 119 > > t/getdate....ok 116/128Confused test output: test 116 answered after > test 120 > > t/getdate....ok 117/128Confused test output: test 117 answered after > test 121 > > t/getdate....ok 118/128Confused test output: test 118 answered after > test 122 > > t/getdate....ok 119/128Confused test output: test 119 answered after > test 123 > > t/getdate....ok 120/128Confused test output: test 120 answered after > test 124 > > t/getdate....ok 121/128Confused test output: test 121 answered after > test 125 > > t/getdate....ok 122/128Confused test output: test 122 answered after > test 126 > > t/getdate....ok 123/128Confused test output: test 123 answered after > test 127 > > t/getdate....FAILED tests 1-5 > > Failed 5/128 tests, 96.09% okay > > t/lang.......ok > > Failed Test Stat Wstat Total Fail Failed List of Failed > > ------------------------------------------------------------------------------- > > t/date.t 123 123 100.00% 1-123 > > t/format.t 150 18 12.00% 8-9 25 28-29 34 58-59 75 78-79 84 > > 108-109 125 128-129 134 > > t/getdate.t 128 5 3.91% 1-5 > > Failed 3/4 test scripts, 25.00% okay. 146/404 subtests failed, 63.86% > okay. > > make: *** [test_dynamic] Error 255 > > error: Bad exit status from /var/tmp/rpm-tmp.94578 (%build) > > Missing file > /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. > > Maybe it did not build correctly? > > Then > > error: Failed dependencies: > > perl(Date::Format) is needed by perl-MailTools-1.50-1 > > perl(Date::Parse) is needed by perl-MailTools-1.50-1 > > And > > error: Failed dependencies: > > perl(Mail::Field) is needed by perl-MIME-tools-5.417-1 > > perl(Mail::Field) >= 1.05 is needed by perl-MIME-tools-5.417-1 > > perl(Mail::Header) >= 1.06 is needed by perl-MIME-tools-5.417-1 > > perl(Mail::Internet) >= 1.28 is needed by perl-MIME-tools-5.417-1 > > perl-MailTools is needed by perl-MIME-tools-5.417-1 > > Then > > error: Failed dependencies: > > perl(MIME::Body) is needed by perl-Convert-TNEF-0.17-1 > > And Finally: > > error: Failed dependencies: > > perl-MIME-tools >= 5.412 is needed by mailscanner-4.40.11-1 > > Thanks again, > > -Brendan > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Tue Apr 26 21:19:38 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:29:23 2006 Subject: New on Redhat 9 (problems) Message-ID: It did say utf8 in the file, it now just says LANG="us_eng" Still similar errors however… slightly different failure rates on the one below. All of the other errors are the same. One note, in the beginning it says it’s rebuilding the modules for a i386 system. I am on an i686 system. Failed Test Stat Wstat Total Fail Failed List of Failed ------------------------------------------------------------------------------- t/date.t 123 123 100.00% 1-123 t/format.t 150 18 12.00% 8-9 25 28-29 34 58-59 75 78-79 84 108-109 125 128-129 134 t/getdate.t 128 5 3.91% 1-5 Failed 3/4 test scripts, 25.00% okay. 146/404 subtests failed, 63.86% okay. make: *** [test_dynamic] Error 255 error: Bad exit status from /var/tmp/rpm-tmp.93236 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.93236 (%build) Missing file /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. Maybe it did not build correctly? -Brendan >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: Tuesday, April 26, 2005 2:56 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: New on Redhat 9 (problems) > >Go into /etc/sysconfig/i18n and remove all mention of utf8. >Then log out, log back in and give it another try. > >chardlist wrote: > >> Perl Version 5.8.5 >> >> Redhat 9 >> >> Mailscanner 4.40.11 >> >> I'm performing a fresh install of Mailscanner on a Redhat 9 box and am >> getting the following errors when running the ./install.sh ignore-perl >> script. >> >> I’ve installed on FreeBSD before, but this is my first run at it on a >> Linux system. I’ve installed all of the perl modules listed below >> using CPAN so I’m stumped. >> >> Thanks for the help, >> >> -Brendna >> >> >> First errors… >> >> t/getdate....ok 114/128Confused test output: test 114 answered after >> test 118 >> >> t/getdate....ok 115/128Confused test output: test 115 answered after >> test 119 >> >> t/getdate....ok 116/128Confused test output: test 116 answered after >> test 120 >> >> t/getdate....ok 117/128Confused test output: test 117 answered after >> test 121 >> >> t/getdate....ok 118/128Confused test output: test 118 answered after >> test 122 >> >> t/getdate....ok 119/128Confused test output: test 119 answered after >> test 123 >> >> t/getdate....ok 120/128Confused test output: test 120 answered after >> test 124 >> >> t/getdate....ok 121/128Confused test output: test 121 answered after >> test 125 >> >> t/getdate....ok 122/128Confused test output: test 122 answered after >> test 126 >> >> t/getdate....ok 123/128Confused test output: test 123 answered after >> test 127 >> >> t/getdate....FAILED tests 1-5 >> >> Failed 5/128 tests, 96.09% okay >> >> t/lang.......ok >> >> Failed Test Stat Wstat Total Fail Failed List of Failed >> >> ------------------------------------------------------------------------- >------ >> >> t/date.t 123 123 100.00% 1-123 >> >> t/format.t 150 18 12.00% 8-9 25 28-29 34 58-59 75 78-79 84 >> >> 108-109 125 128-129 134 >> >> t/getdate.t 128 5 3.91% 1-5 >> >> Failed 3/4 test scripts, 25.00% okay. 146/404 subtests failed, 63.86% >> okay. >> >> make: *** [test_dynamic] Error 255 >> >> error: Bad exit status from /var/tmp/rpm-tmp.94578 (%build) >> >> Missing file >> /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. >> >> Maybe it did not build correctly? >> >> Then >> >> error: Failed dependencies: >> >> perl(Date::Format) is needed by perl-MailTools-1.50-1 >> >> perl(Date::Parse) is needed by perl-MailTools-1.50-1 >> >> And >> >> error: Failed dependencies: >> >> perl(Mail::Field) is needed by perl-MIME-tools-5.417-1 >> >> perl(Mail::Field) >= 1.05 is needed by perl-MIME-tools-5.417-1 >> >> perl(Mail::Header) >= 1.06 is needed by perl-MIME-tools-5.417-1 >> >> perl(Mail::Internet) >= 1.28 is needed by perl-MIME-tools-5.417-1 >> >> perl-MailTools is needed by perl-MIME-tools-5.417-1 >> >> Then >> >> error: Failed dependencies: >> >> perl(MIME::Body) is needed by perl-Convert-TNEF-0.17-1 >> >> And Finally: >> >> error: Failed dependencies: >> >> perl-MIME-tools >= 5.412 is needed by mailscanner-4.40.11-1 >> >> Thanks again, >> >> -Brendan >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Tue Apr 26 21:47:24 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:29:23 2006 Subject: New on Redhat 9 (problems) Message-ID: Attached is the log from the install attempt. -Brendan >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of Julian Field >Sent: Tuesday, April 26, 2005 2:56 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: New on Redhat 9 (problems) > >Go into /etc/sysconfig/i18n and remove all mention of utf8. >Then log out, log back in and give it another try. > >chardlist wrote: > >> Perl Version 5.8.5 >> >> Redhat 9 >> >> Mailscanner 4.40.11 >> >> I'm performing a fresh install of Mailscanner on a Redhat 9 box and am >> getting the following errors when running the ./install.sh ignore-perl >> script. >> >> I've installed on FreeBSD before, but this is my first run at it on a >> Linux system. I've installed all of the perl modules listed below >> using CPAN so I'm stumped. >> >> Thanks for the help, >> >> -Brendna >> >> >> First errors. >> >> t/getdate....ok 114/128Confused test output: test 114 answered after >> test 118 >> >> t/getdate....ok 115/128Confused test output: test 115 answered after >> test 119 >> >> t/getdate....ok 116/128Confused test output: test 116 answered after >> test 120 >> >> t/getdate....ok 117/128Confused test output: test 117 answered after >> test 121 >> >> t/getdate....ok 118/128Confused test output: test 118 answered after >> test 122 >> >> t/getdate....ok 119/128Confused test output: test 119 answered after >> test 123 >> >> t/getdate....ok 120/128Confused test output: test 120 answered after >> test 124 >> >> t/getdate....ok 121/128Confused test output: test 121 answered after >> test 125 >> >> t/getdate....ok 122/128Confused test output: test 122 answered after >> test 126 >> >> t/getdate....ok 123/128Confused test output: test 123 answered after >> test 127 >> >> t/getdate....FAILED tests 1-5 >> >> Failed 5/128 tests, 96.09% okay >> >> t/lang.......ok >> >> Failed Test Stat Wstat Total Fail Failed List of Failed >> >> ------------------------------------------------------------------------- >------ >> >> t/date.t 123 123 100.00% 1-123 >> >> t/format.t 150 18 12.00% 8-9 25 28-29 34 58-59 75 78-79 84 >> >> 108-109 125 128-129 134 >> >> t/getdate.t 128 5 3.91% 1-5 >> >> Failed 3/4 test scripts, 25.00% okay. 146/404 subtests failed, 63.86% >> okay. >> >> make: *** [test_dynamic] Error 255 >> >> error: Bad exit status from /var/tmp/rpm-tmp.94578 (%build) >> >> Missing file >> /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. >> >> Maybe it did not build correctly? >> >> Then >> >> error: Failed dependencies: >> >> perl(Date::Format) is needed by perl-MailTools-1.50-1 >> >> perl(Date::Parse) is needed by perl-MailTools-1.50-1 >> >> And >> >> error: Failed dependencies: >> >> perl(Mail::Field) is needed by perl-MIME-tools-5.417-1 >> >> perl(Mail::Field) >= 1.05 is needed by perl-MIME-tools-5.417-1 >> >> perl(Mail::Header) >= 1.06 is needed by perl-MIME-tools-5.417-1 >> >> perl(Mail::Internet) >= 1.28 is needed by perl-MIME-tools-5.417-1 >> >> perl-MailTools is needed by perl-MIME-tools-5.417-1 >> >> Then >> >> error: Failed dependencies: >> >> perl(MIME::Body) is needed by perl-Convert-TNEF-0.17-1 >> >> And Finally: >> >> error: Failed dependencies: >> >> perl-MIME-tools >= 5.412 is needed by mailscanner-4.40.11-1 >> >> Thanks again, >> >> -Brendan >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) >> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> *Support MailScanner development - buy the book off the website!* > > >-- >Julian Field >www.MailScanner.info >Buy the MailScanner book at www.MailScanner.info/store >Professional Support Services at www.MailScanner.biz >MailScanner thanks transtec Computers for their support > >PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/OCTET-STREAM (Name: "putty.log") 164KB. ] [ Unable to print this part. ] From res at AUSICS.NET Tue Apr 26 22:56:32 2005 From: res at AUSICS.NET (Res) Date: Thu Jan 12 21:29:23 2006 Subject: New on Redhat 9 (problems) Message-ID: On Tue, 26 Apr 2005, chardlist wrote: > Perl Version 5.8.5 > > Redhat 9 > > Mailscanner 4.40.11 change /etc/sysconfig/i18n to LANG="en_US.iso885915" SUPPORTED="en_US.iso885915:en_US:en" SYSFONT="lat0-sun16" SYSFONTACM="iso15" > -- Cheers Res ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 02:02:22 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: Quarantine queue format Message-ID: On 26/04/2005 09:45, "Fred. Oger" wrote: > My problem is the file stored in the quarantine folder aren't in the > format described in the doc. > > eg: > # ls -l /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F > -rw------- 1 postfix postfix 14768 Apr 26 05:20 F29183F8 > -rw------- 1 postfix postfix 11930 Apr 26 05:20 msg-10453-17.html > > > So how can I resend this mail to the user ? Chmod +x /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F/F29183F8 Cp /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F/F29183F8 /var/spool/postfix/incoming/F The file F29183F8 should contain the entire message since you set it to store a single file so you just need to copy that to the correct directory with the correct permissions. Also note the 'incoming/F' the 'F' comes from the first character of the message id. So if your message id started with '4' you copy it to 'incoming/4'. Hope this helps... Regards, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mbneto at gmail.com Wed Apr 27 03:01:37 2005 From: mbneto at gmail.com (mbneto) Date: Thu Jan 12 21:29:24 2006 Subject: Bayes & MySQL Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] but do we still have to take mailscanner down before (and during) this ? On 4/14/05, Julian Field wrote: > The expiry will still need to be done, it's to do with clearing out old > expired tokens that haven't been used in a long time, it's not to do > with database implementation. > > Mike Kercher wrote: > > >I've got my bayes running with mysql on a few machines and seems to be > >working great. MY question is does the bayes rebuild still need to be done > >or is it even effective with bayes residing in mysql? > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Wed Apr 27 06:54:50 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:24 2006 Subject: problems with mailscanner automated cron Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I get two different e-mails from the new server I have built. Can someone tell me what to look for please I get this e-mail every hour running hourly cronjob scripts SCRIPT: check_MailScanner, OK. SCRIPT: fix_quarantine_permissions, OK. SCRIPT: mailq.php, OK. SCRIPT: sendmail_relay.php exited with RETURNCODE = 255. SCRIPT: output (stdout && stderr) follows Warning: main(/var/www/html/mailscanner/functions.php): failed to open stream: No such file or directory in /etc/cron.hourly/sendmail_relay.php on line 23 Fatal error: main(): Failed opening required '/var/www/html/mailscanner/functions.php' (include_path='.:/usr/share/php') in /etc/cron.hourly/sendmail_relay.php on line 23 SCRIPT: sendmail_relay.php ------- END OF OUTPUT I can't find the place to change the path to the functions.php as SUSE web server document root sits in /srv/www/htdocs. I have edited the sendmail_relay.php file with the right path. and this one every day The rules_du_jour exists and the rights a 0755 for root:root running daily cronjob scripts SCRIPT: Rules_Du_Jour.pl exited with RETURNCODE = 1. SCRIPT: output (stdout && stderr) follows /etc/cron.daily/rules_du_jour is either not there or is 0 bytes SCRIPT: Rules_Du_Jour.pl ------- END OF OUTPUT SCRIPT: bayes-rebuild, OK. SCRIPT: clean.quarantine, OK. SCRIPT: clean_catman, OK. SCRIPT: clean_core, OK. SCRIPT: do_mandb, OK. SCRIPT: logrotate, OK. SCRIPT: medusa.cron, OK. SCRIPT: pyzor-discover, OK. SCRIPT: output (stdout && stderr) follows downloading servers from http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x SCRIPT: pyzor-discover ------- END OF OUTPUT SCRIPT: razor-discover, OK. SCRIPT: rules_du_jour_wrapper, OK. SCRIPT: suse.de-backup-rc.config, OK. SCRIPT: suse.de-backup-rpmdb, OK. SCRIPT: suse.de-check-battery, OK. SCRIPT: suse.de-clean-tmp, OK. SCRIPT: suse.de-clean-vi, OK. SCRIPT: suse.de-cron-local, OK. SCRIPT: updatedb, OK. SCRIPT: update_virus_scanners, OK. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From oger at SGSI.UCL.AC.BE Wed Apr 27 07:02:07 2005 From: oger at SGSI.UCL.AC.BE (Fred. Oger) Date: Thu Jan 12 21:29:24 2006 Subject: Quarantine queue format Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wayne a écrit : >On 26/04/2005 09:45, "Fred. Oger" wrote: > > > > >>My problem is the file stored in the quarantine folder aren't in the >>format described in the doc. >> >>eg: >># ls -l /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F >>-rw------- 1 postfix postfix 14768 Apr 26 05:20 F29183F8 >>-rw------- 1 postfix postfix 11930 Apr 26 05:20 msg-10453-17.html >> >> >>So how can I resend this mail to the user ? >> >> > >Chmod +x /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F/F29183F8 >Cp /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F/F29183F8 >/var/spool/postfix/incoming/F > >The file F29183F8 should contain the entire message since you set it to >store a single file so you just need to copy that to the correct directory >with the correct permissions. >Also note the 'incoming/F' the 'F' comes from the first character of the >message id. >So if your message id started with '4' you copy it to 'incoming/4'. > >Hope this helps... > >Regards, > Wayne > > > Hi Wayne, I tried the method you described but hopelessly the mail stays indefinitely in the incoming queue. I also found it coud be resent using postdrop < queuefile. In this case I get the following error : # postdrop < /var/spool/MailScanner/quarantine/20050426/D814F477.D847C/D814F477 queue_id3E83246Cpostdrop: fatal: uid=0: unexpected record type: 67 Any idea ? Regards, Fred. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.6KB. ] [ Unable to print this part. ] From spiv007 at gmail.com Wed Apr 27 07:20:40 2005 From: spiv007 at gmail.com (spiv007) Date: Thu Jan 12 21:29:24 2006 Subject: rbl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] how do i allow an ip that is on an rbl list to send mail to my server? I added the ip to my whitelist but it still get blocked. Maybe spammassin is blocking it? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Wed Apr 27 08:15:18 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:24 2006 Subject: problems with mailscanner automated cron Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I Would like to apologies to the list for being an idiot I have two MS server and I was only looking at the new one as I had assumed it was the one that was configured incorrectly. Duhhhh It was the old one Sorry guys for wasting bandwidth Lance Lance Haig wrote: I get two different e-mails from the new server I have built. Can someone tell me what to look for please I get this e-mail every hour running hourly cronjob scripts SCRIPT: check_MailScanner, OK. SCRIPT: fix_quarantine_permissions, OK. SCRIPT: mailq.php, OK. SCRIPT: sendmail_relay.php exited with RETURNCODE = 255. SCRIPT: output (stdout && stderr) follows Warning: main(/var/www/html/mailscanner/functions.php): failed to open stream: No such file or directory in /etc/cron.hourly/sendmail_relay.php on line 23 Fatal error: main(): Failed opening required '/var/www/html/mailscanner/functions.php' (include_path='.:/usr/share/php') in /etc/cron.hourly/sendmail_relay.php on line 23 SCRIPT: sendmail_relay.php ------- END OF OUTPUT I can't find the place to change the path to the functions.php as SUSE web server document root sits in /srv/www/htdocs. I have edited the sendmail_relay.php file with the right path. and this one every day The rules_du_jour exists and the rights a 0755 for root:root running daily cronjob scripts SCRIPT: Rules_Du_Jour.pl exited with RETURNCODE = 1. SCRIPT: output (stdout && stderr) follows /etc/cron.daily/rules_du_jour is either not there or is 0 bytes SCRIPT: Rules_Du_Jour.pl ------- END OF OUTPUT SCRIPT: bayes-rebuild, OK. SCRIPT: clean.quarantine, OK. SCRIPT: clean_catman, OK. SCRIPT: clean_core, OK. SCRIPT: do_mandb, OK. SCRIPT: logrotate, OK. SCRIPT: medusa.cron, OK. SCRIPT: pyzor-discover, OK. SCRIPT: output (stdout && stderr) follows downloading servers from http://pyzor.sourceforge.net/cgi-bin/inform-servers-0-3-x SCRIPT: pyzor-discover ------- END OF OUTPUT SCRIPT: razor-discover, OK. SCRIPT: rules_du_jour_wrapper, OK. SCRIPT: suse.de-backup-rc.config, OK. SCRIPT: suse.de-backup-rpmdb, OK. SCRIPT: suse.de-check-battery, OK. SCRIPT: suse.de-clean-tmp, OK. SCRIPT: suse.de-clean-vi, OK. SCRIPT: suse.de-cron-local, OK. SCRIPT: updatedb, OK. SCRIPT: update_virus_scanners, OK. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 08:31:29 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: rbl Message-ID: Hi where is the RBL defined, in the MailScanner.conf or used in the SA config? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 spiv007 wrote: > how do i allow an ip that is on an rbl list to send mail to my server? > I added the ip to my whitelist but it still get blocked. Maybe > spammassin is blocking it? > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 08:32:57 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: Rules du jour troubles Message-ID: Kevin I define all my extras in my_rules_du_jour, that way when RDJ gets updated I don't loose my config. I'd ask on the spamassassin-users list as the RDJ maintainers lurk on that list and will be able to give a moe definitive answer. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Matt Kettler wrote: > >>In more detail, you'll want to take these steps. >> 1) update your RDJ config file to reflect the new name. Find the >>reference to 70_sare_evilnum.cf and add the 0 to it's name. >> 2) cd /etc/mail/spamassassin >> 3) wget http://www.rulesemporium.com/rules/70_sare_evilnum0.cf >> 4) rm 70_sare_evilnum.cf > > > Well, some things changed in RDJ. I was getting similar messages for some > time and was confused by them too. The error message said to change the > "language files". Didn't have any, so I left it alone and after a week or > so that particular message stopped. I got curious this morning though so > started looking closer and noticed that there's a newer version of > rules_du_jur out than I was running and now instead of rules_du_jur and > my_rules_du_jur in /root/bin, the new system wants a config file in > /etc/rulesdujour. Also said my_rules_du_jour is deprecated. > > So I started updating my system, but am confused a little. Some places on > the web site indicate to configure everything in the script, and others say > to use a config file. Here's what I've done so far: > > 1: copied latest rules_du_jour to /root/bin/ > 2: created the /etc/rulesdujour directory > 3: copied the rules_du_jur script there as a starting point, renaming it > config. > 4: Deleted everything before the line: TRUSTED_RULESETS="TRIPWIRE > EVILNUMBERS SARE_RANDOM"; > (That's the default list - I did modify a bit, to taste). > > It's not entirely clear what else goes in there. There's the "Rules File > Registry" section in the script. I think that should go in the config file > but am not sure. If it's in the config file, does it also remain in the > script? Seems that would be a hassle to have to update it in two places. > Same with the "Local Settings" section. Does that go in both the script and > config file? > > The web page (http://www.exit0.us/index.php?pagename=RulesDuJourRuleSets) > sats: > "Note: To those wishing to add these rulesets to your local installation of > RulesDuJour: copy and paste the ruleset information you wish to install into > the rules_du_jour script between "Begin Rules File Registry" and "End Rules > File Registry". Then add the rule name (eg: TRIPWIRE) to the > TRUSTED_RULESETS configuration line." > > So that says put 'em in the script, but I'd think they'd go in the config > file. > > Also, the script says to "Configure Local settings in your config file" > while http://www.exit0.us/index.php?pagename=RulesDuJour says this: > "Configure RulesDuJour local settings (SA_DIR, MAIL_ADDRESS, SA_RESTART in > the script)" > > So where are they configured? Both places? Do I need to update both when > new rulesets come out, or just the config file? Does one update the > TRUSTED_RULESETS line in both the script and the config file too? > > So it sounds like RDJ is in a state of upgrade flux. Sorry if this is > getting too off topic but I'm sure many MailScanner users are also using RDJ > and would appreciate a clarification. Or maybe I'm the only dummy here. > > Does anybody have a generic config file and script that they could share > showing exactly what needs to be in each file? > > TIA... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 27 08:56:28 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:24 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released a new beta 4.41.2. This is mostly a bugfix from 4.41.1. The next version will be based on this one, so please file your bug reports :-) Download as usual from www.mailscanner.info Here is the Change Log: * New Features and Improvements * - Improved install.sh to work on AMD64 Fedora Core 3 systems. - Added * wildcard support to phishing.safe.sites.conf, so you can list *.safedomain.com instead of having to list subdomains and other servers individually. Useful for listing your own domain. - Improved IPv6 support as sendmail on Linux adds "IPv6:" on the front of the IPv6 SMTP client address. - Improved support for \ characters in URLs in phishing net. - Better handling of subdirectories in RAR archives. - Duplicates removed in quarantine postmaster notice. - Added filetype entry to allow PostScript files. - Improved phishing net by adding detector for numeric IPs which do match but warn as they might be part of a fraud. - Added new entry to languages.conf which needs translating. - Improved phishing net to improve handling of numbered website references automatically inserted by some Unix text-only email clients. - Improved handling of ClamAV output when it scanned zero-length attachments. - Updated phishing net safe-sites list. * Fixes * - RAR archive handling: creation of directory only archive entries, both windows and *nix created archives (caused problems for SAVI). - RAR archive handling: possible false Encrypted file trigger on file names containing the word "Encrypted". - RAR archive handling: full path names used when extracting archived files, extracted to safe file name without out path. - Removed harmless error message when clearing out empty working directories at startup in debug mode. - Fixed problem where using rulesets to scan messages for dangerous content but not for viruses would cause the messages to be scanned by viruses anyway. - Fixed problem where filename/type checks were still being done on messages which had rulesets saying they should not do dangerous content checking. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From jose at TREELOGIC.COM Wed Apr 27 12:49:29 2005 From: jose at TREELOGIC.COM ([iso-8859-1] José Angel Blanco González) Date: Thu Jan 12 21:29:24 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Any one knows reliable rbl list? No matter if they are not free. Now I am receiving false positives from wanadoo, hotmail,etc. accounts Thank you very much Jose ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 13:28:54 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: Quarantine queue format Message-ID: On 27/04/2005 07:02, "Fred. Oger" wrote: > I tried the method you described but hopelessly the mail stays > indefinitely in the incoming queue. Can you do an ls -l on /var/spool/postfix/incoming/F and post the out? Regards, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 13:31:11 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: OT: mailwatch mailing list Message-ID: Hey Guys, Anybody else here on the mailwatch mailing list? I cant seem to post and no new mails seem to be coming in... Is it just me? Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 13:33:11 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: OT: mailwatch mailing list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wayne wrote: > Hey Guys, > > Anybody else here on the mailwatch mailing list? > I cant seem to post and no new mails seem to be coming in... > Is it just me? > > Thanks, > Wayne > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! yes and it is sometime quiet.... I'll send a test mesg -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 13:32:28 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] José Angel Blanco González wrote: > Any one knows reliable rbl list? No matter if they are not free. > Now I am receiving false positives from wanadoo, hotmail,etc. accounts > > Thank you very much > Jose > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Jose I use the spamhaus XBL list in my SA conf, not in MailScanner.conf as I find using RBLs as actual blacklists can lead to this issue -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 13:45:43 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: Whitelists + blacklists Message-ID: Hey Guys, I have enabled per domain blacklisting + whitelisting in mailscanner. However it seems that the files in /etc/MailScanner/spam.bydomain only understand the concept of 'mail from' not 'mail to'.. How would I say that I want to whitelist all mail to my address? I tried putting in To: wayne@nightsol.net yes In a file called default in /etc/MailScanner/spam.bydomain/whitelist and that hasn't worked.. Anybody able to point me in the right direction? Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 13:49:52 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: Whitelists + blacklists Message-ID: On 27/04/2005 13:45, "Wayne" wrote: > /etc/MailScanner/spam.bydomain/whitelist Correction: That should have read /etc/MailScanner/spam.bydomain/whitelist/default Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 13:52:04 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: OT: mailwatch mailing list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin Hepworth wrote: > Wayne wrote: > >> Hey Guys, >> >> Anybody else here on the mailwatch mailing list? >> I cant seem to post and no new mails seem to be coming in... >> Is it just me? >> >> Thanks, >> Wayne >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > yes and it is sometime quiet.... I'll send a test mesg > Wayne work for me....you sure you're still subscribed? -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 13:53:32 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: Whitelists + blacklists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wayne wrote: > Hey Guys, > > I have enabled per domain blacklisting + whitelisting in mailscanner. > However it seems that the files in /etc/MailScanner/spam.bydomain only > understand the concept of 'mail from' not 'mail to'.. > How would I say that I want to whitelist all mail to my address? > I tried putting in > To: wayne@nightsol.net yes > In a file called default in /etc/MailScanner/spam.bydomain/whitelist and > that hasn't worked.. > Anybody able to point me in the right direction? > > Thanks, > Wayne > wayne Rule files need to end in .rule or .rules. Change the name and it should work fine. -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 14:00:07 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: OT: mailwatch mailing list Message-ID: On 27/04/2005 13:52, "Martin Hepworth" wrote: > work for me....you sure you're still subscribed? Yeah I saw your post, just tried now again if that fails again Ill just try and unsubscribe/resubscribe see if that does anything.. Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 14:49:32 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: Whitelists + blacklists Message-ID: On 27/04/2005 14:27, "Dhawal Doshy" wrote: > Just a vague idea.. try this if the server is not production, though i'm > not too sure if it'll work.. > > Is Definitely Not Spam = %rules-dir%/some.file.ending.in.rules > > Content of some.file.ending.in.rules > ==================================== > To: wayne@nightsol.net yes > FromOrTo: default &ByDomainSpamWhitelist Hi Dhawal, That wasn't a bad idea. Didn't work though, just got syntax errors and it ignored the &ByDomainSpamWhitelist. I think I will have to go back to using the old method. I had written a web interface in php for whitelisting/blacklisting based on using &ByDomainSpamWhitelist, pain in the ass now to go recreate it. Should have thought of *to* before I started. Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Wed Apr 27 15:08:49 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:24 2006 Subject: ClamAV Perl module not found Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Did anyone ever fix this? I'm having the same issue. Here is the content of my /usr/lib/perl5 dir. drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.0 drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.1 drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.2 drwxr-xr-x 4 root root 4.0K Apr 26 18:47 5.8.3 drwxr-xr-x 3 root root 4.0K Apr 26 18:47 5.8.4 drwxr-xr-x 43 root root 4.0K Apr 26 18:47 5.8.5 drwxr-xr-x 8 root root 4.0K Apr 26 18:47 site_perl drwxr-xr-x 2 root root 4.0K Apr 27 02:03 Text drwxr-xr-x 8 root root 4.0K Apr 26 18:47 vendor_perl On 12/14/04, Mike Kercher wrote: Chris Trudeau wrote: > List, > > Installing ClamAV module via CPAN on machine running MailScanner > 4.36-4 stable. The install of the module goes fine, but when > starting MailScanner with Virus Scanners = clamavmodule the log > returns the message: > > ClamAV Perl module not found, did you install it? > > I verified using CPAN install that it is in fact installed and > uptodate. > > Any ideas? > > CT Do you have more than one version of perl installed? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html ). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From itdept at FRACTALWEB.COM Wed Apr 27 15:11:17 2005 From: itdept at FRACTALWEB.COM (Fractal IT Dept.) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi everyone, I'm having a problem with ham becoming spam because it receives AWL points. I'm not sure why this is happening, because in my mailscanner.conf file, I have: SpamAssassin Auto Whitelist = no Any thoughts as to what could possibly be causing this? Thanks, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Wed Apr 27 14:54:09 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:29:24 2006 Subject: New on Redhat 9 (problems) {fixed} Message-ID: Thank you all for the help. After looking at this error: >>> Missing file >>> /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. I copied the rpm file from the MailScanner install directory into the /usr/src/redhat/RPMS/noarch/ directory (it was not there) and then the install breezed right through. -Brendan >-----Original Message----- >From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >Behalf Of chardlist >Sent: Tuesday, April 26, 2005 3:47 PM >To: MAILSCANNER@JISCMAIL.AC.UK >Subject: Re: New on Redhat 9 (problems) > >Attached is the log from the install attempt. > >-Brendan > >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Julian Field >>Sent: Tuesday, April 26, 2005 2:56 PM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: New on Redhat 9 (problems) >> >>Go into /etc/sysconfig/i18n and remove all mention of utf8. >>Then log out, log back in and give it another try. >> >>chardlist wrote: >> >>> Perl Version 5.8.5 >>> >>> Redhat 9 >>> >>> Mailscanner 4.40.11 >>> >>> I'm performing a fresh install of Mailscanner on a Redhat 9 box and am >>> getting the following errors when running the ./install.sh ignore-perl >>> script. >>> >>> I've installed on FreeBSD before, but this is my first run at it on a >>> Linux system. I've installed all of the perl modules listed below >>> using CPAN so I'm stumped. >>> >>> Thanks for the help, >>> >>> -Brendna >>> >>> >>> First errors. >>> >>> t/getdate....ok 114/128Confused test output: test 114 answered after >>> test 118 >>> >>> t/getdate....ok 115/128Confused test output: test 115 answered after >>> test 119 >>> >>> t/getdate....ok 116/128Confused test output: test 116 answered after >>> test 120 >>> >>> t/getdate....ok 117/128Confused test output: test 117 answered after >>> test 121 >>> >>> t/getdate....ok 118/128Confused test output: test 118 answered after >>> test 122 >>> >>> t/getdate....ok 119/128Confused test output: test 119 answered after >>> test 123 >>> >>> t/getdate....ok 120/128Confused test output: test 120 answered after >>> test 124 >>> >>> t/getdate....ok 121/128Confused test output: test 121 answered after >>> test 125 >>> >>> t/getdate....ok 122/128Confused test output: test 122 answered after >>> test 126 >>> >>> t/getdate....ok 123/128Confused test output: test 123 answered after >>> test 127 >>> >>> t/getdate....FAILED tests 1-5 >>> >>> Failed 5/128 tests, 96.09% okay >>> >>> t/lang.......ok >>> >>> Failed Test Stat Wstat Total Fail Failed List of Failed >>> >>> ------------------------------------------------------------------------ >- >>------ >>> >>> t/date.t 123 123 100.00% 1-123 >>> >>> t/format.t 150 18 12.00% 8-9 25 28-29 34 58-59 75 78-79 84 >>> >>> 108-109 125 128-129 134 >>> >>> t/getdate.t 128 5 3.91% 1-5 >>> >>> Failed 3/4 test scripts, 25.00% okay. 146/404 subtests failed, 63.86% >>> okay. >>> >>> make: *** [test_dynamic] Error 255 >>> >>> error: Bad exit status from /var/tmp/rpm-tmp.94578 (%build) >>> >>> Missing file >>> /usr/src/redhat/RPMS/noarch/perl-TimeDate-1.1301-3.noarch.rpm. >>> >>> Maybe it did not build correctly? >>> >>> Then >>> >>> error: Failed dependencies: >>> >>> perl(Date::Format) is needed by perl-MailTools-1.50-1 >>> >>> perl(Date::Parse) is needed by perl-MailTools-1.50-1 >>> >>> And >>> >>> error: Failed dependencies: >>> >>> perl(Mail::Field) is needed by perl-MIME-tools-5.417-1 >>> >>> perl(Mail::Field) >= 1.05 is needed by perl-MIME-tools-5.417-1 >>> >>> perl(Mail::Header) >= 1.06 is needed by perl-MIME-tools-5.417-1 >>> >>> perl(Mail::Internet) >= 1.28 is needed by perl-MIME-tools-5.417-1 >>> >>> perl-MailTools is needed by perl-MIME-tools-5.417-1 >>> >>> Then >>> >>> error: Failed dependencies: >>> >>> perl(MIME::Body) is needed by perl-Convert-TNEF-0.17-1 >>> >>> And Finally: >>> >>> error: Failed dependencies: >>> >>> perl-MIME-tools >= 5.412 is needed by mailscanner-4.40.11-1 >>> >>> Thanks again, >>> >>> -Brendan >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) >>> and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> *Support MailScanner development - buy the book off the website!* >> >> >>-- >>Julian Field >>www.MailScanner.info >>Buy the MailScanner book at www.MailScanner.info/store >>Professional Support Services at www.MailScanner.biz >>MailScanner thanks transtec Computers for their support >> >>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ustunera at itu.edu.tr Wed Apr 27 15:20:55 2005 From: ustunera at itu.edu.tr ([iso-8859-9] Ali Korhan Üstüner ) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: [ The following text is in the "iso-8859-9" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Adding a “use_auto_whitelist      0” line  into /etc/mail/spamassassin/local.cf would possibly solve the problem.   ----- A. Korhan ÜSTÜNER ITU IT Department System Support Team E-mail: ustunera@itu.edu.tr ________________________________________________________________________________ From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Fractal IT Dept. Sent: Wednesday, April 27, 2005 5:11 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: AWL problems Hi everyone, I'm having a problem with ham becoming spam because it receives AWL points. I'm not sure why this is happening, because in my mailscanner.conf file, I have: SpamAssassin Auto Whitelist = no Any thoughts as to what could possibly be causing this? Thanks, Chris ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brad at BECKENHAUER.COM Wed Apr 27 15:59:03 2005 From: brad at BECKENHAUER.COM (Brad Beckenhauer) Date: Thu Jan 12 21:29:24 2006 Subject: zip archive depth as ruleset? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Julian, looks like the "Maximum Archive Depth" option is missing the comment about supporting rulesets. Perhaps you could add this comment in the next release. # To disable this feature set this to 0. # A common useful setting is this option = 0, and Allow Password-Protected # Archives = no. That block password-protected archives but does not do # any filename/filetype checks on the files within the archive. Maximum Archive Depth = 2 thanks Brad >>> Julian Field 4/25/2005 2:32:16 AM >>> Just exactly the same as any other ruleset. Just make the value at the end of the line the depth you want instead of, for example, yes or no. Fractal IT Dept. wrote: > Hi group, > > I now need to set zip archive depth checking to 0 for one domain, but > would like to leave it as 5 for everyone else. Can this be done > through a ruleset? If so, what is proper syntax? > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 15:48:31 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Chris if you're using SA 3.x this doesn't work. You'll need to turn it off in the SA config files. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Fractal IT Dept. wrote: > Hi everyone, > > I'm having a problem with ham becoming spam because it receives AWL > points. I'm not sure why this is happening, because in my > mailscanner.conf file, I have: > > SpamAssassin Auto Whitelist = no > > Any thoughts as to what could possibly be causing this? > > Thanks, > Chris > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From webalizer at NWCWEB.COM Wed Apr 27 16:08:27 2005 From: webalizer at NWCWEB.COM (Dave Duffner - PSCGi) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: See now he's hitting the same wall I am... Even deleting the AWL's for the individual accounts, MS is still compiling the AWL file. And that's with all the config points possible turned off, MS indicating that autolearn is disabled. Since deleting the AWL file in the .spamassassin dir for each user, it's lowered the point value back down to 0.0 and then starts averaging it back up. Julian's ratings for his posts here that I get stopped AWL rating it, then started with a 0.0 and as I get more of his posts I think we're up to a 0.9 rating. Once it sees enough of his posts, it'll be back to tagging his mail until I kill that AWL file in that account's dir again. Chris may not be that far along in the process yet, but it certainly sounds like he's heading in that direction. So either we've got a weird bug or there's some setting being overridden or hidden somewhere so deep that it's triggering the AWL ratings again. And with a ton of accounts, that's a serious PIA to have to manually delete AWL files on a constant basis to kill it off. I'm open for any suggestions, scripts, cron jobs or otherwise to get that fool thing stopped. In our case we're using an Ensim Hosting OS, so we're stuck with 3.XX of SA as any upgrades that might've fixed this would either foul up Ensim or be overwritten in the next half-a'ed upgrade or patch from Ensim for the OS. David J. Duffner President PSCGi Paradise Shore Communications Group www.pscginternet.com > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > Sent: Wednesday, April 27, 2005 10:49 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: AWL problems > > > Chris > > if you're using SA 3.x this doesn't work. You'll need to turn > it off in the SA config files. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Fractal IT Dept. wrote: > > Hi everyone, > > > > I'm having a problem with ham becoming spam because it receives AWL > > points. I'm not sure why this is happening, because in my > > mailscanner.conf file, I have: > > > > SpamAssassin Auto Whitelist = no > > > > Any thoughts as to what could possibly be causing this? > > > > Thanks, > > Chris I--I Message scanned by MailScanner, and is believed to be clean. CONFIDENTIALITY NOTICE: This transmission intended for the specified destination and person. If this is not you, this e-mail must be deleted immediately. www.pscginternet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 16:14:20 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Dave the awl will (should) only get created for the user MailScanner runs as. Are you sure you're running SA from the MTA/procmail etc?? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Dave Duffner - PSCGi wrote: > See now he's hitting the same wall I am... > > Even deleting the AWL's for the individual accounts, > MS is still compiling the AWL file. And that's with all > the config points possible turned off, MS indicating that > autolearn is disabled. > > Since deleting the AWL file in the .spamassassin dir > for each user, it's lowered the point value back down to 0.0 > and then starts averaging it back up. Julian's ratings for > his posts here that I get stopped AWL rating it, then started > with a 0.0 and as I get more of his posts I think we're up > to a 0.9 rating. Once it sees enough of his posts, it'll > be back to tagging his mail until I kill that AWL file in > that account's dir again. > > Chris may not be that far along in the process yet, > but it certainly sounds like he's heading in that direction. > > So either we've got a weird bug or there's some setting > being overridden or hidden somewhere so deep that it's > triggering the AWL ratings again. And with a ton of accounts, > that's a serious PIA to have to manually delete AWL files on > a constant basis to kill it off. > > I'm open for any suggestions, scripts, cron jobs or > otherwise to get that fool thing stopped. In our case we're > using an Ensim Hosting OS, so we're stuck with 3.XX of SA > as any upgrades that might've fixed this would either foul > up Ensim or be overwritten in the next half-a'ed upgrade or > patch from Ensim for the OS. > > David J. Duffner > President > PSCGi > Paradise Shore Communications Group > www.pscginternet.com > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth >>Sent: Wednesday, April 27, 2005 10:49 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: AWL problems >> >> >>Chris >> >>if you're using SA 3.x this doesn't work. You'll need to turn >>it off in the SA config files. >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Fractal IT Dept. wrote: >> >>>Hi everyone, >>> >>>I'm having a problem with ham becoming spam because it receives AWL >>>points. I'm not sure why this is happening, because in my >>>mailscanner.conf file, I have: >>> >>>SpamAssassin Auto Whitelist = no >>> >>>Any thoughts as to what could possibly be causing this? >>> >>>Thanks, >>>Chris > > > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 27 16:21:54 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:24 2006 Subject: zip archive depth as ruleset? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Done. Brad Beckenhauer wrote: >Hi Julian, >looks like the "Maximum Archive Depth" option is missing the comment about supporting rulesets. Perhaps you could add this comment in the next release. > > ># To disable this feature set this to 0. ># A common useful setting is this option = 0, and Allow Password-Protected ># Archives = no. That block password-protected archives but does not do ># any filename/filetype checks on the files within the archive. >Maximum Archive Depth = 2 > > >thanks >Brad > > > >>>>Julian Field 4/25/2005 2:32:16 AM >>> >>>> >>>> >Just exactly the same as any other ruleset. Just make the value at the >end of the line the depth you want instead of, for example, yes or no. > >Fractal IT Dept. wrote: > > > >>Hi group, >> >>I now need to set zip archive depth checking to 0 for one domain, but >>would like to leave it as 5 for everyone else. Can this be done >>through a ruleset? If so, what is proper syntax? >> >> >> -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Wed Apr 27 16:30:07 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:24 2006 Subject: New sophos version 5.0 support Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have evaluated Sophos 3.xx running on FreeBSD 4.10, called from Mailscanner using the perl SAVI module. I have noticed Sophos have announced the new version 5.0 on their website and are dropping support for the 3.xx version by the end of 2005. Before purchasing a new license, does the new version 5.0 also work with MailScanner and/or the perl SAVI module? I'll probably upgrade the mailserver to FreeBSD 5.4 64bit in the near future. If not, does anyone know of any other good anti virus software with centralized management in a mixes Windows/FreeBSD network? Thanks, Adri. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 27 16:35:05 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:24 2006 Subject: New sophos version 5.0 support Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Ooh, this is the first I have heard of V5. I haven't tried it with MailScanner yet, but I will try to either this weekend or some time next week. I've got a few other things to do first, but it is definitely on the list. Thanks for the heads-up! As for the other question, I deliberately have separately-managed F-Prot installations on my email gateways as well as Sophos. Then if the central management system and/or Sophos fails, my mail is still protected. Going to total central management is fine as long as it works. If it fails, everything fails together. Beware. Adri Koppes wrote: >I have evaluated Sophos 3.xx running on FreeBSD 4.10, called from Mailscanner using the perl SAVI module. >I have noticed Sophos have announced the new version 5.0 on their website and are dropping support for the 3.xx version by the end of 2005. >Before purchasing a new license, does the new version 5.0 also work with MailScanner and/or the perl SAVI module? I'll probably upgrade the mailserver to FreeBSD 5.4 64bit in the near future. >If not, does anyone know of any other good anti virus software with centralized management in a mixes Windows/FreeBSD network? > >Thanks, > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From webalizer at NWCWEB.COM Wed Apr 27 16:42:13 2005 From: webalizer at NWCWEB.COM (Dave Duffner - PSCGi) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Martin, Ensim's whacky modification of the MS/SA package in their Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard by any means. I've asked 1,000 times for someone to clarify how the mail is passed through the processes to determine which 'entity' gets what when in order to fix problems like this and others where it's tagged strangely. Ensim does use a fully chrooted environment, which I know drives everyone insane, but may be part of the problem. Not sure what Chris is using to know if we match or if he has a totally different setup with the same problem. In my case, I'm told mail is handled as follows: In to MailScanner (currently 4.63 I believe?) MS checks it against my internal and externally selected BL's If MS tags it as spam, we changed it to read [Spam-MS] If it's tagged, depending on the settings it's delivered as an attachment or dumped at that point. If it passes cleanly, then it's tossed to SpamAssassin (currently the 3.02 patch from Ensim version) SA then uses my rulesets to determine if it is to be checked and not whitelisted (not AWL'ed) If pass, then SA performs my ruleset checks for spam (RulesdeJour & custom rulesets, etc.) If SA finds it as Spam, tags it [SA-Spam] so we know which process did what to it. If passed or below the threshold, delivered to User. Now, from what little I can gather from Ensim folks & forums, these processes should be running as 'root'. One thing that never surfaced until you mentioned it here was the fact that Ensim (or something) is writing a .spamassassin dir in each domain and for each user that holds the Bayes & AWL info along with anything else specific for that User. Reason here may be that Ensim Pro gives the option to have spam handling done via the GUI either by just the server alone or optionally by each User in their GUI. They get to set the threshold of spam, personal whitelists, etc. and determine if it should hold spam or just delete it if it's been tagged by SA. MS tagging is prior to SA handling, so any options picked by the User would only apply if SA got to process the mail in question. We have User Spam Controls turned on as a percentage of our Users like the more direct control and it saves us hassles of 'censorship' if we were the only party determining what's spam and what's not. Again, I did go in and nail the AWL file for the account I get MailScanner mail to. That did stop the AWL rating from appearing until it had built a file back up. I can't find a spot to stop SA from creating that file once I've deleted it, I'm presuming that's my whole problem there. As a side note, I've also noticed MS skipping some e-mails, we don't do a volume where that should be happening but I did increase some settings that seem to have lowered the skip rate to a level we can deal with. There is an option with this Ensim goofy setup to double-run SA if you change the MailScanner.conf file, but we have that set to only use the SA prefs file and all those settings in the MS.conf file are disabled/commented out, etc. So as far as I can see, the flow above is what's happening and MS is the lead application in handling mail to be scanned. Any questions, don't hestitate to fire away! Thanks, Dave > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > Sent: Wednesday, April 27, 2005 11:14 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: AWL problems > > > Dave > > the awl will (should) only get created for the user > MailScanner runs as. > > Are you sure you're running SA from the MTA/procmail etc?? > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Dave Duffner - PSCGi wrote: > > See now he's hitting the same wall I am... > > > > Even deleting the AWL's for the individual accounts, MS is > > still compiling the AWL file. And that's with all the > config points > > possible turned off, MS indicating that autolearn is disabled. > > > > Since deleting the AWL file in the .spamassassin > dir for each > > user, it's lowered the point value back down to 0.0 and then starts > > averaging it back up. Julian's ratings for his posts here > that I get > > stopped AWL rating it, then started with a 0.0 and as I get more of > > his posts I think we're up to a 0.9 rating. Once it sees enough of > > his posts, it'll be back to tagging his mail until I kill that AWL > > file in that account's dir again. > > > > Chris may not be that far along in the process yet, but it > > certainly sounds like he's heading in that direction. > > > > So either we've got a weird bug or there's some > setting being > > overridden or hidden somewhere so deep that it's triggering the AWL > > ratings again. And with a ton of accounts, that's a serious PIA to > > have to manually delete AWL files on a constant basis to > kill it off. > > > > I'm open for any suggestions, scripts, cron jobs or > otherwise > > to get that fool thing stopped. In our case we're using an Ensim > > Hosting OS, so we're stuck with 3.XX of SA as any upgrades that > > might've fixed this would either foul up Ensim or be overwritten in > > the next half-a'ed upgrade or patch from Ensim for the OS. > > > > David J. Duffner > > President > > PSCGi > > Paradise Shore Communications Group > > www.pscginternet.com > > > > > > > >>-----Original Message----- > >>From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >>Behalf Of Martin Hepworth > >>Sent: Wednesday, April 27, 2005 10:49 AM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: AWL problems > >> > >> > >>Chris > >> > >>if you're using SA 3.x this doesn't work. You'll need to > turn it off > >>in the SA config files. > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Fractal IT Dept. wrote: > >> > >>>Hi everyone, > >>> > >>>I'm having a problem with ham becoming spam because it > receives AWL > >>>points. I'm not sure why this is happening, because in my > >>>mailscanner.conf file, I have: > >>> > >>>SpamAssassin Auto Whitelist = no > >>> > >>>Any thoughts as to what could possibly be causing this? > >>> > >>>Thanks, > >>>Chris > > > > > > > > I--I > > Message scanned by MailScanner, and is believed to be clean. > > CONFIDENTIALITY NOTICE: This transmission intended for the > specified > > destination and person. If this is not you, this > > e-mail must be deleted immediately. www.pscginternet.com > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read > the Wiki > > (http://wiki.mailscanner.info/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential > and intended solely for the use of the individual or entity > to whom they are addressed. If you have received this email > in error please notify the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' > in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > I--I Message scanned by MailScanner, and is believed to be clean. CONFIDENTIALITY NOTICE: This transmission intended for the specified destination and person. If this is not you, this e-mail must be deleted immediately. www.pscginternet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 16:32:33 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: New sophos version 5.0 support Message-ID: Adri when Sophos 5 appears for *nix we can test it..... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > I have evaluated Sophos 3.xx running on FreeBSD 4.10, called from Mailscanner using the perl SAVI module. > I have noticed Sophos have announced the new version 5.0 on their website and are dropping support for the 3.xx version by the end of 2005. > Before purchasing a new license, does the new version 5.0 also work with MailScanner and/or the perl SAVI module? I'll probably upgrade the mailserver to FreeBSD 5.4 64bit in the near future. > If not, does anyone know of any other good anti virus software with centralized management in a mixes Windows/FreeBSD network? > > Thanks, > > Adri. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 16:50:31 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Dave ah that's the problem then Ensim's calling SA outside of MS.....yes it gives per user control but can give issues. (also will be MS 4.36 I guess as 4.41 is latest beta) The more I hear about ensim the less i like it, and they don't give Julian any 'help' just take the code. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Dave Duffner - PSCGi wrote: > Martin, > > Ensim's whacky modification of the MS/SA package in > their Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard > by any means. I've asked 1,000 times for someone to clarify > how the mail is passed through the processes to determine > which 'entity' gets what when in order to fix problems like > this and others where it's tagged strangely. > > Ensim does use a fully chrooted environment, which I > know drives everyone insane, but may be part of the problem. > Not sure what Chris is using to know if we match or if he > has a totally different setup with the same problem. > > In my case, I'm told mail is handled as follows: > > In to MailScanner (currently 4.63 I believe?) > MS checks it against my internal and externally selected BL's > If MS tags it as spam, we changed it to read [Spam-MS] > If it's tagged, depending on the settings it's delivered > as an attachment or dumped at that point. > If it passes cleanly, then it's tossed to SpamAssassin > (currently the 3.02 patch from Ensim version) > SA then uses my rulesets to determine if it is to be > checked and not whitelisted (not AWL'ed) > If pass, then SA performs my ruleset checks for spam > (RulesdeJour & custom rulesets, etc.) > If SA finds it as Spam, tags it [SA-Spam] so we know which > process did what to it. > If passed or below the threshold, delivered to User. > > Now, from what little I can gather from Ensim folks & > forums, these processes should be running as 'root'. One thing > that never surfaced until you mentioned it here was the fact > that Ensim (or something) is writing a .spamassassin dir in > each domain and for each user that holds the Bayes & AWL info > along with anything else specific for that User. > > Reason here may be that Ensim Pro gives the option to > have spam handling done via the GUI either by just the server > alone or optionally by each User in their GUI. They get to > set the threshold of spam, personal whitelists, etc. and > determine if it should hold spam or just delete it if it's > been tagged by SA. MS tagging is prior to SA handling, so > any options picked by the User would only apply if SA got to > process the mail in question. We have User Spam Controls > turned on as a percentage of our Users like the more direct > control and it saves us hassles of 'censorship' if we were > the only party determining what's spam and what's not. > > Again, I did go in and nail the AWL file for the account > I get MailScanner mail to. That did stop the AWL rating from > appearing until it had built a file back up. I can't find a > spot to stop SA from creating that file once I've deleted it, > I'm presuming that's my whole problem there. > > As a side note, I've also noticed MS skipping some > e-mails, we don't do a volume where that should be happening > but I did increase some settings that seem to have lowered > the skip rate to a level we can deal with. > > There is an option with this Ensim goofy setup to > double-run SA if you change the MailScanner.conf file, but > we have that set to only use the SA prefs file and all those > settings in the MS.conf file are disabled/commented out, etc. > So as far as I can see, the flow above is what's happening > and MS is the lead application in handling mail to be scanned. > > Any questions, don't hestitate to fire away! > > Thanks, > > Dave > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth >>Sent: Wednesday, April 27, 2005 11:14 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: AWL problems >> >> >>Dave >> >>the awl will (should) only get created for the user >>MailScanner runs as. >> >>Are you sure you're running SA from the MTA/procmail etc?? >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Dave Duffner - PSCGi wrote: >> >>> See now he's hitting the same wall I am... >>> >>> Even deleting the AWL's for the individual accounts, MS is >>>still compiling the AWL file. And that's with all the >> >>config points >> >>>possible turned off, MS indicating that autolearn is disabled. >>> >>> Since deleting the AWL file in the .spamassassin >> >>dir for each >> >>>user, it's lowered the point value back down to 0.0 and then starts >>>averaging it back up. Julian's ratings for his posts here >> >>that I get >> >>>stopped AWL rating it, then started with a 0.0 and as I get more of >>>his posts I think we're up to a 0.9 rating. Once it sees enough of >>>his posts, it'll be back to tagging his mail until I kill that AWL >>>file in that account's dir again. >>> >>> Chris may not be that far along in the process yet, but it >>>certainly sounds like he's heading in that direction. >>> >>> So either we've got a weird bug or there's some >> >>setting being >> >>>overridden or hidden somewhere so deep that it's triggering the AWL >>>ratings again. And with a ton of accounts, that's a serious PIA to >>>have to manually delete AWL files on a constant basis to >> >>kill it off. >> >>> I'm open for any suggestions, scripts, cron jobs or >> >>otherwise >> >>>to get that fool thing stopped. In our case we're using an Ensim >>>Hosting OS, so we're stuck with 3.XX of SA as any upgrades that >>>might've fixed this would either foul up Ensim or be overwritten in >>>the next half-a'ed upgrade or patch from Ensim for the OS. >>> >>> David J. Duffner >>> President >>> PSCGi >>> Paradise Shore Communications Group >>> www.pscginternet.com >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: MailScanner mailing list >> >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >> >>>>Behalf Of Martin Hepworth >>>>Sent: Wednesday, April 27, 2005 10:49 AM >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: AWL problems >>>> >>>> >>>>Chris >>>> >>>>if you're using SA 3.x this doesn't work. You'll need to >> >>turn it off >> >>>>in the SA config files. >>>> >>>>-- >>>>Martin Hepworth >>>>Snr Systems Administrator >>>>Solid State Logic >>>>Tel: +44 (0)1865 842300 >>>> >>>> >>>>Fractal IT Dept. wrote: >>>> >>>> >>>>>Hi everyone, >>>>> >>>>>I'm having a problem with ham becoming spam because it >> >>receives AWL >> >>>>>points. I'm not sure why this is happening, because in my >>>>>mailscanner.conf file, I have: >>>>> >>>>>SpamAssassin Auto Whitelist = no >>>>> >>>>>Any thoughts as to what could possibly be causing this? >>>>> >>>>>Thanks, >>>>>Chris >>> >>> >>> >>>I--I >>>Message scanned by MailScanner, and is believed to be clean. >>>CONFIDENTIALITY NOTICE: This transmission intended for the >> >>specified >> >>>destination and person. If this is not you, this >>>e-mail must be deleted immediately. www.pscginternet.com >>> >>>------------------------ MailScanner list >> >>------------------------ To >> >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>mailscanner' in the body of the email. Before posting, read >> >>the Wiki >> >>>(http://wiki.mailscanner.info/) and the archives >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential >>and intended solely for the use of the individual or entity >>to whom they are addressed. If you have received this email >>in error please notify the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' >>in the body of the email. Before posting, read the Wiki >>(http://wiki.mailscanner.info/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>I--I >>Message scanned by MailScanner, and is believed to be clean. >>CONFIDENTIALITY NOTICE: This transmission intended for the >>specified destination and person. If this is not you, this >>e-mail must be deleted immediately. www.pscginternet.com >> > > > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From hermit921 at YAHOO.COM Wed Apr 27 16:38:55 2005 From: hermit921 at YAHOO.COM (hermit921) Date: Thu Jan 12 21:29:24 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] We picked the most conservative list we could find, CBL. We use it in the MTA, and it rejects over 50% of incoming mail connections. Not one complaint in the last year, and we get over 100,000 messages per day. hermit921 At 04:49 AM 4/27/2005, José Angel Blanco González wrote: >Any one knows reliable rbl list? No matter if they are not free. >Now I am receiving false positives from wanadoo, hotmail,etc. accounts > >Thank you very much >Jose ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From csweeney at OSUBUCKS.ORG Wed Apr 27 15:50:47 2005 From: csweeney at OSUBUCKS.ORG (Chris Sweeney) Date: Thu Jan 12 21:29:24 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have been very happy with NJABL have you tried it? Chris > We picked the most conservative list we could find, CBL. We use it in the > MTA, and it rejects over 50% of incoming mail connections. Not one > complaint in the last year, and we get over 100,000 messages per day. > > hermit921 > > > At 04:49 AM 4/27/2005, José Angel Blanco González wrote: >>Any one knows reliable rbl list? No matter if they are not free. >>Now I am receiving false positives from wanadoo, hotmail,etc. accounts >> >>Thank you very much >>Jose > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > This message has been scanned for viruses and > dangerous content by MailScanner, and is > believed to be clean. > MailScanner thanks transtec Computers for their support. > > Thanks Chris Sweeney 513-290-8550 - Verizon csweeney05@vtext.com - Text MSG csweeney@osubucks.org -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From webalizer at NWCWEB.COM Wed Apr 27 17:05:53 2005 From: webalizer at NWCWEB.COM (Dave Duffner - PSCGi) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Martin, Yep, it's put together like TinkerToys and their a bit apathetic lately about supporting anything in real-time. Took 2-4 extra months to get the SA 3.02 patch out of them to bring it up to near-normal. Not sure if they've even worked with Julian on this, would be the most intelligent way to handle it. And Ensim, sadly, is one of the best managed hosting OS'es out there for everyday use, just a mess behind the scenes. Plesk is the next-best option, but you sacrifice certain elements to get others and we haven't been prepared to go that route at this point. Now Ensim shouldn't be calling SA outside of MS, the MS/Sa/ClamAV anti-spam package they started in version 3.7.XX of Ensim Pro is supposed to be self-contained and function as I outlined. If something else, like Sendmail, is calling it up and causing those files to be written per-user, there has to be a way to disable that. But we've got no clue here on where that would be happening, even tailing & top'ing monitoring of the process shows the layout I outlined. So once Sendmail hands it off to MS, it falls into that flow I laid out. I'm not as concerned about the fact it's writing AWL files into User dirs as I am that I've told SA to lay off using that rating and it's still doing it. That would seem to be more within the MS/SA package, not Ensim doing something additional, especially without it being logged where we can find it? MS has been instructed to ignore the AWL, SA has been instructed to ignore it, but when SA is run, it's like it's picking up some other instruction set that's not configured to ignore the AWL? Any thoughts on where that conf file might be or the filename to search the server for to see if that's the case? The prefs file is configured properly, but that's in the MS/SA's root dir. If Ensim deployed additional copies of those somehow and they're not getting updated, that could be the problem. But we're clueless on what to look for to determine if that's the case. Dave > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > Sent: Wednesday, April 27, 2005 11:51 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: AWL problems > > > Dave > > ah that's the problem then Ensim's calling SA outside of > MS.....yes it gives per user control but can give issues. > (also will be MS 4.36 I guess as 4.41 is latest beta) > > The more I hear about ensim the less i like it, and they > don't give Julian any 'help' just take the code. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Dave Duffner - PSCGi wrote: > > Martin, > > > > Ensim's whacky modification of the MS/SA package in their > > Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard by > any means. > > I've asked 1,000 times for someone to clarify how the mail > is passed > > through the processes to determine which 'entity' gets what when in > > order to fix problems like this and others where it's tagged > > strangely. > > > > Ensim does use a fully chrooted environment, which I know > > drives everyone insane, but may be part of the problem. Not > sure what > > Chris is using to know if we match or if he has a totally different > > setup with the same problem. > > > > In my case, I'm told mail is handled as follows: > > > > In to MailScanner (currently 4.63 I believe?) > > MS checks it against my internal and externally > selected BL's > > If MS tags it as spam, we changed it to read [Spam-MS] > > If it's tagged, depending on the settings it's delivered > > as an attachment or dumped at that point. > > If it passes cleanly, then it's tossed to SpamAssassin > > (currently the 3.02 patch from Ensim version) > > SA then uses my rulesets to determine if it is to be > > checked and not whitelisted (not AWL'ed) > > If pass, then SA performs my ruleset checks for spam > > (RulesdeJour & custom rulesets, etc.) > > If SA finds it as Spam, tags it [SA-Spam] so we know which > > process did what to it. > > If passed or below the threshold, delivered to User. > > > > Now, from what little I can gather from Ensim folks > & forums, > > these processes should be running as 'root'. One thing that never > > surfaced until you mentioned it here was the fact that Ensim (or > > something) is writing a .spamassassin dir in each domain > and for each > > user that holds the Bayes & AWL info along with anything > else specific > > for that User. > > > > Reason here may be that Ensim Pro gives the option to have > > spam handling done via the GUI either by just the server alone or > > optionally by each User in their GUI. They get to set the > threshold > > of spam, personal whitelists, etc. and determine if it should hold > > spam or just delete it if it's been tagged by SA. MS > tagging is prior > > to SA handling, so any options picked by the User would > only apply if > > SA got to process the mail in question. We have User Spam Controls > > turned on as a percentage of our Users like the more direct > > control and it saves us hassles of 'censorship' if we were > > the only party determining what's spam and what's not. > > > > Again, I did go in and nail the AWL file for the > account I get > > MailScanner mail to. That did stop the AWL rating from appearing > > until it had built a file back up. I can't find a spot to stop SA > > from creating that file once I've deleted it, I'm presuming > that's my > > whole problem there. > > > > As a side note, I've also noticed MS skipping some > e-mails, we > > don't do a volume where that should be happening but I did increase > > some settings that seem to have lowered the skip rate to a level we > > can deal with. > > > > There is an option with this Ensim goofy setup to > double-run > > SA if you change the MailScanner.conf file, but we have that set to > > only use the SA prefs file and all those settings in the > MS.conf file > > are disabled/commented out, etc. So as far as I can see, the flow > > above is what's happening and MS is the lead application in > handling > > mail to be scanned. > > > > Any questions, don't hestitate to fire away! > > > > Thanks, > > > > Dave > > > > > > > >>-----Original Message----- > >>From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >>Behalf Of Martin Hepworth > >>Sent: Wednesday, April 27, 2005 11:14 AM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Re: AWL problems > >> > >> > >>Dave > >> > >>the awl will (should) only get created for the user > MailScanner runs > >>as. > >> > >>Are you sure you're running SA from the MTA/procmail etc?? > >> > >>-- > >>Martin Hepworth > >>Snr Systems Administrator > >>Solid State Logic > >>Tel: +44 (0)1865 842300 > >> > >> > >>Dave Duffner - PSCGi wrote: > >> > >>> See now he's hitting the same wall I am... > >>> > >>> Even deleting the AWL's for the individual accounts, MS is > >>>still compiling the AWL file. And that's with all the > >> > >>config points > >> > >>>possible turned off, MS indicating that autolearn is disabled. > >>> > >>> Since deleting the AWL file in the .spamassassin > >> > >>dir for each > >> > >>>user, it's lowered the point value back down to 0.0 and > then starts > >>>averaging it back up. Julian's ratings for his posts here > >> > >>that I get > >> > >>>stopped AWL rating it, then started with a 0.0 and as I > get more of > >>>his posts I think we're up to a 0.9 rating. Once it sees > enough of > >>>his posts, it'll be back to tagging his mail until I kill that AWL > >>>file in that account's dir again. > >>> > >>> Chris may not be that far along in the process yet, but it > >>>certainly sounds like he's heading in that direction. > >>> > >>> So either we've got a weird bug or there's some > >> > >>setting being > >> > >>>overridden or hidden somewhere so deep that it's > triggering the AWL > >>>ratings again. And with a ton of accounts, that's a > serious PIA to > >>>have to manually delete AWL files on a constant basis to > >> > >>kill it off. > >> > >>> I'm open for any suggestions, scripts, cron jobs or > >> > >>otherwise > >> > >>>to get that fool thing stopped. In our case we're using an Ensim > >>>Hosting OS, so we're stuck with 3.XX of SA as any upgrades that > >>>might've fixed this would either foul up Ensim or be > overwritten in > >>>the next half-a'ed upgrade or patch from Ensim for the OS. > >>> > >>> David J. Duffner > >>> President > >>> PSCGi > >>> Paradise Shore Communications Group > >>> www.pscginternet.com > >>> > >>> > >>> > >>> > >>>>-----Original Message----- > >>>>From: MailScanner mailing list > >> > >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >> > >>>>Behalf Of Martin Hepworth > >>>>Sent: Wednesday, April 27, 2005 10:49 AM > >>>>To: MAILSCANNER@JISCMAIL.AC.UK > >>>>Subject: Re: AWL problems > >>>> > >>>> > >>>>Chris > >>>> > >>>>if you're using SA 3.x this doesn't work. You'll need to > >> > >>turn it off > >> > >>>>in the SA config files. > >>>> > >>>>-- > >>>>Martin Hepworth > >>>>Snr Systems Administrator > >>>>Solid State Logic > >>>>Tel: +44 (0)1865 842300 > >>>> > >>>> > >>>>Fractal IT Dept. wrote: > >>>> > >>>> > >>>>>Hi everyone, > >>>>> > >>>>>I'm having a problem with ham becoming spam because it > >> > >>receives AWL > >> > >>>>>points. I'm not sure why this is happening, because in my > >>>>>mailscanner.conf file, I have: > >>>>> > >>>>>SpamAssassin Auto Whitelist = no > >>>>> > >>>>>Any thoughts as to what could possibly be causing this? > >>>>> > >>>>>Thanks, > >>>>>Chris > >>> > >>> > >>> > >>>I--I > >>>Message scanned by MailScanner, and is believed to be clean. > >>>CONFIDENTIALITY NOTICE: This transmission intended for the > >> > >>specified > >> > >>>destination and person. If this is not you, this > >>>e-mail must be deleted immediately. www.pscginternet.com > >>> > >>>------------------------ MailScanner list > >> > >>------------------------ To > >> > >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > >>>mailscanner' in the body of the email. Before posting, read > >> > >>the Wiki > >> > >>>(http://wiki.mailscanner.info/) and the archives > >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>>Support MailScanner development - buy the book off the website! > >> > >>************************************************************ > ********** > >> > >>This email and any files transmitted with it are confidential and > >>intended solely for the use of the individual or entity to > whom they > >>are addressed. If you have received this email in error > please notify > >>the system manager. > >> > >>This footnote confirms that this email message has been > swept for the > >>presence of computer viruses and is believed to be clean. > >> > >>************************************************************ > ********** > >> > >>------------------------ MailScanner list > >>------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk > >>with the words: 'leave mailscanner' in the body of the > email. Before > >>posting, read the Wiki > >>(http://wiki.mailscanner.info/) and the archives > >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >>Support MailScanner development - buy the book off the website! > >> > >>I--I > >>Message scanned by MailScanner, and is believed to be clean. > >>CONFIDENTIALITY NOTICE: This transmission intended for the > specified > >>destination and person. If this is not you, this > >>e-mail must be deleted immediately. www.pscginternet.com > >> > > > > > > > > I--I > > Message scanned by MailScanner, and is believed to be clean. > > CONFIDENTIALITY NOTICE: This transmission intended for the > specified > > destination and person. If this is not you, this > > e-mail must be deleted immediately. www.pscginternet.com > > > > ------------------------ MailScanner list > ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > > mailscanner' in the body of the email. Before posting, read > the Wiki > > (http://wiki.mailscanner.info/) and the archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential > and intended solely for the use of the individual or entity > to whom they are addressed. If you have received this email > in error please notify the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list > ------------------------ To unsubscribe, email > jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' > in the body of the email. Before posting, read the Wiki > (http://wiki.mailscanner.info/) and the archives > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > I--I Message scanned by MailScanner, and is believed to be clean. CONFIDENTIALITY NOTICE: This transmission intended for the specified destination and person. If this is not you, this e-mail must be deleted immediately. www.pscginternet.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From R.A.Gardener at SHU.AC.UK Wed Apr 27 17:11:48 2005 From: R.A.Gardener at SHU.AC.UK (Ray Gardener) Date: Thu Jan 12 21:29:24 2006 Subject: sophossavi errors on Red Hat Enterprise version 4 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, Thanks for taking the trouble to reply. we are using 32bit processors so I don't think this is the issue but I will check. > Ray > > from my misty memory I remember Julian (or someone) commenting on this > and finding out that Sophos themselves have a problem with 64bit Linux > kernels, and are working to fox it sometime. > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Ray Gardener wrote: >> Hi, >> >> I recently upgraded one of my servers to RHEL version 4. After bringing >> this into use I noticed a problem with load on the server going up >> dramatically. On inspection I saw a mailscanner process consuming 1.4GB >> of >> memory. This was causing the system to page memory frantically!!!. >> Looking in the log files I saw indications that sophossavi was seeing >> some >> of the mail as a denial of service attack and noticed that certain files >> from my incoming spool file were not been processed. However some of the >> files were been processed. I switched the scanner type from sophossavi >> to >> sophos and these files were cleared and the problems with memory and >> load >> haven't reoccurred. Thinking that there was some problem with Savi-Perl >> I >> downloaded the latest version and recompiled it. It ran make OK; but on >> "make test" I got the following message below. [At the end of this >> message >> are the details of my system and version of mailscanner] Obviously I am >> OK >> using sophos but would like sophossavi to work - Has anyone got this >> working under RHEL 4 or had similar problem (with hopefully a fix)? >> >> _________________________________________________________________________ >> PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-e" >> "test_harness(0, 'blib/lib', 'blib/arch')" t/*.t >> t/use....Can't load >> '/home/cisrag/SAVI-Perl-0.30/blib/arch/auto/SAVI/SAVI.so' for module >> SAVI: >> libsavi.so.3: cannot open shared object file: No such file or directory >> at >> /usr/lib/perl5/5.8.5/i386-linux-thread-multi/DynaLoader.pm line 230. >> at t/use.t line 8 >> Compilation failed in require at t/use.t line 8. >> BEGIN failed--compilation aborted at t/use.t line 8. >> t/use....dubious >> Test returned status 255 (wstat 65280, 0xff00) >> DIED. FAILED test 1 >> Failed 1/1 tests, 0.00% okay >> Failed Test Stat Wstat Total Fail Failed List of Failed >> ------------------------------------------------------------------------------- >> t/use.t 255 65280 1 2 200.00% 1 >> Failed 1/1 test scripts, 0.00% okay. 1/1 subtests failed, 0.00% okay. >> ------------------------------------------------------------------------- >> >> System details >> uname -a >> Linux coffee.shu.ac.uk 2.6.9-5.0.5.ELsmp #1 SMP Fri Apr 8 14:29:47 EDT >> 2005 i686 i686 i386 GNU/Linux >> 2Gb memory dual Xeon system >> Runni > ng Red hat Enterprise Edition version 4 >> >> MailScanner version is 4.40.11 >> >> >> -- >> Ray Gardener >> CIS >> Sheffield Hallam University >> Telephone: 0114 225 4926 >> Email: R.A.Gardener@shu.ac.uk >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > -- Ray Gardener CIS Sheffield Hallam University Telephone: 0114 225 4926 Email: R.A.Gardener@shu.ac.uk ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Apr 27 14:27:19 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:24 2006 Subject: Whitelists + blacklists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wayne wrote: > On 27/04/2005 14:04, "Dhawal Doshy" wrote: > > >>Read CustomConfig.pm for more details.. > > > Hi Dhawal, > > Yeah that's where I saw the info on using a file called default. > In the file /etc/MailScanner/spam.bydomain/whitelist/nightsol.net > I have > wayne@nightsol.net > In the file /etc/MailScanner/spam.bydomain/whitelist/default > I have > wayne@nightsol.net > > But this is only whitelisting mail in *from* wayne@nightsol.net > I want to whitelist all mail *to* wayne@nightsol.net > > Before I enabled the whitelist / blacklist per domain from CustomConfig.pm > In MailScanner.conf I could set rules so that all mail *to* an address was > whitelisted. > I want to be able to do that now again for my account.. > > Thanks, > Wayne Just a vague idea.. try this if the server is not production, though i'm not too sure if it'll work.. Is Definitely Not Spam = %rules-dir%/some.file.ending.in.rules Content of some.file.ending.in.rules ==================================== To: wayne@nightsol.net yes FromOrTo: default &ByDomainSpamWhitelist - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 17:27:58 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: Whitelists + blacklists Message-ID: Ok, for anybody who is interested here is how I fixed this. Im using postfix so I changed it so that postfix did not hold mail for wayne@nightsol.net Postfix follows restrictions in the following order 1. smtpd_client_restrictions 2. smtpd_helo_restrictions 3. smtpd_sender_restrictions 4. smtpd_recipient_restrictions So in my main.cf I have placed: smtpd_sender_restrictions = permit_sasl_authenticated And also: smtpd_recipient_restrictions = reject_unauth_destination, check_recipient_access hash:/etc/postfix/access.recipient, static:hold /etc/postfix/access.recipient contains wayne@nightsol.net OK static:hold above tells postfix to hold the mail for MailScanner which isnt Coming from authenticated users. Reason I have done it this way is that I also use the mailserver for outgoing mail using SMTP Auth. I know this is postfix specific but it might be of help to somebody in the same situation as me down the line. Regards, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Wed Apr 27 17:29:52 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Dave Duffner - PSCGi > Sent: Wednesday, April 27, 2005 12:06 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: AWL problems > > Martin, > > Yep, it's put together like TinkerToys and their a > bit apathetic lately about supporting anything in real-time. > Took 2-4 extra months to get the SA 3.02 patch out of them > to bring it up to near-normal. > > Not sure if they've even worked with Julian on this, > would be the most intelligent way to handle it. And Ensim, > sadly, is one of the best managed hosting OS'es out there > for everyday use, just a mess behind the scenes. Plesk is > the next-best option, but you sacrifice certain elements > to get others and we haven't been prepared to go that route > at this point. > > Now Ensim shouldn't be calling SA outside of MS, the > MS/Sa/ClamAV anti-spam package they started in version 3.7.XX > of Ensim Pro is supposed to be self-contained and function > as I outlined. If something else, like Sendmail, is calling > it up and causing those files to be written per-user, there > has to be a way to disable that. But we've got no clue here > on where that would be happening, even tailing & top'ing > monitoring of the process shows the layout I outlined. > > So once Sendmail hands it off to MS, it falls into > that flow I laid out. I'm not as concerned about the fact > it's writing AWL files into User dirs as I am that I've > told SA to lay off using that rating and it's still doing > it. That would seem to be more within the MS/SA package, > not Ensim doing something additional, especially without > it being logged where we can find it? > > MS has been instructed to ignore the AWL, SA has been > instructed to ignore it, but when SA is run, it's like it's > picking up some other instruction set that's not configured > to ignore the AWL? Any thoughts on where that conf file > might be or the filename to search the server for to see if > that's the case? The prefs file is configured properly, but > that's in the MS/SA's root dir. If Ensim deployed additional > copies of those somehow and they're not getting updated, that > could be the problem. But we're clueless on what to look > for to determine if that's the case. > > Dave > > If I remember Ensim correctly each user has a ~/.spamassassin directory with a personal configuration file - something like local.cf in that directory. If nothing else works it should be simple to find all of these files and add the line that turns off auto white listing to each file. use_auto_whitelist 0 Steve Steve Swaney President Fortress Systems Ltd. Phone: 202 338-1670 Cell: 202 352-3262 www.fsl.com steve.swaney@fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 17:30:10 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Dave if MS isn't tagging correctly sounds like another sendmail might be still listening on port 25 and moving the email itself. Which would also explain how SA is getting called outside of MS.... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Dave Duffner - PSCGi wrote: > Martin, > > Yep, it's put together like TinkerToys and their a > bit apathetic lately about supporting anything in real-time. > Took 2-4 extra months to get the SA 3.02 patch out of them > to bring it up to near-normal. > > Not sure if they've even worked with Julian on this, > would be the most intelligent way to handle it. And Ensim, > sadly, is one of the best managed hosting OS'es out there > for everyday use, just a mess behind the scenes. Plesk is > the next-best option, but you sacrifice certain elements > to get others and we haven't been prepared to go that route > at this point. > > Now Ensim shouldn't be calling SA outside of MS, the > MS/Sa/ClamAV anti-spam package they started in version 3.7.XX > of Ensim Pro is supposed to be self-contained and function > as I outlined. If something else, like Sendmail, is calling > it up and causing those files to be written per-user, there > has to be a way to disable that. But we've got no clue here > on where that would be happening, even tailing & top'ing > monitoring of the process shows the layout I outlined. > > So once Sendmail hands it off to MS, it falls into > that flow I laid out. I'm not as concerned about the fact > it's writing AWL files into User dirs as I am that I've > told SA to lay off using that rating and it's still doing > it. That would seem to be more within the MS/SA package, > not Ensim doing something additional, especially without > it being logged where we can find it? > > MS has been instructed to ignore the AWL, SA has been > instructed to ignore it, but when SA is run, it's like it's > picking up some other instruction set that's not configured > to ignore the AWL? Any thoughts on where that conf file > might be or the filename to search the server for to see if > that's the case? The prefs file is configured properly, but > that's in the MS/SA's root dir. If Ensim deployed additional > copies of those somehow and they're not getting updated, that > could be the problem. But we're clueless on what to look > for to determine if that's the case. > > Dave > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth >>Sent: Wednesday, April 27, 2005 11:51 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: AWL problems >> >> >>Dave >> >>ah that's the problem then Ensim's calling SA outside of >>MS.....yes it gives per user control but can give issues. >>(also will be MS 4.36 I guess as 4.41 is latest beta) >> >>The more I hear about ensim the less i like it, and they >>don't give Julian any 'help' just take the code. >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Dave Duffner - PSCGi wrote: >> >>>Martin, >>> >>> Ensim's whacky modification of the MS/SA package in their >>>Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard by >> >>any means. >> >>>I've asked 1,000 times for someone to clarify how the mail >> >>is passed >> >>>through the processes to determine which 'entity' gets what when in >>>order to fix problems like this and others where it's tagged >>>strangely. >>> >>> Ensim does use a fully chrooted environment, which I know >>>drives everyone insane, but may be part of the problem. Not >> >>sure what >> >>>Chris is using to know if we match or if he has a totally different >>>setup with the same problem. >>> >>> In my case, I'm told mail is handled as follows: >>> >>> In to MailScanner (currently 4.63 I believe?) >>> MS checks it against my internal and externally >> >>selected BL's >> >>> If MS tags it as spam, we changed it to read [Spam-MS] >>> If it's tagged, depending on the settings it's delivered >>> as an attachment or dumped at that point. >>> If it passes cleanly, then it's tossed to SpamAssassin >>> (currently the 3.02 patch from Ensim version) >>> SA then uses my rulesets to determine if it is to be >>> checked and not whitelisted (not AWL'ed) >>> If pass, then SA performs my ruleset checks for spam >>> (RulesdeJour & custom rulesets, etc.) >>> If SA finds it as Spam, tags it [SA-Spam] so we know which >>> process did what to it. >>> If passed or below the threshold, delivered to User. >>> >>> Now, from what little I can gather from Ensim folks >> >>& forums, >> >>>these processes should be running as 'root'. One thing that never >>>surfaced until you mentioned it here was the fact that Ensim (or >>>something) is writing a .spamassassin dir in each domain >> >>and for each >> >>>user that holds the Bayes & AWL info along with anything >> >>else specific >> >>>for that User. >>> >>> Reason here may be that Ensim Pro gives the option to have >>>spam handling done via the GUI either by just the server alone or >>>optionally by each User in their GUI. They get to set the >> >>threshold >> >>>of spam, personal whitelists, etc. and determine if it should hold >>>spam or just delete it if it's been tagged by SA. MS >> >>tagging is prior >> >>>to SA handling, so any options picked by the User would >> >>only apply if >> >>>SA got to process the mail in question. We have User Spam Controls >>>turned on as a percentage of our Users like the more direct >>>control and it saves us hassles of 'censorship' if we were >>>the only party determining what's spam and what's not. >>> >>> Again, I did go in and nail the AWL file for the >> >>account I get >> >>>MailScanner mail to. That did stop the AWL rating from appearing >>>until it had built a file back up. I can't find a spot to stop SA >>>from creating that file once I've deleted it, I'm presuming >> >>that's my >> >>>whole problem there. >>> >>> As a side note, I've also noticed MS skipping some >> >>e-mails, we >> >>>don't do a volume where that should be happening but I did increase >>>some settings that seem to have lowered the skip rate to a level we >>>can deal with. >>> >>> There is an option with this Ensim goofy setup to >> >>double-run >> >>>SA if you change the MailScanner.conf file, but we have that set to >>>only use the SA prefs file and all those settings in the >> >>MS.conf file >> >>>are disabled/commented out, etc. So as far as I can see, the flow >>>above is what's happening and MS is the lead application in >> >>handling >> >>>mail to be scanned. >>> >>> Any questions, don't hestitate to fire away! >>> >>> Thanks, >>> >>> Dave >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: MailScanner mailing list >> >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >> >>>>Behalf Of Martin Hepworth >>>>Sent: Wednesday, April 27, 2005 11:14 AM >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: AWL problems >>>> >>>> >>>>Dave >>>> >>>>the awl will (should) only get created for the user >> >>MailScanner runs >> >>>>as. >>>> >>>>Are you sure you're running SA from the MTA/procmail etc?? >>>> >>>>-- >>>>Martin Hepworth >>>>Snr Systems Administrator >>>>Solid State Logic >>>>Tel: +44 (0)1865 842300 >>>> >>>> >>>>Dave Duffner - PSCGi wrote: >>>> >>>> >>>>> See now he's hitting the same wall I am... >>>>> >>>>> Even deleting the AWL's for the individual accounts, MS is >>>>>still compiling the AWL file. And that's with all the >>>> >>>>config points >>>> >>>> >>>>>possible turned off, MS indicating that autolearn is disabled. >>>>> >>>>> Since deleting the AWL file in the .spamassassin >>>> >>>>dir for each >>>> >>>> >>>>>user, it's lowered the point value back down to 0.0 and >> >>then starts >> >>>>>averaging it back up. Julian's ratings for his posts here >>>> >>>>that I get >>>> >>>> >>>>>stopped AWL rating it, then started with a 0.0 and as I >> >>get more of >> >>>>>his posts I think we're up to a 0.9 rating. Once it sees >> >>enough of >> >>>>>his posts, it'll be back to tagging his mail until I kill that AWL >>>>>file in that account's dir again. >>>>> >>>>> Chris may not be that far along in the process yet, but it >>>>>certainly sounds like he's heading in that direction. >>>>> >>>>> So either we've got a weird bug or there's some >>>> >>>>setting being >>>> >>>> >>>>>overridden or hidden somewhere so deep that it's >> >>triggering the AWL >> >>>>>ratings again. And with a ton of accounts, that's a >> >>serious PIA to >> >>>>>have to manually delete AWL files on a constant basis to >>>> >>>>kill it off. >>>> >>>> >>>>> I'm open for any suggestions, scripts, cron jobs or >>>> >>>>otherwise >>>> >>>> >>>>>to get that fool thing stopped. In our case we're using an Ensim >>>>>Hosting OS, so we're stuck with 3.XX of SA as any upgrades that >>>>>might've fixed this would either foul up Ensim or be >> >>overwritten in >> >>>>>the next half-a'ed upgrade or patch from Ensim for the OS. >>>>> >>>>> David J. Duffner >>>>> President >>>>> PSCGi >>>>> Paradise Shore Communications Group >>>>> www.pscginternet.com >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>-----Original Message----- >>>>>>From: MailScanner mailing list >>>> >>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>>> >>>> >>>>>>Behalf Of Martin Hepworth >>>>>>Sent: Wednesday, April 27, 2005 10:49 AM >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>Subject: Re: AWL problems >>>>>> >>>>>> >>>>>>Chris >>>>>> >>>>>>if you're using SA 3.x this doesn't work. You'll need to >>>> >>>>turn it off >>>> >>>> >>>>>>in the SA config files. >>>>>> >>>>>>-- >>>>>>Martin Hepworth >>>>>>Snr Systems Administrator >>>>>>Solid State Logic >>>>>>Tel: +44 (0)1865 842300 >>>>>> >>>>>> >>>>>>Fractal IT Dept. wrote: >>>>>> >>>>>> >>>>>> >>>>>>>Hi everyone, >>>>>>> >>>>>>>I'm having a problem with ham becoming spam because it >>>> >>>>receives AWL >>>> >>>> >>>>>>>points. I'm not sure why this is happening, because in my >>>>>>>mailscanner.conf file, I have: >>>>>>> >>>>>>>SpamAssassin Auto Whitelist = no >>>>>>> >>>>>>>Any thoughts as to what could possibly be causing this? >>>>>>> >>>>>>>Thanks, >>>>>>>Chris >>>>> >>>>> >>>>> >>>>>I--I >>>>>Message scanned by MailScanner, and is believed to be clean. >>>>>CONFIDENTIALITY NOTICE: This transmission intended for the >>>> >>>>specified >>>> >>>> >>>>>destination and person. If this is not you, this >>>>>e-mail must be deleted immediately. www.pscginternet.com >>>>> >>>>>------------------------ MailScanner list >>>> >>>>------------------------ To >>>> >>>> >>>>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>>>mailscanner' in the body of the email. Before posting, read >>>> >>>>the Wiki >>>> >>>> >>>>>(http://wiki.mailscanner.info/) and the archives >>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>> >>>>************************************************************ >> >>********** >> >>>>This email and any files transmitted with it are confidential and >>>>intended solely for the use of the individual or entity to >> >>whom they >> >>>>are addressed. If you have received this email in error >> >>please notify >> >>>>the system manager. >>>> >>>>This footnote confirms that this email message has been >> >>swept for the >> >>>>presence of computer viruses and is believed to be clean. >>>> >>>>************************************************************ >> >>********** >> >>>>------------------------ MailScanner list >>>>------------------------ To unsubscribe, email >> >>jiscmail@jiscmail.ac.uk >> >>>>with the words: 'leave mailscanner' in the body of the >> >>email. Before >> >>>>posting, read the Wiki >>>>(http://wiki.mailscanner.info/) and the archives >>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>>I--I >>>>Message scanned by MailScanner, and is believed to be clean. >>>>CONFIDENTIALITY NOTICE: This transmission intended for the >> >>specified >> >>>>destination and person. If this is not you, this >>>>e-mail must be deleted immediately. www.pscginternet.com >>>> >>> >>> >>> >>>I--I >>>Message scanned by MailScanner, and is believed to be clean. >>>CONFIDENTIALITY NOTICE: This transmission intended for the >> >>specified >> >>>destination and person. If this is not you, this >>>e-mail must be deleted immediately. www.pscginternet.com >>> >>>------------------------ MailScanner list >> >>------------------------ To >> >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>mailscanner' in the body of the email. Before posting, read >> >>the Wiki >> >>>(http://wiki.mailscanner.info/) and the archives >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential >>and intended solely for the use of the individual or entity >>to whom they are addressed. If you have received this email >>in error please notify the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' >>in the body of the email. Before posting, read the Wiki >>(http://wiki.mailscanner.info/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>I--I >>Message scanned by MailScanner, and is believed to be clean. >>CONFIDENTIALITY NOTICE: This transmission intended for the >>specified destination and person. If this is not you, this >>e-mail must be deleted immediately. www.pscginternet.com >> > > > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 17:18:50 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Of course you could alway build a MS box to act as gateway to the ensim thing and do things in a known way. Should ensim themselves support MS if they are messing with it's config... -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Dave Duffner - PSCGi wrote: > Martin, > > Yep, it's put together like TinkerToys and their a > bit apathetic lately about supporting anything in real-time. > Took 2-4 extra months to get the SA 3.02 patch out of them > to bring it up to near-normal. > > Not sure if they've even worked with Julian on this, > would be the most intelligent way to handle it. And Ensim, > sadly, is one of the best managed hosting OS'es out there > for everyday use, just a mess behind the scenes. Plesk is > the next-best option, but you sacrifice certain elements > to get others and we haven't been prepared to go that route > at this point. > > Now Ensim shouldn't be calling SA outside of MS, the > MS/Sa/ClamAV anti-spam package they started in version 3.7.XX > of Ensim Pro is supposed to be self-contained and function > as I outlined. If something else, like Sendmail, is calling > it up and causing those files to be written per-user, there > has to be a way to disable that. But we've got no clue here > on where that would be happening, even tailing & top'ing > monitoring of the process shows the layout I outlined. > > So once Sendmail hands it off to MS, it falls into > that flow I laid out. I'm not as concerned about the fact > it's writing AWL files into User dirs as I am that I've > told SA to lay off using that rating and it's still doing > it. That would seem to be more within the MS/SA package, > not Ensim doing something additional, especially without > it being logged where we can find it? > > MS has been instructed to ignore the AWL, SA has been > instructed to ignore it, but when SA is run, it's like it's > picking up some other instruction set that's not configured > to ignore the AWL? Any thoughts on where that conf file > might be or the filename to search the server for to see if > that's the case? The prefs file is configured properly, but > that's in the MS/SA's root dir. If Ensim deployed additional > copies of those somehow and they're not getting updated, that > could be the problem. But we're clueless on what to look > for to determine if that's the case. > > Dave > > > >>-----Original Message----- >>From: MailScanner mailing list >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth >>Sent: Wednesday, April 27, 2005 11:51 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: AWL problems >> >> >>Dave >> >>ah that's the problem then Ensim's calling SA outside of >>MS.....yes it gives per user control but can give issues. >>(also will be MS 4.36 I guess as 4.41 is latest beta) >> >>The more I hear about ensim the less i like it, and they >>don't give Julian any 'help' just take the code. >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Dave Duffner - PSCGi wrote: >> >>>Martin, >>> >>> Ensim's whacky modification of the MS/SA package in their >>>Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard by >> >>any means. >> >>>I've asked 1,000 times for someone to clarify how the mail >> >>is passed >> >>>through the processes to determine which 'entity' gets what when in >>>order to fix problems like this and others where it's tagged >>>strangely. >>> >>> Ensim does use a fully chrooted environment, which I know >>>drives everyone insane, but may be part of the problem. Not >> >>sure what >> >>>Chris is using to know if we match or if he has a totally different >>>setup with the same problem. >>> >>> In my case, I'm told mail is handled as follows: >>> >>> In to MailScanner (currently 4.63 I believe?) >>> MS checks it against my internal and externally >> >>selected BL's >> >>> If MS tags it as spam, we changed it to read [Spam-MS] >>> If it's tagged, depending on the settings it's delivered >>> as an attachment or dumped at that point. >>> If it passes cleanly, then it's tossed to SpamAssassin >>> (currently the 3.02 patch from Ensim version) >>> SA then uses my rulesets to determine if it is to be >>> checked and not whitelisted (not AWL'ed) >>> If pass, then SA performs my ruleset checks for spam >>> (RulesdeJour & custom rulesets, etc.) >>> If SA finds it as Spam, tags it [SA-Spam] so we know which >>> process did what to it. >>> If passed or below the threshold, delivered to User. >>> >>> Now, from what little I can gather from Ensim folks >> >>& forums, >> >>>these processes should be running as 'root'. One thing that never >>>surfaced until you mentioned it here was the fact that Ensim (or >>>something) is writing a .spamassassin dir in each domain >> >>and for each >> >>>user that holds the Bayes & AWL info along with anything >> >>else specific >> >>>for that User. >>> >>> Reason here may be that Ensim Pro gives the option to have >>>spam handling done via the GUI either by just the server alone or >>>optionally by each User in their GUI. They get to set the >> >>threshold >> >>>of spam, personal whitelists, etc. and determine if it should hold >>>spam or just delete it if it's been tagged by SA. MS >> >>tagging is prior >> >>>to SA handling, so any options picked by the User would >> >>only apply if >> >>>SA got to process the mail in question. We have User Spam Controls >>>turned on as a percentage of our Users like the more direct >>>control and it saves us hassles of 'censorship' if we were >>>the only party determining what's spam and what's not. >>> >>> Again, I did go in and nail the AWL file for the >> >>account I get >> >>>MailScanner mail to. That did stop the AWL rating from appearing >>>until it had built a file back up. I can't find a spot to stop SA >>>from creating that file once I've deleted it, I'm presuming >> >>that's my >> >>>whole problem there. >>> >>> As a side note, I've also noticed MS skipping some >> >>e-mails, we >> >>>don't do a volume where that should be happening but I did increase >>>some settings that seem to have lowered the skip rate to a level we >>>can deal with. >>> >>> There is an option with this Ensim goofy setup to >> >>double-run >> >>>SA if you change the MailScanner.conf file, but we have that set to >>>only use the SA prefs file and all those settings in the >> >>MS.conf file >> >>>are disabled/commented out, etc. So as far as I can see, the flow >>>above is what's happening and MS is the lead application in >> >>handling >> >>>mail to be scanned. >>> >>> Any questions, don't hestitate to fire away! >>> >>> Thanks, >>> >>> Dave >>> >>> >>> >>> >>>>-----Original Message----- >>>>From: MailScanner mailing list >> >>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >> >>>>Behalf Of Martin Hepworth >>>>Sent: Wednesday, April 27, 2005 11:14 AM >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: AWL problems >>>> >>>> >>>>Dave >>>> >>>>the awl will (should) only get created for the user >> >>MailScanner runs >> >>>>as. >>>> >>>>Are you sure you're running SA from the MTA/procmail etc?? >>>> >>>>-- >>>>Martin Hepworth >>>>Snr Systems Administrator >>>>Solid State Logic >>>>Tel: +44 (0)1865 842300 >>>> >>>> >>>>Dave Duffner - PSCGi wrote: >>>> >>>> >>>>> See now he's hitting the same wall I am... >>>>> >>>>> Even deleting the AWL's for the individual accounts, MS is >>>>>still compiling the AWL file. And that's with all the >>>> >>>>config points >>>> >>>> >>>>>possible turned off, MS indicating that autolearn is disabled. >>>>> >>>>> Since deleting the AWL file in the .spamassassin >>>> >>>>dir for each >>>> >>>> >>>>>user, it's lowered the point value back down to 0.0 and >> >>then starts >> >>>>>averaging it back up. Julian's ratings for his posts here >>>> >>>>that I get >>>> >>>> >>>>>stopped AWL rating it, then started with a 0.0 and as I >> >>get more of >> >>>>>his posts I think we're up to a 0.9 rating. Once it sees >> >>enough of >> >>>>>his posts, it'll be back to tagging his mail until I kill that AWL >>>>>file in that account's dir again. >>>>> >>>>> Chris may not be that far along in the process yet, but it >>>>>certainly sounds like he's heading in that direction. >>>>> >>>>> So either we've got a weird bug or there's some >>>> >>>>setting being >>>> >>>> >>>>>overridden or hidden somewhere so deep that it's >> >>triggering the AWL >> >>>>>ratings again. And with a ton of accounts, that's a >> >>serious PIA to >> >>>>>have to manually delete AWL files on a constant basis to >>>> >>>>kill it off. >>>> >>>> >>>>> I'm open for any suggestions, scripts, cron jobs or >>>> >>>>otherwise >>>> >>>> >>>>>to get that fool thing stopped. In our case we're using an Ensim >>>>>Hosting OS, so we're stuck with 3.XX of SA as any upgrades that >>>>>might've fixed this would either foul up Ensim or be >> >>overwritten in >> >>>>>the next half-a'ed upgrade or patch from Ensim for the OS. >>>>> >>>>> David J. Duffner >>>>> President >>>>> PSCGi >>>>> Paradise Shore Communications Group >>>>> www.pscginternet.com >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>-----Original Message----- >>>>>>From: MailScanner mailing list >>>> >>>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>>> >>>> >>>>>>Behalf Of Martin Hepworth >>>>>>Sent: Wednesday, April 27, 2005 10:49 AM >>>>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>Subject: Re: AWL problems >>>>>> >>>>>> >>>>>>Chris >>>>>> >>>>>>if you're using SA 3.x this doesn't work. You'll need to >>>> >>>>turn it off >>>> >>>> >>>>>>in the SA config files. >>>>>> >>>>>>-- >>>>>>Martin Hepworth >>>>>>Snr Systems Administrator >>>>>>Solid State Logic >>>>>>Tel: +44 (0)1865 842300 >>>>>> >>>>>> >>>>>>Fractal IT Dept. wrote: >>>>>> >>>>>> >>>>>> >>>>>>>Hi everyone, >>>>>>> >>>>>>>I'm having a problem with ham becoming spam because it >>>> >>>>receives AWL >>>> >>>> >>>>>>>points. I'm not sure why this is happening, because in my >>>>>>>mailscanner.conf file, I have: >>>>>>> >>>>>>>SpamAssassin Auto Whitelist = no >>>>>>> >>>>>>>Any thoughts as to what could possibly be causing this? >>>>>>> >>>>>>>Thanks, >>>>>>>Chris >>>>> >>>>> >>>>> >>>>>I--I >>>>>Message scanned by MailScanner, and is believed to be clean. >>>>>CONFIDENTIALITY NOTICE: This transmission intended for the >>>> >>>>specified >>>> >>>> >>>>>destination and person. If this is not you, this >>>>>e-mail must be deleted immediately. www.pscginternet.com >>>>> >>>>>------------------------ MailScanner list >>>> >>>>------------------------ To >>>> >>>> >>>>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>>>mailscanner' in the body of the email. Before posting, read >>>> >>>>the Wiki >>>> >>>> >>>>>(http://wiki.mailscanner.info/) and the archives >>>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>> >>>>************************************************************ >> >>********** >> >>>>This email and any files transmitted with it are confidential and >>>>intended solely for the use of the individual or entity to >> >>whom they >> >>>>are addressed. If you have received this email in error >> >>please notify >> >>>>the system manager. >>>> >>>>This footnote confirms that this email message has been >> >>swept for the >> >>>>presence of computer viruses and is believed to be clean. >>>> >>>>************************************************************ >> >>********** >> >>>>------------------------ MailScanner list >>>>------------------------ To unsubscribe, email >> >>jiscmail@jiscmail.ac.uk >> >>>>with the words: 'leave mailscanner' in the body of the >> >>email. Before >> >>>>posting, read the Wiki >>>>(http://wiki.mailscanner.info/) and the archives >>>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>>I--I >>>>Message scanned by MailScanner, and is believed to be clean. >>>>CONFIDENTIALITY NOTICE: This transmission intended for the >> >>specified >> >>>>destination and person. If this is not you, this >>>>e-mail must be deleted immediately. www.pscginternet.com >>>> >>> >>> >>> >>>I--I >>>Message scanned by MailScanner, and is believed to be clean. >>>CONFIDENTIALITY NOTICE: This transmission intended for the >> >>specified >> >>>destination and person. If this is not you, this >>>e-mail must be deleted immediately. www.pscginternet.com >>> >>>------------------------ MailScanner list >> >>------------------------ To >> >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>mailscanner' in the body of the email. Before posting, read >> >>the Wiki >> >>>(http://wiki.mailscanner.info/) and the archives >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential >>and intended solely for the use of the individual or entity >>to whom they are addressed. If you have received this email >>in error please notify the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list >>------------------------ To unsubscribe, email >>jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' >>in the body of the email. Before posting, read the Wiki >>(http://wiki.mailscanner.info/) and the archives >>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>I--I >>Message scanned by MailScanner, and is believed to be clean. >>CONFIDENTIALITY NOTICE: This transmission intended for the >>specified destination and person. If this is not you, this >>e-mail must be deleted immediately. www.pscginternet.com >> > > > > I--I > Message scanned by MailScanner, and is believed to be clean. > CONFIDENTIALITY NOTICE: This transmission intended for the > specified destination and person. If this is not you, this > e-mail must be deleted immediately. www.pscginternet.com > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From shrek-m at GMX.DE Wed Apr 27 17:55:43 2005 From: shrek-m at GMX.DE (shrek-m@gmx.de) Date: Thu Jan 12 21:29:24 2006 Subject: New sophos version 5.0 support Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] hi, afaik sav 5.x (virus-data-version=3.x) does not exist yet for *nixes. imho the real question is: when will MS let us configure to use sophos and eminstall.sh directly instead of /usr/local/Sophos/* sophos-auoupdate and Sophos.install ? afaik it is not recommended to manage the sav-updates manually with SophosEnterpriseConsole (Windows 200x Server) and EnterpriseManager-Library (Windows 200x) because all relevant datas are stored in the m$de/m$sql database. EM 1.2 let you select, subscribe and publish the needed CIDs for all versions of SAV3.x, and 4.x, 5.x. Julian Field wrote: > Ooh, this is the first I have heard of V5. I haven't tried it with > MailScanner yet, but I will try to either this weekend or some time > next week. I've got a few other things to do first, but it is definitely > on the list. > > Thanks for the heads-up! > > As for the other question, I deliberately have separately-managed F-Prot > installations on my email gateways as well as Sophos. Then if the > central management system and/or Sophos fails, sav 5.x let you setup 2 sources for updates, /etc/emistall.conf 3, see /usr/local/sav/eminstall.sh eg. your local server and sophos directly. the SEC let you change all these settings for win/mac remotely within a few seconds and for seperately groups different. a minimal eminstall.conf could be $ cat /etc/eminstall.conf EM install CID = /mnt/smb/unixinst/linux/intel_libc6/ EM cache dir = /usr/local/sav-cache > my mail is still > protected. Going to total central management is fine as long as it > works. If it fails, everything fails together. Beware. EM can send infos, download-infos, warnings to you. > Adri Koppes wrote: > >> I have evaluated Sophos 3.xx running on FreeBSD 4.10, called from >> Mailscanner using the perl SAVI module. >> I have noticed Sophos have announced the new version 5.0 on their >> website and are dropping support for the 3.xx version by the end of >> 2005. >> Before purchasing a new license, does the new version 5.0 also work >> with MailScanner and/or the perl SAVI module? I'll probably upgrade >> the mailserver to FreeBSD 5.4 64bit in the near future. >> If not, does anyone know of any other good anti virus software with >> centralized management in a mixes Windows/FreeBSD network? > -- shrek-m ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Wed Apr 27 17:57:51 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Wayne > Sent: Wednesday, April 27, 2005 12:47 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: AWL problems > > Im using MS as a gateway and Im seeing this too.. > Also don't have another MTA aside from postfix on the server. > Removed sendmail completely. > > Im not using ensim and I just noticed a false positive caused by an AWL > score driving up the total SA score. > Checked MailScanner.conf and I have: > SpamAssassin Auto Whitelist = no > As was mentions before in this thread, if you're using SA 3.0x you must set use_auto_whitelist 0 in your spam.assassin.prefs.conf to actually turn off auto white listng Steve Steve Swaney President Fortress Systems Ltd. Phone: 202 338-1670 Cell: 202 352-3262 www.fsl.com steve.swaney@fsl.com > Regards, > Wayne > > > > On 27/04/2005 17:18, "Martin Hepworth" > wrote: > > > Of course you could alway build a MS box to act as gateway to the ensim > > thing and do things in a known way. > > > > Should ensim themselves support MS if they are messing with it's > config... > > > > -- > > Martin Hepworth > > Snr Systems Administrator > > Solid State Logic > > Tel: +44 (0)1865 842300 > > > > > > Dave Duffner - PSCGi wrote: > >> Martin, > >> > >> Yep, it's put together like TinkerToys and their a > >> bit apathetic lately about supporting anything in real-time. > >> Took 2-4 extra months to get the SA 3.02 patch out of them > >> to bring it up to near-normal. > >> > >> Not sure if they've even worked with Julian on this, > >> would be the most intelligent way to handle it. And Ensim, > >> sadly, is one of the best managed hosting OS'es out there > >> for everyday use, just a mess behind the scenes. Plesk is > >> the next-best option, but you sacrifice certain elements > >> to get others and we haven't been prepared to go that route > >> at this point. > >> > >> Now Ensim shouldn't be calling SA outside of MS, the > >> MS/Sa/ClamAV anti-spam package they started in version 3.7.XX > >> of Ensim Pro is supposed to be self-contained and function > >> as I outlined. If something else, like Sendmail, is calling > >> it up and causing those files to be written per-user, there > >> has to be a way to disable that. But we've got no clue here > >> on where that would be happening, even tailing & top'ing > >> monitoring of the process shows the layout I outlined. > >> > >> So once Sendmail hands it off to MS, it falls into > >> that flow I laid out. I'm not as concerned about the fact > >> it's writing AWL files into User dirs as I am that I've > >> told SA to lay off using that rating and it's still doing > >> it. That would seem to be more within the MS/SA package, > >> not Ensim doing something additional, especially without > >> it being logged where we can find it? > >> > >> MS has been instructed to ignore the AWL, SA has been > >> instructed to ignore it, but when SA is run, it's like it's > >> picking up some other instruction set that's not configured > >> to ignore the AWL? Any thoughts on where that conf file > >> might be or the filename to search the server for to see if > >> that's the case? The prefs file is configured properly, but > >> that's in the MS/SA's root dir. If Ensim deployed additional > >> copies of those somehow and they're not getting updated, that > >> could be the problem. But we're clueless on what to look > >> for to determine if that's the case. > >> > >> Dave > >> > >> > >> > >>> -----Original Message----- > >>> From: MailScanner mailing list > >>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth > >>> Sent: Wednesday, April 27, 2005 11:51 AM > >>> To: MAILSCANNER@JISCMAIL.AC.UK > >>> Subject: Re: AWL problems > >>> > >>> > >>> Dave > >>> > >>> ah that's the problem then Ensim's calling SA outside of > >>> MS.....yes it gives per user control but can give issues. > >>> (also will be MS 4.36 I guess as 4.41 is latest beta) > >>> > >>> The more I hear about ensim the less i like it, and they > >>> don't give Julian any 'help' just take the code. > >>> > >>> -- > >>> Martin Hepworth > >>> Snr Systems Administrator > >>> Solid State Logic > >>> Tel: +44 (0)1865 842300 > >>> > >>> > >>> Dave Duffner - PSCGi wrote: > >>> > >>>> Martin, > >>>> > >>>> Ensim's whacky modification of the MS/SA package in their > >>>> Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard by > >>> > >>> any means. > >>> > >>>> I've asked 1,000 times for someone to clarify how the mail > >>> > >>> is passed > >>> > >>>> through the processes to determine which 'entity' gets what when in > >>>> order to fix problems like this and others where it's tagged > >>>> strangely. > >>>> > >>>> Ensim does use a fully chrooted environment, which I know > >>>> drives everyone insane, but may be part of the problem. Not > >>> > >>> sure what > >>> > >>>> Chris is using to know if we match or if he has a totally different > >>>> setup with the same problem. > >>>> > >>>> In my case, I'm told mail is handled as follows: > >>>> > >>>> In to MailScanner (currently 4.63 I believe?) > >>>> MS checks it against my internal and externally > >>> > >>> selected BL's > >>> > >>>> If MS tags it as spam, we changed it to read [Spam-MS] > >>>> If it's tagged, depending on the settings it's delivered > >>>> as an attachment or dumped at that point. > >>>> If it passes cleanly, then it's tossed to SpamAssassin > >>>> (currently the 3.02 patch from Ensim version) > >>>> SA then uses my rulesets to determine if it is to be > >>>> checked and not whitelisted (not AWL'ed) > >>>> If pass, then SA performs my ruleset checks for spam > >>>> (RulesdeJour & custom rulesets, etc.) > >>>> If SA finds it as Spam, tags it [SA-Spam] so we know which > >>>> process did what to it. > >>>> If passed or below the threshold, delivered to User. > >>>> > >>>> Now, from what little I can gather from Ensim folks > >>> > >>> & forums, > >>> > >>>> these processes should be running as 'root'. One thing that never > >>>> surfaced until you mentioned it here was the fact that Ensim (or > >>>> something) is writing a .spamassassin dir in each domain > >>> > >>> and for each > >>> > >>>> user that holds the Bayes & AWL info along with anything > >>> > >>> else specific > >>> > >>>> for that User. > >>>> > >>>> Reason here may be that Ensim Pro gives the option to have > >>>> spam handling done via the GUI either by just the server alone or > >>>> optionally by each User in their GUI. They get to set the > >>> > >>> threshold > >>> > >>>> of spam, personal whitelists, etc. and determine if it should hold > >>>> spam or just delete it if it's been tagged by SA. MS > >>> > >>> tagging is prior > >>> > >>>> to SA handling, so any options picked by the User would > >>> > >>> only apply if > >>> > >>>> SA got to process the mail in question. We have User Spam Controls > >>>> turned on as a percentage of our Users like the more direct > >>>> control and it saves us hassles of 'censorship' if we were > >>>> the only party determining what's spam and what's not. > >>>> > >>>> Again, I did go in and nail the AWL file for the > >>> > >>> account I get > >>> > >>>> MailScanner mail to. That did stop the AWL rating from appearing > >>>> until it had built a file back up. I can't find a spot to stop SA > >>>> from creating that file once I've deleted it, I'm presuming > >>> > >>> that's my > >>> > >>>> whole problem there. > >>>> > >>>> As a side note, I've also noticed MS skipping some > >>> > >>> e-mails, we > >>> > >>>> don't do a volume where that should be happening but I did increase > >>>> some settings that seem to have lowered the skip rate to a level we > >>>> can deal with. > >>>> > >>>> There is an option with this Ensim goofy setup to > >>> > >>> double-run > >>> > >>>> SA if you change the MailScanner.conf file, but we have that set to > >>>> only use the SA prefs file and all those settings in the > >>> > >>> MS.conf file > >>> > >>>> are disabled/commented out, etc. So as far as I can see, the flow > >>>> above is what's happening and MS is the lead application in > >>> > >>> handling > >>> > >>>> mail to be scanned. > >>>> > >>>> Any questions, don't hestitate to fire away! > >>>> > >>>> Thanks, > >>>> > >>>> Dave > >>>> > >>>> > >>>> > >>>> > >>>>> -----Original Message----- > >>>>> From: MailScanner mailing list > >>> > >>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >>> > >>>>> Behalf Of Martin Hepworth > >>>>> Sent: Wednesday, April 27, 2005 11:14 AM > >>>>> To: MAILSCANNER@JISCMAIL.AC.UK > >>>>> Subject: Re: AWL problems > >>>>> > >>>>> > >>>>> Dave > >>>>> > >>>>> the awl will (should) only get created for the user > >>> > >>> MailScanner runs > >>> > >>>>> as. > >>>>> > >>>>> Are you sure you're running SA from the MTA/procmail etc?? > >>>>> > >>>>> -- > >>>>> Martin Hepworth > >>>>> Snr Systems Administrator > >>>>> Solid State Logic > >>>>> Tel: +44 (0)1865 842300 > >>>>> > >>>>> > >>>>> Dave Duffner - PSCGi wrote: > >>>>> > >>>>> > >>>>>> See now he's hitting the same wall I am... > >>>>>> > >>>>>> Even deleting the AWL's for the individual accounts, MS is > >>>>>> still compiling the AWL file. And that's with all the > >>>>> > >>>>> config points > >>>>> > >>>>> > >>>>>> possible turned off, MS indicating that autolearn is disabled. > >>>>>> > >>>>>> Since deleting the AWL file in the .spamassassin > >>>>> > >>>>> dir for each > >>>>> > >>>>> > >>>>>> user, it's lowered the point value back down to 0.0 and > >>> > >>> then starts > >>> > >>>>>> averaging it back up. Julian's ratings for his posts here > >>>>> > >>>>> that I get > >>>>> > >>>>> > >>>>>> stopped AWL rating it, then started with a 0.0 and as I > >>> > >>> get more of > >>> > >>>>>> his posts I think we're up to a 0.9 rating. Once it sees > >>> > >>> enough of > >>> > >>>>>> his posts, it'll be back to tagging his mail until I kill that AWL > >>>>>> file in that account's dir again. > >>>>>> > >>>>>> Chris may not be that far along in the process yet, but it > >>>>>> certainly sounds like he's heading in that direction. > >>>>>> > >>>>>> So either we've got a weird bug or there's some > >>>>> > >>>>> setting being > >>>>> > >>>>> > >>>>>> overridden or hidden somewhere so deep that it's > >>> > >>> triggering the AWL > >>> > >>>>>> ratings again. And with a ton of accounts, that's a > >>> > >>> serious PIA to > >>> > >>>>>> have to manually delete AWL files on a constant basis to > >>>>> > >>>>> kill it off. > >>>>> > >>>>> > >>>>>> I'm open for any suggestions, scripts, cron jobs or > >>>>> > >>>>> otherwise > >>>>> > >>>>> > >>>>>> to get that fool thing stopped. In our case we're using an Ensim > >>>>>> Hosting OS, so we're stuck with 3.XX of SA as any upgrades that > >>>>>> might've fixed this would either foul up Ensim or be > >>> > >>> overwritten in > >>> > >>>>>> the next half-a'ed upgrade or patch from Ensim for the OS. > >>>>>> > >>>>>> David J. Duffner > >>>>>> President > >>>>>> PSCGi > >>>>>> Paradise Shore Communications Group > >>>>>> www.pscginternet.com > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>>> -----Original Message----- > >>>>>>> From: MailScanner mailing list > >>>>> > >>>>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >>>>> > >>>>> > >>>>>>> Behalf Of Martin Hepworth > >>>>>>> Sent: Wednesday, April 27, 2005 10:49 AM > >>>>>>> To: MAILSCANNER@JISCMAIL.AC.UK > >>>>>>> Subject: Re: AWL problems > >>>>>>> > >>>>>>> > >>>>>>> Chris > >>>>>>> > >>>>>>> if you're using SA 3.x this doesn't work. You'll need to > >>>>> > >>>>> turn it off > >>>>> > >>>>> > >>>>>>> in the SA config files. > >>>>>>> > >>>>>>> -- > >>>>>>> Martin Hepworth > >>>>>>> Snr Systems Administrator > >>>>>>> Solid State Logic > >>>>>>> Tel: +44 (0)1865 842300 > >>>>>>> > >>>>>>> > >>>>>>> Fractal IT Dept. wrote: > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>>> Hi everyone, > >>>>>>>> > >>>>>>>> I'm having a problem with ham becoming spam because it > >>>>> > >>>>> receives AWL > >>>>> > >>>>> > >>>>>>>> points. I'm not sure why this is happening, because in my > >>>>>>>> mailscanner.conf file, I have: > >>>>>>>> > >>>>>>>> SpamAssassin Auto Whitelist = no > >>>>>>>> > >>>>>>>> Any thoughts as to what could possibly be causing this? > >>>>>>>> > >>>>>>>> Thanks, > >>>>>>>> Chris > >>>>>> > >>>>>> > >>>>>> > >>>>>> I--I > >>>>>> Message scanned by MailScanner, and is believed to be clean. > >>>>>> CONFIDENTIALITY NOTICE: This transmission intended for the > >>>>> > >>>>> specified > >>>>> > >>>>> > >>>>>> destination and person. If this is not you, this > >>>>>> e-mail must be deleted immediately. www.pscginternet.com > >>>>>> > >>>>>> ------------------------ MailScanner list > >>>>> > >>>>> ------------------------ To > >>>>> > >>>>> > >>>>>> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > >>>>>> mailscanner' in the body of the email. Before posting, read > >>>>> > >>>>> the Wiki > >>>>> > >>>>> > >>>>>> (http://wiki.mailscanner.info/) and the archives > >>>>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>>> > >>>>>> Support MailScanner development - buy the book off the website! > >>>>> > >>>>> ************************************************************ > >>> > >>> ********** > >>> > >>>>> This email and any files transmitted with it are confidential and > >>>>> intended solely for the use of the individual or entity to > >>> > >>> whom they > >>> > >>>>> are addressed. If you have received this email in error > >>> > >>> please notify > >>> > >>>>> the system manager. > >>>>> > >>>>> This footnote confirms that this email message has been > >>> > >>> swept for the > >>> > >>>>> presence of computer viruses and is believed to be clean. > >>>>> > >>>>> ************************************************************ > >>> > >>> ********** > >>> > >>>>> ------------------------ MailScanner list > >>>>> ------------------------ To unsubscribe, email > >>> > >>> jiscmail@jiscmail.ac.uk > >>> > >>>>> with the words: 'leave mailscanner' in the body of the > >>> > >>> email. Before > >>> > >>>>> posting, read the Wiki > >>>>> (http://wiki.mailscanner.info/) and the archives > >>>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>>> > >>>>> Support MailScanner development - buy the book off the website! > >>>>> > >>>>> I--I > >>>>> Message scanned by MailScanner, and is believed to be clean. > >>>>> CONFIDENTIALITY NOTICE: This transmission intended for the > >>> > >>> specified > >>> > >>>>> destination and person. If this is not you, this > >>>>> e-mail must be deleted immediately. www.pscginternet.com > >>>>> > >>>> > >>>> > >>>> > >>>> I--I > >>>> Message scanned by MailScanner, and is believed to be clean. > >>>> CONFIDENTIALITY NOTICE: This transmission intended for the > >>> > >>> specified > >>> > >>>> destination and person. If this is not you, this > >>>> e-mail must be deleted immediately. www.pscginternet.com > >>>> > >>>> ------------------------ MailScanner list > >>> > >>> ------------------------ To > >>> > >>>> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave > >>>> mailscanner' in the body of the email. Before posting, read > >>> > >>> the Wiki > >>> > >>>> (http://wiki.mailscanner.info/) and the archives > >>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>>> > >>>> Support MailScanner development - buy the book off the website! > >>> > >>> ********************************************************************** > >>> > >>> This email and any files transmitted with it are confidential > >>> and intended solely for the use of the individual or entity > >>> to whom they are addressed. If you have received this email > >>> in error please notify the system manager. > >>> > >>> This footnote confirms that this email message has been swept > >>> for the presence of computer viruses and is believed to be clean. > >>> > >>> ********************************************************************** > >>> > >>> ------------------------ MailScanner list > >>> ------------------------ To unsubscribe, email > >>> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' > >>> in the body of the email. Before posting, read the Wiki > >>> (http://wiki.mailscanner.info/) and the archives > >>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >>> > >>> Support MailScanner development - buy the book off the website! > >>> > >>> I--I > >>> Message scanned by MailScanner, and is believed to be clean. > >>> CONFIDENTIALITY NOTICE: This transmission intended for the > >>> specified destination and person. If this is not you, this > >>> e-mail must be deleted immediately. www.pscginternet.com > >>> > >> > >> > >> > >> I--I > >> Message scanned by MailScanner, and is believed to be clean. > >> CONFIDENTIALITY NOTICE: This transmission intended for the > >> specified destination and person. If this is not you, this > >> e-mail must be deleted immediately. www.pscginternet.com > >> > >> ------------------------ MailScanner list ------------------------ > >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > >> 'leave mailscanner' in the body of the email. > >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and > >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >> > >> Support MailScanner development - buy the book off the website! > > > > ********************************************************************** > > > > This email and any files transmitted with it are confidential and > > intended solely for the use of the individual or entity to whom they > > are addressed. If you have received this email in error please notify > > the system manager. > > > > This footnote confirms that this email message has been swept > > for the presence of computer viruses and is believed to be clean. > > > > ********************************************************************** > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > -- > > ** Email Scanned by Elive's Virus Scanning Service - > > http://www.elive.net ** > > > > > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 17:46:57 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: Im using MS as a gateway and Im seeing this too.. Also don't have another MTA aside from postfix on the server. Removed sendmail completely. Im not using ensim and I just noticed a false positive caused by an AWL score driving up the total SA score. Checked MailScanner.conf and I have: SpamAssassin Auto Whitelist = no Regards, Wayne On 27/04/2005 17:18, "Martin Hepworth" wrote: > Of course you could alway build a MS box to act as gateway to the ensim > thing and do things in a known way. > > Should ensim themselves support MS if they are messing with it's config... > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Dave Duffner - PSCGi wrote: >> Martin, >> >> Yep, it's put together like TinkerToys and their a >> bit apathetic lately about supporting anything in real-time. >> Took 2-4 extra months to get the SA 3.02 patch out of them >> to bring it up to near-normal. >> >> Not sure if they've even worked with Julian on this, >> would be the most intelligent way to handle it. And Ensim, >> sadly, is one of the best managed hosting OS'es out there >> for everyday use, just a mess behind the scenes. Plesk is >> the next-best option, but you sacrifice certain elements >> to get others and we haven't been prepared to go that route >> at this point. >> >> Now Ensim shouldn't be calling SA outside of MS, the >> MS/Sa/ClamAV anti-spam package they started in version 3.7.XX >> of Ensim Pro is supposed to be self-contained and function >> as I outlined. If something else, like Sendmail, is calling >> it up and causing those files to be written per-user, there >> has to be a way to disable that. But we've got no clue here >> on where that would be happening, even tailing & top'ing >> monitoring of the process shows the layout I outlined. >> >> So once Sendmail hands it off to MS, it falls into >> that flow I laid out. I'm not as concerned about the fact >> it's writing AWL files into User dirs as I am that I've >> told SA to lay off using that rating and it's still doing >> it. That would seem to be more within the MS/SA package, >> not Ensim doing something additional, especially without >> it being logged where we can find it? >> >> MS has been instructed to ignore the AWL, SA has been >> instructed to ignore it, but when SA is run, it's like it's >> picking up some other instruction set that's not configured >> to ignore the AWL? Any thoughts on where that conf file >> might be or the filename to search the server for to see if >> that's the case? The prefs file is configured properly, but >> that's in the MS/SA's root dir. If Ensim deployed additional >> copies of those somehow and they're not getting updated, that >> could be the problem. But we're clueless on what to look >> for to determine if that's the case. >> >> Dave >> >> >> >>> -----Original Message----- >>> From: MailScanner mailing list >>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth >>> Sent: Wednesday, April 27, 2005 11:51 AM >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Re: AWL problems >>> >>> >>> Dave >>> >>> ah that's the problem then Ensim's calling SA outside of >>> MS.....yes it gives per user control but can give issues. >>> (also will be MS 4.36 I guess as 4.41 is latest beta) >>> >>> The more I hear about ensim the less i like it, and they >>> don't give Julian any 'help' just take the code. >>> >>> -- >>> Martin Hepworth >>> Snr Systems Administrator >>> Solid State Logic >>> Tel: +44 (0)1865 842300 >>> >>> >>> Dave Duffner - PSCGi wrote: >>> >>>> Martin, >>>> >>>> Ensim's whacky modification of the MS/SA package in their >>>> Ensim Pro 4.XX versions (FC 1/2 & RHEL) are not standard by >>> >>> any means. >>> >>>> I've asked 1,000 times for someone to clarify how the mail >>> >>> is passed >>> >>>> through the processes to determine which 'entity' gets what when in >>>> order to fix problems like this and others where it's tagged >>>> strangely. >>>> >>>> Ensim does use a fully chrooted environment, which I know >>>> drives everyone insane, but may be part of the problem. Not >>> >>> sure what >>> >>>> Chris is using to know if we match or if he has a totally different >>>> setup with the same problem. >>>> >>>> In my case, I'm told mail is handled as follows: >>>> >>>> In to MailScanner (currently 4.63 I believe?) >>>> MS checks it against my internal and externally >>> >>> selected BL's >>> >>>> If MS tags it as spam, we changed it to read [Spam-MS] >>>> If it's tagged, depending on the settings it's delivered >>>> as an attachment or dumped at that point. >>>> If it passes cleanly, then it's tossed to SpamAssassin >>>> (currently the 3.02 patch from Ensim version) >>>> SA then uses my rulesets to determine if it is to be >>>> checked and not whitelisted (not AWL'ed) >>>> If pass, then SA performs my ruleset checks for spam >>>> (RulesdeJour & custom rulesets, etc.) >>>> If SA finds it as Spam, tags it [SA-Spam] so we know which >>>> process did what to it. >>>> If passed or below the threshold, delivered to User. >>>> >>>> Now, from what little I can gather from Ensim folks >>> >>> & forums, >>> >>>> these processes should be running as 'root'. One thing that never >>>> surfaced until you mentioned it here was the fact that Ensim (or >>>> something) is writing a .spamassassin dir in each domain >>> >>> and for each >>> >>>> user that holds the Bayes & AWL info along with anything >>> >>> else specific >>> >>>> for that User. >>>> >>>> Reason here may be that Ensim Pro gives the option to have >>>> spam handling done via the GUI either by just the server alone or >>>> optionally by each User in their GUI. They get to set the >>> >>> threshold >>> >>>> of spam, personal whitelists, etc. and determine if it should hold >>>> spam or just delete it if it's been tagged by SA. MS >>> >>> tagging is prior >>> >>>> to SA handling, so any options picked by the User would >>> >>> only apply if >>> >>>> SA got to process the mail in question. We have User Spam Controls >>>> turned on as a percentage of our Users like the more direct >>>> control and it saves us hassles of 'censorship' if we were >>>> the only party determining what's spam and what's not. >>>> >>>> Again, I did go in and nail the AWL file for the >>> >>> account I get >>> >>>> MailScanner mail to. That did stop the AWL rating from appearing >>>> until it had built a file back up. I can't find a spot to stop SA >>>> from creating that file once I've deleted it, I'm presuming >>> >>> that's my >>> >>>> whole problem there. >>>> >>>> As a side note, I've also noticed MS skipping some >>> >>> e-mails, we >>> >>>> don't do a volume where that should be happening but I did increase >>>> some settings that seem to have lowered the skip rate to a level we >>>> can deal with. >>>> >>>> There is an option with this Ensim goofy setup to >>> >>> double-run >>> >>>> SA if you change the MailScanner.conf file, but we have that set to >>>> only use the SA prefs file and all those settings in the >>> >>> MS.conf file >>> >>>> are disabled/commented out, etc. So as far as I can see, the flow >>>> above is what's happening and MS is the lead application in >>> >>> handling >>> >>>> mail to be scanned. >>>> >>>> Any questions, don't hestitate to fire away! >>>> >>>> Thanks, >>>> >>>> Dave >>>> >>>> >>>> >>>> >>>>> -----Original Message----- >>>>> From: MailScanner mailing list >>> >>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>> >>>>> Behalf Of Martin Hepworth >>>>> Sent: Wednesday, April 27, 2005 11:14 AM >>>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>>> Subject: Re: AWL problems >>>>> >>>>> >>>>> Dave >>>>> >>>>> the awl will (should) only get created for the user >>> >>> MailScanner runs >>> >>>>> as. >>>>> >>>>> Are you sure you're running SA from the MTA/procmail etc?? >>>>> >>>>> -- >>>>> Martin Hepworth >>>>> Snr Systems Administrator >>>>> Solid State Logic >>>>> Tel: +44 (0)1865 842300 >>>>> >>>>> >>>>> Dave Duffner - PSCGi wrote: >>>>> >>>>> >>>>>> See now he's hitting the same wall I am... >>>>>> >>>>>> Even deleting the AWL's for the individual accounts, MS is >>>>>> still compiling the AWL file. And that's with all the >>>>> >>>>> config points >>>>> >>>>> >>>>>> possible turned off, MS indicating that autolearn is disabled. >>>>>> >>>>>> Since deleting the AWL file in the .spamassassin >>>>> >>>>> dir for each >>>>> >>>>> >>>>>> user, it's lowered the point value back down to 0.0 and >>> >>> then starts >>> >>>>>> averaging it back up. Julian's ratings for his posts here >>>>> >>>>> that I get >>>>> >>>>> >>>>>> stopped AWL rating it, then started with a 0.0 and as I >>> >>> get more of >>> >>>>>> his posts I think we're up to a 0.9 rating. Once it sees >>> >>> enough of >>> >>>>>> his posts, it'll be back to tagging his mail until I kill that AWL >>>>>> file in that account's dir again. >>>>>> >>>>>> Chris may not be that far along in the process yet, but it >>>>>> certainly sounds like he's heading in that direction. >>>>>> >>>>>> So either we've got a weird bug or there's some >>>>> >>>>> setting being >>>>> >>>>> >>>>>> overridden or hidden somewhere so deep that it's >>> >>> triggering the AWL >>> >>>>>> ratings again. And with a ton of accounts, that's a >>> >>> serious PIA to >>> >>>>>> have to manually delete AWL files on a constant basis to >>>>> >>>>> kill it off. >>>>> >>>>> >>>>>> I'm open for any suggestions, scripts, cron jobs or >>>>> >>>>> otherwise >>>>> >>>>> >>>>>> to get that fool thing stopped. In our case we're using an Ensim >>>>>> Hosting OS, so we're stuck with 3.XX of SA as any upgrades that >>>>>> might've fixed this would either foul up Ensim or be >>> >>> overwritten in >>> >>>>>> the next half-a'ed upgrade or patch from Ensim for the OS. >>>>>> >>>>>> David J. Duffner >>>>>> President >>>>>> PSCGi >>>>>> Paradise Shore Communications Group >>>>>> www.pscginternet.com >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>>> -----Original Message----- >>>>>>> From: MailScanner mailing list >>>>> >>>>> [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>>>> >>>>> >>>>>>> Behalf Of Martin Hepworth >>>>>>> Sent: Wednesday, April 27, 2005 10:49 AM >>>>>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>>>>> Subject: Re: AWL problems >>>>>>> >>>>>>> >>>>>>> Chris >>>>>>> >>>>>>> if you're using SA 3.x this doesn't work. You'll need to >>>>> >>>>> turn it off >>>>> >>>>> >>>>>>> in the SA config files. >>>>>>> >>>>>>> -- >>>>>>> Martin Hepworth >>>>>>> Snr Systems Administrator >>>>>>> Solid State Logic >>>>>>> Tel: +44 (0)1865 842300 >>>>>>> >>>>>>> >>>>>>> Fractal IT Dept. wrote: >>>>>>> >>>>>>> >>>>>>> >>>>>>>> Hi everyone, >>>>>>>> >>>>>>>> I'm having a problem with ham becoming spam because it >>>>> >>>>> receives AWL >>>>> >>>>> >>>>>>>> points. I'm not sure why this is happening, because in my >>>>>>>> mailscanner.conf file, I have: >>>>>>>> >>>>>>>> SpamAssassin Auto Whitelist = no >>>>>>>> >>>>>>>> Any thoughts as to what could possibly be causing this? >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Chris >>>>>> >>>>>> >>>>>> >>>>>> I--I >>>>>> Message scanned by MailScanner, and is believed to be clean. >>>>>> CONFIDENTIALITY NOTICE: This transmission intended for the >>>>> >>>>> specified >>>>> >>>>> >>>>>> destination and person. If this is not you, this >>>>>> e-mail must be deleted immediately. www.pscginternet.com >>>>>> >>>>>> ------------------------ MailScanner list >>>>> >>>>> ------------------------ To >>>>> >>>>> >>>>>> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>>>> mailscanner' in the body of the email. Before posting, read >>>>> >>>>> the Wiki >>>>> >>>>> >>>>>> (http://wiki.mailscanner.info/) and the archives >>>>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>>> >>>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> ************************************************************ >>> >>> ********** >>> >>>>> This email and any files transmitted with it are confidential and >>>>> intended solely for the use of the individual or entity to >>> >>> whom they >>> >>>>> are addressed. If you have received this email in error >>> >>> please notify >>> >>>>> the system manager. >>>>> >>>>> This footnote confirms that this email message has been >>> >>> swept for the >>> >>>>> presence of computer viruses and is believed to be clean. >>>>> >>>>> ************************************************************ >>> >>> ********** >>> >>>>> ------------------------ MailScanner list >>>>> ------------------------ To unsubscribe, email >>> >>> jiscmail@jiscmail.ac.uk >>> >>>>> with the words: 'leave mailscanner' in the body of the >>> >>> email. Before >>> >>>>> posting, read the Wiki >>>>> (http://wiki.mailscanner.info/) and the archives >>>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>> Support MailScanner development - buy the book off the website! >>>>> >>>>> I--I >>>>> Message scanned by MailScanner, and is believed to be clean. >>>>> CONFIDENTIALITY NOTICE: This transmission intended for the >>> >>> specified >>> >>>>> destination and person. If this is not you, this >>>>> e-mail must be deleted immediately. www.pscginternet.com >>>>> >>>> >>>> >>>> >>>> I--I >>>> Message scanned by MailScanner, and is believed to be clean. >>>> CONFIDENTIALITY NOTICE: This transmission intended for the >>> >>> specified >>> >>>> destination and person. If this is not you, this >>>> e-mail must be deleted immediately. www.pscginternet.com >>>> >>>> ------------------------ MailScanner list >>> >>> ------------------------ To >>> >>>> unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave >>>> mailscanner' in the body of the email. Before posting, read >>> >>> the Wiki >>> >>>> (http://wiki.mailscanner.info/) and the archives >>>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>> >>> ********************************************************************** >>> >>> This email and any files transmitted with it are confidential >>> and intended solely for the use of the individual or entity >>> to whom they are addressed. If you have received this email >>> in error please notify the system manager. >>> >>> This footnote confirms that this email message has been swept >>> for the presence of computer viruses and is believed to be clean. >>> >>> ********************************************************************** >>> >>> ------------------------ MailScanner list >>> ------------------------ To unsubscribe, email >>> jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' >>> in the body of the email. Before posting, read the Wiki >>> (http://wiki.mailscanner.info/) and the archives >>> (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> I--I >>> Message scanned by MailScanner, and is believed to be clean. >>> CONFIDENTIALITY NOTICE: This transmission intended for the >>> specified destination and person. If this is not you, this >>> e-mail must be deleted immediately. www.pscginternet.com >>> >> >> >> >> I--I >> Message scanned by MailScanner, and is believed to be clean. >> CONFIDENTIALITY NOTICE: This transmission intended for the >> specified destination and person. If this is not you, this >> e-mail must be deleted immediately. www.pscginternet.com >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > ** Email Scanned by Elive's Virus Scanning Service - > http://www.elive.net ** > > > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 18:12:18 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:24 2006 Subject: AWL problems Message-ID: On 27/04/2005 17:57, "Stephen Swaney" wrote: > As was mentions before in this thread, if you're using SA 3.0x you must set > > use_auto_whitelist 0 Ah, missed that - thanks. Regards, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Apr 27 18:24:08 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:24 2006 Subject: rbl Message-ID: Or at the MTA level? -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Wednesday, April 27, 2005 2:31 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: rbl Hi where is the RBL defined, in the MailScanner.conf or used in the SA config? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 spiv007 wrote: > how do i allow an ip that is on an rbl list to send mail to my server? > I added the ip to my whitelist but it still get blocked. Maybe > spammassin is blocking it? > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Apr 27 18:26:19 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:24 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] YMMV - I've used SBL+XBL+SpamCop at the MTA level and have received an average of 3-4 FPs a year on about 5000 mailboxes - most of which can be corrected by a simple addition to /etc/mail/access and /etc/MailScanner/rules/spam.whitelist.rules ... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Wednesday, April 27, 2005 7:32 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Reliable RBL,SBL Lists José Angel Blanco González wrote: > Any one knows reliable rbl list? No matter if they are not free. > Now I am receiving false positives from wanadoo, hotmail,etc. accounts > > Thank you very much > Jose > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! Jose I use the spamhaus XBL list in my SA conf, not in MailScanner.conf as I find using RBLs as actual blacklists can lead to this issue -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mark at TIPPINGMAR.COM Wed Apr 27 18:35:01 2005 From: mark at TIPPINGMAR.COM (Mark Nienberg) Date: Thu Jan 12 21:29:24 2006 Subject: OT: Thunderbird and iptables Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Thanks very much for the primer about RST flags. I guess I should learn a little more about basic TCP connections. While I work on that, I'll try allowing outgoing packets that have the ACK and RST bits set, so that at least the clients will hear the server's response. The server (as you suggested) isn't listening on the upper ports and there is no ftp daemon running. The NAT behind which the server sits doesn't forward incoming high ports to the server either. There is not question that the blocking is related to Thunderbird IMAP, so maybe I should ask about it on a Thunderbird forum. Thanks again. Mark Matt Kettler wrote: >I think your biggest hint should be to notice that the packet has the >RST bit set. I doubt this is part of a connection originated by the >server, but instead part of a connection originated, or trying to >originate from, the remote. > >The RST flag generally means that the.remote sent a packet to an >unserved port on your mailserver. The other case could be an abrupt >close of the socket on the server side, such as a process kill. The RST >packet would be generated by your mailserver as a method of warning the >connection isn't valid and doesn't have any state tracking. > >If multiple resets were generated due to multiple offending packets, >IPTables may refuse all but the first, as the connection was destroyed >by the first RST (I see this all the time on cisco PIX equipment, a late >arriving duplicate fin or rst packet gets dropped because there's no >matching connection) > >However, that port pattern looks more like passive-mode FTP than IMAP.. >but who knows, I'm no IMAP expert. > >So, I suppose your questions should be: > >1) can the client try to connect to port 36798 on the server? >2) If not, does IMAP advertise secondary ports for the client to connect >to (like passive FTP does)? >3) If so, can the remote try to make tcp connections to port 36798 if >advertised by the IMAP server? > >Mark Nienberg wrote: > > > >>Forgive the off-topic post, but what a great place this is to get the >>ear of a bunch of e-mail administrators. >> >>My offsite Thunderbird users, chen checking mail using IMAP, generate >>messages like the following from iptables: >> >>Apr 20 10:29:10 gingham kernel: IN= OUT=eth0 >>SRC=my.mailserver.ip.address DST=the.remote.ip.address >>LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=50142 DF PROTO=TCP >>SPT=36798 DPT=60933 WINDOW=7040 RES=0x00 ACK RST URGP=0 >> >>In spite of this, the Thunderbird clients seem to work just fine. >> >> > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > -- Mark Nienberg, SE Tipping Mar + associates 1906 Shattuck Ave Berkeley, CA 94704 http://www.tippingmar.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 14:18:32 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:25 2006 Subject: Whitelists + blacklists Message-ID: On 27/04/2005 14:04, "Dhawal Doshy" wrote: > Read CustomConfig.pm for more details.. Hi Dhawal, Yeah that's where I saw the info on using a file called default. In the file /etc/MailScanner/spam.bydomain/whitelist/nightsol.net I have wayne@nightsol.net In the file /etc/MailScanner/spam.bydomain/whitelist/default I have wayne@nightsol.net But this is only whitelisting mail in *from* wayne@nightsol.net I want to whitelist all mail *to* wayne@nightsol.net Before I enabled the whitelist / blacklist per domain from CustomConfig.pm In MailScanner.conf I could set rules so that all mail *to* an address was whitelisted. I want to be able to do that now again for my account.. Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spiv007 at gmail.com Wed Apr 27 18:57:33 2005 From: spiv007 at gmail.com (spiv007) Date: Thu Jan 12 21:29:25 2006 Subject: rbl Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Its under MailScanner.conf MailScanner.conf # # Spam Detection and Spam Lists (DNS blocklists) # ---------------------------------------------- # # Do you want to check messages to see if they are spam? # Note: If you switch this off then *no* spam checks will be done at all. # This includes both MailScanner's own checks and SpamAssassin. # If you want to just disable the "Spam List" feature then set # "Spam List =" (i.e. an empty list) in the setting below. # This can also be the filename of a ruleset. Spam Checks = yes # This is the list of spam blacklists (RBLs) which you are using. # See the "Spam List Definitions" file for more information about what # you can put here. # This can also be the filename of a ruleset. Spam List = AHBL ABL SPEWS1 SPEWS2 AHBL-RHSBL BADWHOIS MAILPOLICE-BULK MAILPOLIC E-PORN DUHLUSERS ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL spamcop.net NJABL RF C-IGNORANT-DSN RFC-IGNORANT-POSTMASTER RFC-IGNORANT-ABUSE RFC-IGNORANT-WHOIS RFC -IGNORANT-IPWHOIS RFC-IGNORANT-BOGUSMX SORBS-DNSBL SORBS-HTTP SORBS-SOCKS SORBS- MISC SORBS-SMTP SORBS-WEB SORBS-SPAM SORBS-BLOCK SORBS-ZOMBIE SORBS-DUL SORBS-RH SBL CBL RSL DSBL BLITZEDALL spam.assassin.prefs.conf # By default, SpamAssassin will run RBL checks. If your ISP already # does this, set this to 1. # skip_rbl_checks 1 On 4/27/05, Alex Neuman van der Hans wrote: > Or at the MTA level? > > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf > Of Martin Hepworth > Sent: Wednesday, April 27, 2005 2:31 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: rbl > > Hi > > where is the RBL defined, in the MailScanner.conf or used in the SA config? > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > spiv007 wrote: > > how do i allow an ip that is on an rbl list to send mail to my server? > > I added the ip to my whitelist but it still get blocked. Maybe > > spammassin is blocking it? > > > > ------------------------ MailScanner list ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the system manager. > > This footnote confirms that this email message has been swept for the > presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spamtrap71892316634 at ANIME.NET Wed Apr 27 19:09:32 2005 From: spamtrap71892316634 at ANIME.NET (Dan Hollis) Date: Thu Jan 12 21:29:25 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] On Wed, 27 Apr 2005, José Angel Blanco González wrote: > Any one knows reliable rbl list? No matter if they are not free. > Now I am receiving false positives from wanadoo, hotmail,etc. accounts wanadoo is not a false positive. they are bullet-proof spamhosting. -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From wayne at NIGHTSOL.NET Wed Apr 27 14:10:51 2005 From: wayne at NIGHTSOL.NET (Wayne) Date: Thu Jan 12 21:29:25 2006 Subject: Whitelists + blacklists Message-ID: On 27/04/2005 13:53, "Martin Hepworth" wrote: > Rule files need to end in .rule or .rules. Change the name and it should > work fine. Tried filenames: /etc/MailScanner/spam.bydomain/whitelist/default /etc/MailScanner/spam.bydomain/whitelist/default.rule /etc/MailScanner/spam.bydomain/whitelist/default.rules Restarted mailscanner between changes, and the file had contents of To: wayne@nightsol.net yes In /etc/MailScanner/spam.bydomain/whitelist/ I have a file called nightsol.net for my whitelist 'from' rules. There must be some way to whitelist as a 'To' rule while using the whitelist / blacklist per domain feature.... Anywhere else I can put a 'To' rule? Thanks, Wayne ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Wed Apr 27 14:03:57 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just released a new beta 4.41.2. > This is mostly a bugfix from 4.41.1. > The next version will be based on this one, so please file your bug > reports :-) > > > -- > Julian Field Running for a couple of hours - bo obvious problems.. -- -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd tel: +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dhawal at NETMAGICSOLUTIONS.COM Wed Apr 27 14:04:05 2005 From: dhawal at NETMAGICSOLUTIONS.COM (Dhawal Doshy) Date: Thu Jan 12 21:29:25 2006 Subject: Whitelists + blacklists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Wayne wrote: > On 27/04/2005 13:45, "Wayne" wrote: > > >>/etc/MailScanner/spam.bydomain/whitelist > > Correction: > That should have read > /etc/MailScanner/spam.bydomain/whitelist/default > > Thanks, > Wayne If i understand you are using "ByDomainSpamWhite(Black)list", which don't understand anything apart from email-addresses, domains and ip-addresses.. Change this To: wayne@nightsol.net yes To this wayne@nightsol.net Read CustomConfig.pm for more details.. hope it works.. - dhawal ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ssilva at SGVWATER.COM Wed Apr 27 19:23:38 2005 From: ssilva at SGVWATER.COM (Scott Silva) Date: Thu Jan 12 21:29:25 2006 Subject: Reliable RBL,SBL Lists Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Dan Hollis wrote: > On Wed, 27 Apr 2005, José Angel Blanco González wrote: > >>Any one knows reliable rbl list? No matter if they are not free. >>Now I am receiving false positives from wanadoo, hotmail,etc. accounts > > > wanadoo is not a false positive. they are bullet-proof spamhosting. > I second that. I wouldn't be surprised if even the domain registrar is a spammer. -- "If you have ever eaten crow, It don't taste like chicken!!" ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Wed Apr 27 19:47:55 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:25 2006 Subject: ClamAV Perl module not found Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Anyone? On 4/27/05, Devon Harding wrote: Did anyone ever fix this? I'm having the same issue. Here is the content of my /usr/lib/perl5 dir. drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.0 drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.1 drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.2 drwxr-xr-x 4 root root 4.0K Apr 26 18:47 5.8.3 drwxr-xr-x 3 root root 4.0K Apr 26 18:47 5.8.4 drwxr-xr-x 43 root root 4.0K Apr 26 18:47 5.8.5 drwxr-xr-x 8 root root 4.0K Apr 26 18:47 site_perl drwxr-xr-x 2 root root 4.0K Apr 27 02:03 Text drwxr-xr-x 8 root root 4.0K Apr 26 18:47 vendor_perl On 12/14/04, Mike Kercher < mike@camaross.net> wrote: Chris Trudeau wrote: > List, > > Installing ClamAV module via CPAN on machine running MailScanner > 4.36-4 stable. The install of the module goes fine, but when > starting MailScanner with Virus Scanners = clamavmodule the log > returns the message: > > ClamAV Perl module not found, did you install it? > > I verified using CPAN install that it is in fact installed and > uptodate. > > Any ideas? > > CT Do you have more than one version of perl installed? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives ( http://www.jiscmail.ac.uk/lists/mailscanner.html ). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From frank at OPENMINDS.BE Wed Apr 27 19:48:22 2005 From: frank at OPENMINDS.BE (Frank Louwers) Date: Thu Jan 12 21:29:25 2006 Subject: Reliable RBL,SBL Lists Message-ID: On Wed, Apr 27, 2005 at 11:23:38AM -0700, Scott Silva wrote: > >>Any one knows reliable rbl list? No matter if they are not free. > >>Now I am receiving false positives from wanadoo, hotmail,etc. accounts > > > > > > wanadoo is not a false positive. they are bullet-proof spamhosting. > > > I second that. I wouldn't be surprised if even the domain registrar is a > spammer. they also happen to be the largest isp in one of the largest countries in europe, and a big isp in some other european countries. Decide for yourself if you can affort to block them. Kind Regards, Frank Louwers -- Openminds bvba www.openminds.be Tweebruggenstraat 16 - 9000 Gent - Belgium ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Apr 27 20:17:37 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > I have just released a new beta 4.41.2. > > Here is the Change Log: > * New Features and Improvements * > - Better handling of subdirectories in RAR archives. > > * Fixes * > - RAR archive handling: creation of directory only archive entries, both > windows and *nix created archives (caused problems for SAVI). > - RAR archive handling: possible false Encrypted file trigger on file > names > containing the word "Encrypted". > - RAR archive handling: full path names used when extracting archived > files, > extracted to safe file name without out path. I notice a lot of new work with RAR archives. I tried to find out how to get the external unrar to work on my RHEL 3/4 servers but I couldn't. Does anybody have a HOWTO on the subject? I really would like to scan inside RAR files instead of blocking them... Thanks! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From spamtrap71892316634 at ANIME.NET Wed Apr 27 20:30:26 2005 From: spamtrap71892316634 at ANIME.NET (Dan Hollis) Date: Thu Jan 12 21:29:25 2006 Subject: Reliable RBL,SBL Lists Message-ID: On Wed, 27 Apr 2005, Frank Louwers wrote: > On Wed, Apr 27, 2005 at 11:23:38AM -0700, Scott Silva wrote: > > >>Any one knows reliable rbl list? No matter if they are not free. > > >>Now I am receiving false positives from wanadoo, hotmail,etc. accounts > > > wanadoo is not a false positive. they are bullet-proof spamhosting. > > I second that. I wouldn't be surprised if even the domain registrar is a > > spammer. > they also happen to be the largest isp in one of the largest countries > in europe, and a big isp in some other european countries. Decide for > yourself if you can affort to block them. wanadoo is already widely blocked not just by entire ISPs, but also by many end users. so people have already decided wanadoo can be blocked. maybe eventually wanadoo will get a clue, but I bet not. i mean, not even internet-wide blocking has managed to get tiscali to remove their head from their ass yet. so i won't expect anything better from wanadoo. people on wanadoo who find their emails blocked, I recommend to them to leave wanadoo and move to another ISP. most do leave wanadoo suprisingly without complaints -- telling me that it was the straw that broke the camel's back and they just needed a good excuse to leave wanadoo. people stopped blocking aol after they finally started taking abuse seriously. wanadoo will have to do the same before they get removed from RBLs. -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Apr 27 20:34:10 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:25 2006 Subject: Reliable RBL,SBL Lists Message-ID: I do, at the MTA level. On all my clients' servers. I specifically add whitelist entries for the few users who happen to have wanadoo.* accounts and can't/won't switch; most others are sensible enough to use legitimate gmail/hotmail/yahoo accounts anyways, since they have so much trouble sending e-mail to anyone else other than fellow wanadoo users. Since the rejection message shows a web page explaining the reason, most people understand. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Frank Louwers Sent: Wednesday, April 27, 2005 1:48 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Reliable RBL,SBL Lists On Wed, Apr 27, 2005 at 11:23:38AM -0700, Scott Silva wrote: > >>Any one knows reliable rbl list? No matter if they are not free. > >>Now I am receiving false positives from wanadoo, hotmail,etc. > >>accounts > > > > > > wanadoo is not a false positive. they are bullet-proof spamhosting. > > > I second that. I wouldn't be surprised if even the domain registrar is > a spammer. they also happen to be the largest isp in one of the largest countries in europe, and a big isp in some other european countries. Decide for yourself if you can affort to block them. Kind Regards, Frank Louwers -- Openminds bvba www.openminds.be Tweebruggenstraat 16 - 9000 Gent - Belgium ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Wed Apr 27 20:34:54 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:25 2006 Subject: Reliable RBL,SBL Lists Message-ID: I block tiscali too, at the MTA level. Same problem. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Dan Hollis Sent: Wednesday, April 27, 2005 2:30 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Reliable RBL,SBL Lists On Wed, 27 Apr 2005, Frank Louwers wrote: > On Wed, Apr 27, 2005 at 11:23:38AM -0700, Scott Silva wrote: > > >>Any one knows reliable rbl list? No matter if they are not free. > > >>Now I am receiving false positives from wanadoo, hotmail,etc. > > >>accounts > > > wanadoo is not a false positive. they are bullet-proof spamhosting. > > I second that. I wouldn't be surprised if even the domain registrar > > is a spammer. > they also happen to be the largest isp in one of the largest countries > in europe, and a big isp in some other european countries. Decide for > yourself if you can affort to block them. wanadoo is already widely blocked not just by entire ISPs, but also by many end users. so people have already decided wanadoo can be blocked. maybe eventually wanadoo will get a clue, but I bet not. i mean, not even internet-wide blocking has managed to get tiscali to remove their head from their ass yet. so i won't expect anything better from wanadoo. people on wanadoo who find their emails blocked, I recommend to them to leave wanadoo and move to another ISP. most do leave wanadoo suprisingly without complaints -- telling me that it was the straw that broke the camel's back and they just needed a good excuse to leave wanadoo. people stopped blocking aol after they finally started taking abuse seriously. wanadoo will have to do the same before they get removed from RBLs. -Dan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 27 21:10:37 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Julian Field wrote: > >> I have just released a new beta 4.41.2. >> >> Here is the Change Log: >> * New Features and Improvements * >> - Better handling of subdirectories in RAR archives. >> >> * Fixes * >> - RAR archive handling: creation of directory only archive entries, both >> windows and *nix created archives (caused problems for SAVI). >> - RAR archive handling: possible false Encrypted file trigger on file >> names >> containing the word "Encrypted". >> - RAR archive handling: full path names used when extracting archived >> files, >> extracted to safe file name without out path. > > > I notice a lot of new work with RAR archives. I tried to find out how > to get the external unrar to work on my RHEL 3/4 servers but I couldn't. > > Does anybody have a HOWTO on the subject? I really would like to scan > inside RAR files instead of blocking them... You basically just have to install a copy of unrar. I just did a Google for unrar and found a Linux version at http://linux.tucows.com/preview/8753.html or even better there are some good RPM's of it at http://dag.wieers.com/packages/unrar/ -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Wed Apr 27 21:27:49 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Julian Field > Sent: Wednesday, April 27, 2005 4:11 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: ANNOUNCE: beta release 4.41.2 > > Denis Beauchemin wrote: > > > Julian Field wrote: > > > >> I have just released a new beta 4.41.2. > >> > >> Here is the Change Log: > >> * New Features and Improvements * > >> - Better handling of subdirectories in RAR archives. > >> > >> * Fixes * > >> - RAR archive handling: creation of directory only archive entries, > both > >> windows and *nix created archives (caused problems for SAVI). > >> - RAR archive handling: possible false Encrypted file trigger on file > >> names > >> containing the word "Encrypted". > >> - RAR archive handling: full path names used when extracting archived > >> files, > >> extracted to safe file name without out path. > > > > > > I notice a lot of new work with RAR archives. I tried to find out how > > to get the external unrar to work on my RHEL 3/4 servers but I couldn't. > > > > Does anybody have a HOWTO on the subject? I really would like to scan > > inside RAR files instead of blocking them... > > You basically just have to install a copy of unrar. > I just did a Google for unrar and found a Linux version at > http://linux.tucows.com/preview/8753.html > or even better there are some good RPM's of it at > http://dag.wieers.com/packages/unrar/ > We have been using the http://dag.wieers.com/packages/unrar/ rpms on many rpm systems with no problems. For SuSE 9.X. we've been using the rpm.pbone.net rpm at: http://rpm.pbone.net/index.php3/stat/4/idpl/1625252/com/unrar-3.4.2-2.i586.r pm.html Again no problems. Steve Steve Swaney President Fortress Systems Ltd. Phone: 202 338-1670 Cell: 202 352-3262 www.fsl.com steve.swaney@fsl.com > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Wed Apr 27 21:30:31 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > Denis Beauchemin wrote: > >> Julian Field wrote: >> >>> I have just released a new beta 4.41.2. >>> >>> Here is the Change Log: >>> * New Features and Improvements * >>> - Better handling of subdirectories in RAR archives. >>> >>> * Fixes * >>> - RAR archive handling: creation of directory only archive entries, >>> both >>> windows and *nix created archives (caused problems for SAVI). >>> - RAR archive handling: possible false Encrypted file trigger on file >>> names >>> containing the word "Encrypted". >>> - RAR archive handling: full path names used when extracting archived >>> files, >>> extracted to safe file name without out path. >> >> >> >> I notice a lot of new work with RAR archives. I tried to find out how >> to get the external unrar to work on my RHEL 3/4 servers but I couldn't. >> >> Does anybody have a HOWTO on the subject? I really would like to scan >> inside RAR files instead of blocking them... > > > You basically just have to install a copy of unrar. > I just did a Google for unrar and found a Linux version at > http://linux.tucows.com/preview/8753.html > or even better there are some good RPM's of it at > http://dag.wieers.com/packages/unrar/ Julian, Tucow's version is v2.71 (dated Sep 2002) :-( dag's page looks promising but no link seems to work. Do I have to setup a yum config to retrieve the files? Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From Kevin_Miller at CI.JUNEAU.AK.US Wed Apr 27 21:34:13 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:25 2006 Subject: SuSE 9.3 Message-ID: Anybody installed on 9.3 yet? Any gotchas? I've ordered a copy which should be here in a week or so. (I'll be dumping Postfix and running Sendmail instead) so any 'heads up' are appreaciated... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Wed Apr 27 21:36:37 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Denis Beauchemin wrote: > Julian Field wrote: > >> Denis Beauchemin wrote: >> >>> Julian Field wrote: >>> >>>> I have just released a new beta 4.41.2. >>>> >>>> Here is the Change Log: >>>> * New Features and Improvements * >>>> - Better handling of subdirectories in RAR archives. >>>> >>>> * Fixes * >>>> - RAR archive handling: creation of directory only archive entries, >>>> both >>>> windows and *nix created archives (caused problems for SAVI). >>>> - RAR archive handling: possible false Encrypted file trigger on file >>>> names >>>> containing the word "Encrypted". >>>> - RAR archive handling: full path names used when extracting archived >>>> files, >>>> extracted to safe file name without out path. >>> >>> >>> >>> >>> I notice a lot of new work with RAR archives. I tried to find out how >>> to get the external unrar to work on my RHEL 3/4 servers but I couldn't. >>> >>> Does anybody have a HOWTO on the subject? I really would like to scan >>> inside RAR files instead of blocking them... >> >> >> >> You basically just have to install a copy of unrar. >> I just did a Google for unrar and found a Linux version at >> http://linux.tucows.com/preview/8753.html >> or even better there are some good RPM's of it at >> http://dag.wieers.com/packages/unrar/ > > > Julian, > > Tucow's version is v2.71 (dated Sep 2002) :-( > > dag's page looks promising but no link seems to work. Do I have to > setup a yum config to retrieve the files? > No need to have a yum config for only this package. The link works here. i386: RHEL3: http://dag.wieers.com/packages/unrar/unrar-3.5.1-1.2.el4.rf.i386.rpm RHEL4: http://dag.wieers.com/packages/unrar/unrar-3.5.1-1.2.el4.rf.i386.rpm > Denis > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Wed Apr 27 21:55:55 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:29:25 2006 Subject: incoming/outgoing spool shared with several mailscanners over nfs? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I've got a mailserver with sendmail and mailscanner, which is getting a bit overloaded. I'm using the setup where one sendmail daemon drops the mail in .../mqueue.in, mailscanner takes the mail from there and drops it in .../mqueue, where another sendmail daemon picks it up and sends it out. Is it possible to share the mqueue.in and mqueue dirs over nfs with other machines? so I can have several mailscanners working on the same diretories without they are trying to process the same files? Or could I make a program which periodically moved mailfiles from one server to another? Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Wed Apr 27 22:08:29 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:25 2006 Subject: incoming/outgoing spool shared with several mailscanners over nfs? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I would advise the use of multiple independent MailScanner servers, each with its own MX record in its DNS. Should load-balance very nicely for you. Sharing mqueue directories is fraught with locking problems and inefficient. The biggest cluster I have heard of is over 100 MailScanner servers. Leif Neland wrote: > I've got a mailserver with sendmail and mailscanner, which is getting > a bit > overloaded. > > I'm using the setup where one sendmail daemon drops the mail in > .../mqueue.in, mailscanner takes the mail from there and drops it in > .../mqueue, where another sendmail daemon picks it up and sends it out. > > Is it possible to share the mqueue.in and mqueue dirs over nfs with other > machines? > so I can have several mailscanners working on the same diretories without > they are trying to process the same files? > > Or could I make a program which periodically moved mailfiles from one > server > to another? > > Leif > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From raymond at PROLOCATION.NET Wed Apr 27 23:47:05 2005 From: raymond at PROLOCATION.NET (Raymond Dijkxhoorn) Date: Thu Jan 12 21:29:25 2006 Subject: incoming/outgoing spool shared with several mailscanners over nfs? Message-ID: Hi! > Is it possible to share the mqueue.in and mqueue dirs over nfs with other > machines? > so I can have several mailscanners working on the same diretories without > they are trying to process the same files? > > Or could I make a program which periodically moved mailfiles from one server > to another? Why not let 2 boxes process it and balance mail with DNS ? bye, Raymond. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Thu Apr 28 03:55:33 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:29:25 2006 Subject: incoming/outgoing spool shared with several mailscanners over nfs? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Just FYI: I tried using balance (http://sourceforge.net/projects/balance/) It's an userland daemon, which listens on one port, and forwards the requests to several servers on a round robin schedule. It works ok, but had the disadvantage that all connections to sendmail came from my own network, and therefore was whitelisted; all acl's on ip was defeated. I must look into other types of loadbalancing, beside dns. Leif ----- Original Message ----- From: "Julian Field" To: Sent: Wednesday, April 27, 2005 11:08 PM Subject: Re: incoming/outgoing spool shared with several mailscanners over nfs? >I would advise the use of multiple independent MailScanner servers, each > with its own MX record in its DNS. Should load-balance very nicely for > you. > > Sharing mqueue directories is fraught with locking problems and > inefficient. > > The biggest cluster I have heard of is over 100 MailScanner servers. > > Leif Neland wrote: > >> I've got a mailserver with sendmail and mailscanner, which is getting >> a bit >> overloaded. >> >> I'm using the setup where one sendmail daemon drops the mail in >> .../mqueue.in, mailscanner takes the mail from there and drops it in >> .../mqueue, where another sendmail daemon picks it up and sends it out. >> >> Is it possible to share the mqueue.in and mqueue dirs over nfs with other >> machines? >> so I can have several mailscanners working on the same diretories without >> they are trying to process the same files? >> >> Or could I make a program which periodically moved mailfiles from one >> server >> to another? >> >> Leif >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- > Denne mail er kontrolleret for spam og virus af http://www.MailCare.dk > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From gsaindon at CGOCABLE.CA Thu Apr 28 05:04:45 2005 From: gsaindon at CGOCABLE.CA (Guy Saindon) Date: Thu Jan 12 21:29:25 2006 Subject: Block all extensions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, Does anyone know how to block all file extensions, except certain specified ones? Thanks, Guy ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mailscanner-user at NELAND.DK Thu Apr 28 07:38:18 2005 From: mailscanner-user at NELAND.DK (Leif Neland) Date: Thu Jan 12 21:29:25 2006 Subject: Block all extensions Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] From: "Guy Saindon" To: Sent: Thursday, April 28, 2005 6:04 AM Subject: Block all extensions > Hi, > Does anyone know how to block all file extensions, except certain > specified > ones? > In the file filename.rules.conf First allow the files you want, then deny the rest. Leif ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Thu Apr 28 08:48:57 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:25 2006 Subject: New sophos version 5.0 support Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Martin, I didn't know Sophos still shipped only the 3.xx product for *nix. According to their website the 5.0 version should be available. I'll check with Sophos. Adri. > -----Original Message----- > From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] > Sent: 27 April, 2005 17:33 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: New sophos version 5.0 support > > > Adri > > when Sophos 5 appears for *nix we can test it..... > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > Adri Koppes wrote: > > I have evaluated Sophos 3.xx running on FreeBSD 4.10, > called from Mailscanner using the perl SAVI module. > > I have noticed Sophos have announced the new version 5.0 on > their website and are dropping support for the 3.xx version > by the end of 2005. > > Before purchasing a new license, does the new version 5.0 > also work with MailScanner and/or the perl SAVI module? I'll > probably upgrade the mailserver to FreeBSD 5.4 64bit in the > near future. > > If not, does anyone know of any other good anti virus > software with centralized management in a mixes > Windows/FreeBSD network? > > > > Thanks, > > > > Adri. > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > ********************************************************************** > > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote confirms that this email message has been swept > for the presence of computer viruses and is believed to be clean. > > ********************************************************************** > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Thu Apr 28 08:50:09 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:25 2006 Subject: New sophos version 5.0 support Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, I agree not putting all my eggs in one basket. I already have ClamAv and BitDefender running on the MS server. Sophos would be added to that. Adri. > -----Original Message----- > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > Sent: 27 April, 2005 17:35 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: New sophos version 5.0 support > > > Ooh, this is the first I have heard of V5. I haven't tried it with > MailScanner yet, but I will try to either this weekend or some time > next week. I've got a few other things to do first, but it is > definitely > on the list. > > Thanks for the heads-up! > > As for the other question, I deliberately have > separately-managed F-Prot > installations on my email gateways as well as Sophos. Then if the > central management system and/or Sophos fails, my mail is still > protected. Going to total central management is fine as long as it > works. If it fails, everything fails together. Beware. > > Adri Koppes wrote: > > >I have evaluated Sophos 3.xx running on FreeBSD 4.10, called > from Mailscanner using the perl SAVI module. > >I have noticed Sophos have announced the new version 5.0 on > their website and are dropping support for the 3.xx version > by the end of 2005. > >Before purchasing a new license, does the new version 5.0 > also work with MailScanner and/or the perl SAVI module? I'll > probably upgrade the mailserver to FreeBSD 5.4 64bit in the > near future. > >If not, does anyone know of any other good anti virus > software with centralized management in a mixes > Windows/FreeBSD network? > > > >Thanks, > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Apr 28 09:04:03 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:25 2006 Subject: New sophos version 5.0 support Message-ID: Adri 5.0 is only available for Windows and MacOS X and the NetApp filers. The EM 1.2 will update to all versions from what I see but I don't see any 5.0 for other platforms, or indeed a new version 3.x for this month either. Prob means they are due out soon. Don't blame them, get the major volume platforms out first, deal with the support issues and a few weeks later release more versions for the other platforms.. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Adri Koppes wrote: > Martin, > > I didn't know Sophos still shipped only the 3.xx product for *nix. > According to their website the 5.0 version should be available. > I'll check with Sophos. > > Adri. > > > >>-----Original Message----- >>From: Martin Hepworth [mailto:martinh@SOLID-STATE-LOGIC.COM] >>Sent: 27 April, 2005 17:33 >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: New sophos version 5.0 support >> >> >>Adri >> >>when Sophos 5 appears for *nix we can test it..... >> >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >> >>Adri Koppes wrote: >> >>>I have evaluated Sophos 3.xx running on FreeBSD 4.10, >> >>called from Mailscanner using the perl SAVI module. >> >>>I have noticed Sophos have announced the new version 5.0 on >> >>their website and are dropping support for the 3.xx version >>by the end of 2005. >> >>>Before purchasing a new license, does the new version 5.0 >> >>also work with MailScanner and/or the perl SAVI module? I'll >>probably upgrade the mailserver to FreeBSD 5.4 64bit in the >>near future. >> >>>If not, does anyone know of any other good anti virus >> >>software with centralized management in a mixes >>Windows/FreeBSD network? >> >>>Thanks, >>> >>>Adri. >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and >>intended solely for the use of the individual or entity to whom they >>are addressed. If you have received this email in error please notify >>the system manager. >> >>This footnote confirms that this email message has been swept >>for the presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Thu Apr 28 10:31:53 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:25 2006 Subject: Quarantine queue format Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You likely need chmod 700 /var/spool/postfix/incoming/F/F29183F8 and chown postfix.postfix /var/spool/postfix/incoming/F/F29183F8 ... postfix is picky about this:-). Might also need touch it, but the copy should take care of that (while destroying ownership and probably the permissions too). -- Glenn > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Fred. Oger > Sent: den 27 april 2005 08:02 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Quarantine queue format > > > Wayne a écrit : > > >On 26/04/2005 09:45, "Fred. Oger" wrote: > > > > > > > > > >>My problem is the file stored in the quarantine folder aren't in the > >>format described in the doc. > >> > >>eg: > >># ls -l /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F > >>-rw------- 1 postfix postfix 14768 Apr 26 05:20 F29183F8 > >>-rw------- 1 postfix postfix 11930 Apr 26 05:20 msg-10453-17.html > >> > >> > >>So how can I resend this mail to the user ? > >> > >> > > > >Chmod +x > /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F/F29183F8 > >Cp /var/spool/MailScanner/quarantine/20050426/F29183F8.76E8F/F29183F8 > >/var/spool/postfix/incoming/F > > > >The file F29183F8 should contain the entire message since > you set it to > >store a single file so you just need to copy that to the > correct directory > >with the correct permissions. > >Also note the 'incoming/F' the 'F' comes from the first > character of the > >message id. > >So if your message id started with '4' you copy it to 'incoming/4'. > > > >Hope this helps... > > > >Regards, > > Wayne > > > > > > > Hi Wayne, > > I tried the method you described but hopelessly the mail stays > indefinitely in the incoming queue. > I also found it coud be resent using postdrop < queuefile. In > this case > I get the following error : > # postdrop < > /var/spool/MailScanner/quarantine/20050426/D814F477.D847C/D814F477 > > queue_id3E83246Cpostdrop: fatal: uid=0: unexpected record type: 67 > > Any idea ? > > Regards, > > Fred. > > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Thu Apr 28 10:51:40 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:25 2006 Subject: rbl Message-ID: Hi Thats alot of RBL's for MailScanner to blacklist against, no wonder you are seeing FPs, I normally suggest these at the SA level. In order to 'whitelist' then set the Spam List option to a rule file and make sure the ip-address has a no value. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 spiv007 wrote: > Its under MailScanner.conf > > > MailScanner.conf > # > # Spam Detection and Spam Lists (DNS blocklists) > # ---------------------------------------------- > # > > # Do you want to check messages to see if they are spam? > # Note: If you switch this off then *no* spam checks will be done at all. > # This includes both MailScanner's own checks and SpamAssassin. > # If you want to just disable the "Spam List" feature then set > # "Spam List =" (i.e. an empty list) in the setting below. > # This can also be the filename of a ruleset. > Spam Checks = yes > > # This is the list of spam blacklists (RBLs) which you are using. > # See the "Spam List Definitions" file for more information about what > # you can put here. > # This can also be the filename of a ruleset. > Spam List = AHBL ABL SPEWS1 SPEWS2 AHBL-RHSBL BADWHOIS MAILPOLICE-BULK MAILPOLIC > E-PORN DUHLUSERS ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL spamcop.net NJABL RF > C-IGNORANT-DSN RFC-IGNORANT-POSTMASTER RFC-IGNORANT-ABUSE RFC-IGNORANT-WHOIS RFC > -IGNORANT-IPWHOIS RFC-IGNORANT-BOGUSMX SORBS-DNSBL SORBS-HTTP SORBS-SOCKS SORBS- > MISC SORBS-SMTP SORBS-WEB SORBS-SPAM SORBS-BLOCK SORBS-ZOMBIE SORBS-DUL SORBS-RH > SBL CBL RSL DSBL BLITZEDALL > > spam.assassin.prefs.conf > # By default, SpamAssassin will run RBL checks. If your ISP already > # does this, set this to 1. > # > skip_rbl_checks 1 > On 4/27/05, Alex Neuman van der Hans wrote: > >>Or at the MTA level? >> >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf >>Of Martin Hepworth >>Sent: Wednesday, April 27, 2005 2:31 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: rbl >> >>Hi >> >>where is the RBL defined, in the MailScanner.conf or used in the SA config? >>-- >>Martin Hepworth >>Snr Systems Administrator >>Solid State Logic >>Tel: +44 (0)1865 842300 >> >>spiv007 wrote: >> >>>how do i allow an ip that is on an rbl list to send mail to my server? >>> I added the ip to my whitelist but it still get blocked. Maybe >>>spammassin is blocking it? >>> >>>------------------------ MailScanner list ------------------------ To >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >> >>********************************************************************** >> >>This email and any files transmitted with it are confidential and intended >>solely for the use of the individual or entity to whom they are addressed. >>If you have received this email in error please notify the system manager. >> >>This footnote confirms that this email message has been swept for the >>presence of computer viruses and is believed to be clean. >> >>********************************************************************** >> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >>------------------------ MailScanner list ------------------------ >>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chuck.foster at STREAMSHIELD.COM Thu Apr 28 11:45:49 2005 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I have just released a new beta 4.41.2. This is mostly a bugfix from 4.41.1. The next version will be based on this one, so please file your bug reports :-) Hi Julian, I noticed that the date code still had that slight race condition that I reported before; I've included the previous message below! Chuck ----------- Hi, Finally had time to play with the new MailScanner code, and looked at the changes made from below. One thing that I've realised now that I hadn't before is that the originating time() value isn't being kept, which meant that it wasn't available to my custom functions as I'd hoped - having to parse the string to get the hours and minutes out is a bit painful! A simple addition to the new function to keep that value would be very useful; I used 'dateval' for that in my code: # Set the date string and number $this->{dateval} = time; $this->{datestring} = scalar localtime($this->{dateval}); my ($day, $month, $year) = (localtime($this->dateval))[3,4,5]; $this->{datenumber} = sprintf("%04d%02d%02d", $year+1900, $month+1, $day); This also avoided the (very very slight!) situation where the day changes between the setting of datestring and datenumber in the original code, which both called a fresh time in localtime(). Also, there are a couple of points in the code that still call TodayDir() in the archiving (Message.pm line 669,3982, MCPMessage.pm line 372) which could conceivably end up with different dates - any plans to move those to $this->{datenumber} too? (unless I missed something obvious!) Best Wishes, Chuck This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. -- This message has been scanned for viruses and potentially harmful content by StreamShield Protector. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 28 12:00:57 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Please can you try the attached patches for MCPMessage.pm and Message.pm. Let me know how you get on. Chuck Foster wrote: >I have just released a new beta 4.41.2. >This is mostly a bugfix from 4.41.1. >The next version will be based on this one, so please file your bug >reports :-) > > > >Hi Julian, > >I noticed that the date code still had that slight race condition that I >reported before; I've included the previous message below! > >Chuck > >----------- > >Hi, > >Finally had time to play with the new MailScanner code, and looked at the >changes made from below. One thing that I've realised now that I hadn't >before is that the originating time() value isn't being kept, which meant >that it wasn't available to my custom functions as I'd hoped - having to >parse the string to get the hours and minutes out is a bit painful! > >A simple addition to the new function to keep that value would be very >useful; I used 'dateval' for that in my code: > > # Set the date string and number > $this->{dateval} = time; > $this->{datestring} = scalar localtime($this->{dateval}); > my ($day, $month, $year) = (localtime($this->dateval))[3,4,5]; > $this->{datenumber} = sprintf("%04d%02d%02d", $year+1900, $month+1, $day); > >This also avoided the (very very slight!) situation where the day changes >between the setting of datestring and datenumber in the original code, which >both called a fresh time in localtime(). > > >Also, there are a couple of points in the code that still call TodayDir() in >the archiving (Message.pm line 669,3982, MCPMessage.pm line 372) which could >conceivably end up with different dates - any plans to move those to >$this->{datenumber} too? (unless I missed something obvious!) > >Best Wishes, >Chuck > > >This message should be regarded as confidential. If you have received this >email in error please notify the sender and destroy it immediately. >Statements of intent shall only become binding when confirmed in hard copy >by an authorized signatory. > > >-- >This message has been scanned for viruses and potentially >harmful content by StreamShield Protector. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Application/X-GZIP 596bytes. ] [ Unable to print this part. ] [ Part 3, Application/X-GZIP 468bytes. ] [ Unable to print this part. ] From chuck.foster at STREAMSHIELD.COM Thu Apr 28 12:27:18 2005 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > Please can you try the attached patches for MCPMessage.pm and Message.pm. Yup, they're fine. Dare I say it you could remove the TodayDir() function completely now ... Still have the two localtime()'s to resolve in Message::New() though :-) Thanks Chuck This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. -- This message has been scanned for viruses and potentially harmful content by StreamShield Protector. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 28 13:48:24 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I don't think you can avoid the 2 calls to localtime can you? In a scalar context it returns a nice pretty string and in a list context it returns a structure. So evaluating it in a list context, and then using the "scalar" operator on that would not have the same effect as applying the "scalar" operator directly on localtime itself. Chuck Foster wrote: >>Please can you try the attached patches for MCPMessage.pm and Message.pm. >> >> > >Yup, they're fine. Dare I say it you could remove the TodayDir() function >completely now ... > > >Still have the two localtime()'s to resolve in Message::New() though :-) > >Thanks >Chuck > > >This message should be regarded as confidential. If you have received this >email in error please notify the sender and destroy it immediately. >Statements of intent shall only become binding when confirmed in hard copy >by an authorized signatory. > > >-- >This message has been scanned for viruses and potentially >harmful content by StreamShield Protector. > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chuck.foster at STREAMSHIELD.COM Thu Apr 28 14:03:39 2005 From: chuck.foster at STREAMSHIELD.COM (Chuck Foster) Date: Thu Jan 12 21:29:25 2006 Subject: ANNOUNCE: beta release 4.41.2 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi Julian, localtime acts upon a time integer if you pass it as a parameter, so if you save the current time first you can then use it in subsequent calls - that way you can call localtime twice with the same time. My original message had a patch for that (and kept it as a Message variable so I could use it in my custom functions :-)). Hope that makes sense! C:> -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On Behalf Of Julian Field Sent: 28 April 2005 13:48 To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: ANNOUNCE: beta release 4.41.2 I don't think you can avoid the 2 calls to localtime can you? In a scalar context it returns a nice pretty string and in a list context it returns a structure. So evaluating it in a list context, and then using the "scalar" operator on that would not have the same effect as applying the "scalar" operator directly on localtime itself. Chuck Foster wrote: >>Please can you try the attached patches for MCPMessage.pm and Message.pm. >> >> > >Yup, they're fine. Dare I say it you could remove the TodayDir() function >completely now ... > > >Still have the two localtime()'s to resolve in Message::New() though :-) > >Thanks >Chuck This message should be regarded as confidential. If you have received this email in error please notify the sender and destroy it immediately. Statements of intent shall only become binding when confirmed in hard copy by an authorized signatory. -- This message has been scanned for viruses and potentially harmful content by StreamShield Protector. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dh at UPTIME.AT Thu Apr 28 14:23:02 2005 From: dh at UPTIME.AT ([ISO-8859-1] David Höhn) Date: Thu Jan 12 21:29:25 2006 Subject: incoming/outgoing spool shared with several mailscanners over nfs? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 Ugo Bellavance wrote: > Leif Neland wrote: > >> Just FYI: >> >> I tried using balance (http://sourceforge.net/projects/balance/) >> It's an userland daemon, which listens on one port, and forwards the >> requests to several servers on a round robin schedule. >> It works ok, but had the disadvantage that all connections to sendmail >> came >> from my own network, and therefore was whitelisted; all acl's on ip was >> defeated. >> I must look into other types of loadbalancing, beside dns. > > > Is there a reason why you can't go with DNS? Yepp I would love to know that as well :) Luckily enough SMTP has load balancing built in by design so to speak :) - -d - -- nee anata wo mitsukete soshite nidoto wasurezu donna ni munega itakutemo soba ni iru no zutto...zutto...zutto Key fingerprint = FD77 F0B7 5C65 F546 EB08 A4EC 3CCA 1A32 7E24 291E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (Darwin) iD8DBQFCcOO2PMoaMn4kKR4RA+DHAJ9WBp3oesciJINPOcOm1mKOxCERLwCbBCBs I/i3nMnCcOeScm21Ahn1yD8= =m4L2 -----END PGP SIGNATURE----- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From ugob at CAMO-ROUTE.COM Thu Apr 28 14:09:33 2005 From: ugob at CAMO-ROUTE.COM (Ugo Bellavance) Date: Thu Jan 12 21:29:25 2006 Subject: incoming/outgoing spool shared with several mailscanners over nfs? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Leif Neland wrote: > Just FYI: > > I tried using balance (http://sourceforge.net/projects/balance/) > It's an userland daemon, which listens on one port, and forwards the > requests to several servers on a round robin schedule. > It works ok, but had the disadvantage that all connections to sendmail came > from my own network, and therefore was whitelisted; all acl's on ip was > defeated. > I must look into other types of loadbalancing, beside dns. Is there a reason why you can't go with DNS? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Thu Apr 28 14:32:04 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:25 2006 Subject: Blocked filename and filetype attachments scanning changed in 4.40? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Since running MS 4.40, I noticed a change in the behavour of virus scanning and attachment scanning. MailScanner.conf contains: Dangerous Content Scanning = %etc-dir%/rules/not.localhost.rules not.localhost.rules contains: From: 127.0.0.1 no From: 192.168.0.30 no FromOrTo: default yes Since 4.40, messages submitted from the MS machine, still get attachments blocked by filename and filetype! Has there been a change in behaviour? Thanks, Adri. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From adrik at SALESMANAGER.NL Thu Apr 28 15:00:50 2005 From: adrik at SALESMANAGER.NL (Adri Koppes) Date: Thu Jan 12 21:29:25 2006 Subject: Blocked filename and filetype attachments scanning changed in 4.40? Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Thanks, I'll wait for the final 4.41 version. Adri. > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Julian Field > Sent: 28 April, 2005 15:55 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Blocked filename and filetype attachments > scanning changed > in 4.40? > > > That's a bug in 4.40 which I hope is corrected in the latest > beta of 4.41. > > Adri Koppes wrote: > > >Since running MS 4.40, I noticed a change in the behavour of > virus scanning and attachment scanning. > >MailScanner.conf contains: > > > >Dangerous Content Scanning = %etc-dir%/rules/not.localhost.rules > > > >not.localhost.rules contains: > > > >From: 127.0.0.1 no > >From: 192.168.0.30 no > >FromOrTo: default yes > > > >Since 4.40, messages submitted from the MS machine, still > get attachments blocked by filename and filetype! > >Has there been a change in behaviour? > > > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve at yurmail.com Thu Apr 28 14:53:17 2005 From: steve at yurmail.com (Steve Waterman) Date: Thu Jan 12 21:29:25 2006 Subject: Debian unstable error on 'MailScanner check' Message-ID: System: Debian unstable Kernel: 2.6.11, custom Mailscanner version: 4.40.11-1 CPU: Intel Pentium III (Katmai) stepping 02, 450 Mhz Memory: 512 MB Filesystem: EXT3 Perl: revision 5 version 8 subversion 4 Characteristics of this binary (from libperl): Compile-time options: MULTIPLICITY USE_ITHREADS USE_LARGE_FILES PERL_IMPLICIT_ CONTEXT Built under linux Compiled at Mar 8 2005 19:51:48 @INC: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl Apt-get sources are default and all updates have been applied 'apt-get update' and 'apt-get upgrade'. Problem: When running the command 'MailScanner check' or '/etc/init.d/MailScanner start' I receive the following error: Cannot open config file check, No such file or directory at /usr/share/MailScanner/MailScanner/Config.pm line 592. Compilation failed in require at /usr/sbin/MailScanner line 65. BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 65. Line 592 in /usr/share/MailScanner/MailScanner/Config.pm refers to: $fh->open("<$filename") or die "Cannot open config file $filename, $!"; Line 65 in /usr/sbin/MailScanner refers to: use MailScanner::CustomConfig; I have removed MailScanner via 'apt-get remove mailscanner --purge', re-installed, edited the maintainer's /etc/MailScanner/MailScanner.conf file, saved the file and tried using my previous MailScanner.conf file from my previous working config. The program did work correctly until the last 'apt-get upgrade'. As a last resort, I have done an 'apt-get dist-upgrade' yet continue to receive the same error message. Thank you! Steve ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From spike_cacti at YAHOO.COM Thu Apr 28 17:02:25 2005 From: spike_cacti at YAHOO.COM (Spike Cacti) Date: Thu Jan 12 21:29:25 2006 Subject: can't get rid of *.header files in MS's incoming dir Message-ID: I upgraded from 4.35.11 to 4.40.11 and I now have this problem... (.header files stay in the incoming directory after processing...) I use postfix 2.0.16, SpamAssassin 3.0.2 and ClamAV I ran MailScanner with debug but saw nothing special... Im also running /var/spool/MailScanner/incoming in TMPFS (ram) All permissions look ok on /var/spool/MailScanner/incoming and on the header files (postfix:postfix with 600) Anyone knows what module in MailScanner is supposed to take care of this ? Spike ##################################################### Check that all your paths specifed in MailScanner.conf are real absolute paths and none of them involve any symlinks. Also check the permissions on /var/spool/MailScanner/incoming. Do you get any errors in the maillog? Are these files being created with the right owner and permissions? Aldas wrote: > Hi there, > > I have been using MS for long time , almost from the project begining, > i have to say it is really great program and i really enjoy it. My old > system is running on Redhat 6.2 with sendmail 8.11.6 and MS 4.32.5 > > Now i am setting up new system on Gentoo with ldap authentification, > Postfix 2.1.5 & MS 4.37.7 Everything seems to work perfect except one > anoying problem, after each message was scanned and delivered there is > *.header file left in incoming dir. After some time i have huge amount > of those header files and seems they are not going to disapear. I've > looked MS's conf file for 10x, searched google and FAQs with no > success. If someone has any ideas i'll be very thankful -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Thu Apr 28 17:48:28 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:29:25 2006 Subject: maillog logging level Message-ID: I have been trying to test sendmail and I am not having too much success. Namely because I do not know what I am doing, but I am trying to learn. So thank you all for bearing with me and answering my questions. I was trying to run commands such as: peanut# /usr/lib/sendmail -Ctest.cf -t -v To: craigh@ora.com From: craig Subject: Sendmail Test Ignore this test. I wasn't able to get anywhere. I did find this in my log, does this mean anything? I did do some searches and seen that this is a security measure and might be able to ignore it???? Apr 24 04:02:13 WoodenMS MailScanner[7073]: Disconnected from the database Apr 24 04:02:13 WoodenMS MailScanner[7073]: MailScanner child dying of old age Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS: ClientCertFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS: ClientKeyFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS: CACertPath missing Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS: CACertFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS: CRLFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS=client, init=1 I was also trying to find a way to just be able to send an email from the linux box to somewhere to see if sendmail is working (is that the best way to test it?) I also tried using the test link that you gave but the page wasn't found. I tried a search on testing email at the wiki site and found only post testing. Billy Pumphrey IT Manager Wooden & McLaughlin > -----Original Message----- > From: Steen, Glenn [mailto:Glenn.Steen@AP1.SE] > Sent: Wednesday, April 20, 2005 3:01 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Billy Pumphrey > > Sent: den 19 april 2005 21:45 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: maillog logging level > > > > > > When I set it up I either ran the one in the mailscanner book: > > Chkconfig --level all sendmail off > > Chkconfig --level 345 MailScanner on Service sendmail stop Service > > MailScanner start > > > > Or the one on the site > > http://www.sng.ecs.soton.ac.uk/mailscanner/install/linux.shtml > > > > service sendmail stop > > chkconfig sendmail off > > chkconfig --level 2345 MailScanner on > > service MailScanner start > > > > > > I do not recall which one that I did, but that did confuse me a little > > because they are different. I tried researching exactly what this > > does but I did not get very far. > They are assentially the same (less the Capital letter, and that one > setup MS to run at runlevel 2 as well... the --level is just someone > being explicit:-). > > > > I did run what you just said and here is what I found: > > > > If I do service MailScanner stop > > Then service sendmail status Sendmail is stopped > > > > UPDATE UPDATE > > I feel stupid :), and linux just kicks my behind. My mistake on what > > information I have been giving you, I am sorry :(. I cannot pass mail > > through the machine. How I have been testing was by sending a email > > to my external email address, that address gets forwarded to my work > > address where mailscanner would then process it. What I forgot was > > that I had changed my setup. I no longer was forwarding my email, > > but I setup a > > POP3 account on > > my outlook and it received the email that way. > > (hope that makes sense) > > > > In other words, the email was never passing through mailscanner. > > > > So I believe my sendmail chkconfig to be correct. Now I am really > > lost on what to check. ?? > Ok, so you don't pass any mail through the system, and don't get any > logs of this nonevent? So... "service MailScanner start", then use the > connection testing examples in the wiki > http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot > :mta:connexion > > ... If that works OK, then arrange for mail to be passed through it... > The > same as you did for the "other machine"... Be it by FW rules, MX record > or > whatever. > > Or have you done that, and it still doesn't work? > > -- Glenn > > > > > > -----Original Message----- > > > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > > > Sent: Tuesday, April 19, 2005 10:53 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: maillog logging level > > > > > > Did you kill the sendmail service and stop it from starting when the > > > system boots? > > > As the installation script tells you, you need to do this after > > > installation (I kept it separate for clarity and also > > because a lot of > > > RPM-based systems do not have the "service" command). > > > chkconfig MailScanner on > > > chkconfig sendmail off > > > service sendmail stop > > > service MailScanner start > > > > > > I would suspect you still have a sendmail process running even after > > you > > > have done the "service MailScanner stop" as it will be left over the > > > "sendmail" service, which is not wanted. > > > > > > Billy Pumphrey wrote: > > > > > > >I think that I have a clue! > > > > > > > >I stopped mailscanner via service MailScanner stop. > > > >Then I sent a message to test to see if it would come > > through and it > > did. > > > > > > > >So messages are not even going through MailScanner. At > > this point I > > do > > > not > > > >know how to trouble shoot why really. I thought that I > > configured my > > new > > > >server (this one) the same as my last one. My setup is that > > MailScanner > > > is > > > >the relay between the internet and my exchange server 10.1.1.2. I > > will > > > run > > > >briefly what I did. > > > >Edited mailertable to: > > > >Woodmaclaw.com esmtp:[10.1.1.2] > > > >www.woodmaclaw.com esmtp:[10.1.1.2] > > > > > > > >Then I ran the makefile thing (??? Can't recall the command) for > > > >mailtertable > > > > > > > >Other than that I change organization name and such in > > MailScanner.conf. > > > > > > > >------------------------ MailScanner list > > ------------------------ To > > > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > >'leave mailscanner' in the body of the email. > > > >Before posting, read the Wiki > > (http://wiki.mailscanner.info/) and the > > > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > >Support MailScanner development - buy the book off the website! > > > > > > > > > > > > > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Buy the MailScanner book at www.MailScanner.info/store > > > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki > > (http://wiki.mailscanner.info/) and the > > > archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Thu Apr 28 17:51:44 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:29:25 2006 Subject: maillog logging level Message-ID: test Billy Pumphrey IT Manager Wooden & McLaughlin > -----Original Message----- > From: Steen, Glenn [mailto:Glenn.Steen@AP1.SE] > Sent: Wednesday, April 20, 2005 3:01 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > > -----Original Message----- > > From: MailScanner mailing list > > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Billy Pumphrey > > Sent: den 19 april 2005 21:45 > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: maillog logging level > > > > > > When I set it up I either ran the one in the mailscanner book: > > Chkconfig --level all sendmail off > > Chkconfig --level 345 MailScanner on > > Service sendmail stop > > Service MailScanner start > > > > Or the one on the site > > http://www.sng.ecs.soton.ac.uk/mailscanner/install/linux.shtml > > > > service sendmail stop > > chkconfig sendmail off > > chkconfig --level 2345 MailScanner on > > service MailScanner start > > > > > > I do not recall which one that I did, but that did confuse me a little > > because they are different. I tried researching exactly what > > this does but > > I did not get very far. > They are assentially the same (less the Capital letter, and that one > setup MS to run at runlevel 2 as well... the --level is just someone > being explicit:-). > > > > I did run what you just said and here is what I found: > > > > If I do service MailScanner stop > > Then service sendmail status > > Sendmail is stopped > > > > UPDATE UPDATE > > I feel stupid :), and linux just kicks my behind. My mistake on what > > information I have been giving you, I am sorry :(. I cannot pass mail > > through the machine. How I have been testing was by sending > > a email to my > > external email address, that address gets forwarded to my > > work address where > > mailscanner would then process it. What I forgot was that I > > had changed my > > setup. I no longer was forwarding my email, but I setup a > > POP3 account on > > my outlook and it received the email that way. > > (hope that makes sense) > > > > In other words, the email was never passing through mailscanner. > > > > So I believe my sendmail chkconfig to be correct. Now I am > > really lost > > on what to check. ?? > Ok, so you don't pass any mail through the system, and don't get any > logs > of this nonevent? So... "service MailScanner start", then use the > connection > testing examples in the wiki > http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot > :mta:connexion > > ... If that works OK, then arrange for mail to be passed through it... > The > same as you did for the "other machine"... Be it by FW rules, MX record > or > whatever. > > Or have you done that, and it still doesn't work? > > -- Glenn > > > > > > -----Original Message----- > > > From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] > > > Sent: Tuesday, April 19, 2005 10:53 AM > > > To: MAILSCANNER@JISCMAIL.AC.UK > > > Subject: Re: maillog logging level > > > > > > Did you kill the sendmail service and stop it from starting when the > > > system boots? > > > As the installation script tells you, you need to do this after > > > installation (I kept it separate for clarity and also > > because a lot of > > > RPM-based systems do not have the "service" command). > > > chkconfig MailScanner on > > > chkconfig sendmail off > > > service sendmail stop > > > service MailScanner start > > > > > > I would suspect you still have a sendmail process running even after > > you > > > have done the "service MailScanner stop" as it will be left over the > > > "sendmail" service, which is not wanted. > > > > > > Billy Pumphrey wrote: > > > > > > >I think that I have a clue! > > > > > > > >I stopped mailscanner via service MailScanner stop. > > > >Then I sent a message to test to see if it would come > > through and it > > did. > > > > > > > >So messages are not even going through MailScanner. At > > this point I > > do > > > not > > > >know how to trouble shoot why really. I thought that I > > configured my > > new > > > >server (this one) the same as my last one. My setup is that > > MailScanner > > > is > > > >the relay between the internet and my exchange server 10.1.1.2. I > > will > > > run > > > >briefly what I did. > > > >Edited mailertable to: > > > >Woodmaclaw.com esmtp:[10.1.1.2] > > > >www.woodmaclaw.com esmtp:[10.1.1.2] > > > > > > > >Then I ran the makefile thing (??? Can't recall the command) for > > > >mailtertable > > > > > > > >Other than that I change organization name and such in > > MailScanner.conf. > > > > > > > >------------------------ MailScanner list > > ------------------------ To > > > >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > >'leave mailscanner' in the body of the email. > > > >Before posting, read the Wiki > > (http://wiki.mailscanner.info/) and the > > > >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > > >Support MailScanner development - buy the book off the website! > > > > > > > > > > > > > > > > > > -- > > > Julian Field > > > www.MailScanner.info > > > Buy the MailScanner book at www.MailScanner.info/store > > > > > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > > > > > ------------------------ MailScanner list > > ------------------------ To > > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > > 'leave mailscanner' in the body of the email. > > > Before posting, read the Wiki > > (http://wiki.mailscanner.info/) and the > > > archives > > (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > > > Support MailScanner development - buy the book off the website! > > > > > > > ------------------------ MailScanner list ------------------------ To > > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > > 'leave mailscanner' in the body of the email. > > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > > > Support MailScanner development - buy the book off the website! > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 28 18:04:44 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:25 2006 Subject: maillog logging level Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm not sure the -v will actually help you, but the main things are 1) Put a blank line after the headers, before the body of the message 2) End the message by putting a dot '.' on its own on a line. 3) Make sure you put proper email address in the From and To as you are using -t so it gets the envelope addresses from the headers. So your message should look like To: craigh@ora.com From: craigh@ora.com Subject: Sendmail Test Ignore this test. . I think that should work rather better. If it doesn't immediately give you your shell prompt back after the "." line then press Ctrl-D to end the message. Billy A. Pumphrey wrote: >I have been trying to test sendmail and I am not having too much >success. Namely because I do not know what I am doing, but I am trying >to learn. So thank you all for bearing with me and answering my >questions. > >I was trying to run commands such as: >peanut# /usr/lib/sendmail -Ctest.cf -t -v >To: craigh@ora.com >From: craig >Subject: Sendmail Test >Ignore this test. > > >I wasn't able to get anywhere. I did find this in my log, does this >mean anything? I did do some searches and seen that this is a security >measure and might be able to ignore it???? > >Apr 24 04:02:13 WoodenMS MailScanner[7073]: Disconnected from the >database Apr 24 04:02:13 WoodenMS MailScanner[7073]: MailScanner child >dying of old age Apr 24 04:02:14 WoodenMS sendmail[9328]: STARTTLS: >ClientCertFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: >STARTTLS: ClientKeyFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: >STARTTLS: CACertPath missing Apr 24 04:02:14 WoodenMS sendmail[9328]: >STARTTLS: CACertFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: >STARTTLS: CRLFile missing Apr 24 04:02:14 WoodenMS sendmail[9328]: >STARTTLS=client, init=1 > >I was also trying to find a way to just be able to send an email from >the linux box to somewhere to see if sendmail is working (is that the >best way to test it?) I also tried using the test link that you gave but >the page wasn't found. I tried a search on testing email at the wiki >site and found only post testing. > >Billy Pumphrey >IT Manager >Wooden & McLaughlin > > > >>-----Original Message----- >>From: Steen, Glenn [mailto:Glenn.Steen@AP1.SE] >>Sent: Wednesday, April 20, 2005 3:01 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Re: maillog logging level >> >> >> >>>-----Original Message----- >>>From: MailScanner mailing list >>>[mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Billy Pumphrey >>>Sent: den 19 april 2005 21:45 >>>To: MAILSCANNER@JISCMAIL.AC.UK >>>Subject: Re: maillog logging level >>> >>> >>>When I set it up I either ran the one in the mailscanner book: >>>Chkconfig --level all sendmail off >>>Chkconfig --level 345 MailScanner on Service sendmail stop Service >>>MailScanner start >>> >>>Or the one on the site >>>http://www.sng.ecs.soton.ac.uk/mailscanner/install/linux.shtml >>> >>> service sendmail stop >>> chkconfig sendmail off >>> chkconfig --level 2345 MailScanner on >>> service MailScanner start >>> >>> >>>I do not recall which one that I did, but that did confuse me a >>> >>> >little > > >>>because they are different. I tried researching exactly what this >>>does but I did not get very far. >>> >>> >>They are assentially the same (less the Capital letter, and that one >>setup MS to run at runlevel 2 as well... the --level is just someone >>being explicit:-). >> >> >> >> >>>I did run what you just said and here is what I found: >>> >>>If I do service MailScanner stop >>> Then service sendmail status Sendmail is stopped >>> >>>UPDATE UPDATE >>>I feel stupid :), and linux just kicks my behind. My mistake on >>> >>> >what > > >>>information I have been giving you, I am sorry :(. I cannot pass >>> >>> >mail > > >>>through the machine. How I have been testing was by sending a email >>> >>> > > > >>>to my external email address, that address gets forwarded to my work >>> >>> > > > >>>address where mailscanner would then process it. What I forgot was >>>that I had changed my setup. I no longer was forwarding my email, >>>but I setup a >>>POP3 account on >>>my outlook and it received the email that way. >>>(hope that makes sense) >>> >>>In other words, the email was never passing through mailscanner. >>> >>>So I believe my sendmail chkconfig to be correct. Now I am really >>>lost on what to check. ?? >>> >>> >>Ok, so you don't pass any mail through the system, and don't get any >>logs of this nonevent? So... "service MailScanner start", then use the >> >> > > > >>connection testing examples in the wiki >> >> >> >http://wiki.mailscanner.info/doku.php?id=documentation:test_troubleshoot > > >>:mta:connexion >> >>... If that works OK, then arrange for mail to be passed through it... >>The >>same as you did for the "other machine"... Be it by FW rules, MX >> >> >record > > >>or >>whatever. >> >>Or have you done that, and it still doesn't work? >> >>-- Glenn >> >> >> >>>>-----Original Message----- >>>>From: Julian Field [mailto:MailScanner@ECS.SOTON.AC.UK] >>>>Sent: Tuesday, April 19, 2005 10:53 AM >>>>To: MAILSCANNER@JISCMAIL.AC.UK >>>>Subject: Re: maillog logging level >>>> >>>>Did you kill the sendmail service and stop it from starting when >>>> >>>> >the > > >>>>system boots? >>>>As the installation script tells you, you need to do this after >>>>installation (I kept it separate for clarity and also >>>> >>>> >>>because a lot of >>> >>> >>>>RPM-based systems do not have the "service" command). >>>> chkconfig MailScanner on >>>> chkconfig sendmail off >>>> service sendmail stop >>>> service MailScanner start >>>> >>>>I would suspect you still have a sendmail process running even >>>> >>>> >after > > >>>you >>> >>> >>>>have done the "service MailScanner stop" as it will be left over >>>> >>>> >the > > >>>>"sendmail" service, which is not wanted. >>>> >>>>Billy Pumphrey wrote: >>>> >>>> >>>> >>>>>I think that I have a clue! >>>>> >>>>>I stopped mailscanner via service MailScanner stop. >>>>>Then I sent a message to test to see if it would come >>>>> >>>>> >>>through and it >>>did. >>> >>> >>>>>So messages are not even going through MailScanner. At >>>>> >>>>> >>>this point I >>>do >>> >>> >>>>not >>>> >>>> >>>>>know how to trouble shoot why really. I thought that I >>>>> >>>>> >>>configured my >>>new >>> >>> >>>>>server (this one) the same as my last one. My setup is that >>>>> >>>>> >>>MailScanner >>> >>> >>>>is >>>> >>>> >>>>>the relay between the internet and my exchange server 10.1.1.2. >>>>> >>>>> >I > > >>>will >>> >>> >>>>run >>>> >>>> >>>>>briefly what I did. >>>>>Edited mailertable to: >>>>>Woodmaclaw.com esmtp:[10.1.1.2] >>>>>www.woodmaclaw.com esmtp:[10.1.1.2] >>>>> >>>>>Then I ran the makefile thing (??? Can't recall the command) for >>>>>mailtertable >>>>> >>>>>Other than that I change organization name and such in >>>>> >>>>> >>>MailScanner.conf. >>> >>> >>>>>------------------------ MailScanner list >>>>> >>>>> >>>------------------------ To >>> >>> >>>>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>>'leave mailscanner' in the body of the email. >>>>>Before posting, read the Wiki >>>>> >>>>> >>>(http://wiki.mailscanner.info/) and the >>> >>> >>>>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>>> >>>>>Support MailScanner development - buy the book off the website! >>>>> >>>>> >>>>> >>>>> >>>>> >>>>-- >>>>Julian Field >>>>www.MailScanner.info >>>>Buy the MailScanner book at www.MailScanner.info/store >>>> >>>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>>> >>>>------------------------ MailScanner list >>>> >>>> >>>------------------------ To >>> >>> >>>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>>'leave mailscanner' in the body of the email. >>>>Before posting, read the Wiki >>>> >>>> >>>(http://wiki.mailscanner.info/) and the >>> >>> >>>>archives >>>> >>>> >>>(http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> >>>>Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>>------------------------ MailScanner list ------------------------ >>> >>> >To > > >>>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> >>> >the > > >>>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>>------------------------ MailScanner list ------------------------ >>>To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>'leave mailscanner' in the body of the email. >>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>>Support MailScanner development - buy the book off the website! >>> >>> >>> >>------------------------ MailScanner list ------------------------ To >>unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>'leave mailscanner' in the body of the email. >>Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >>archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >>Support MailScanner development - buy the book off the website! >> >> > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From chardlist at CHARD.NET Thu Apr 28 18:49:03 2005 From: chardlist at CHARD.NET (chardlist) Date: Thu Jan 12 21:29:25 2006 Subject: Log files Message-ID: I have MS running on a system with Exim. Currently MS logs to /var/log/maillog whereas Exim logs to /var/log/exim_mainlog. How can I get the two to log into the same file? I'd rather make the change on the MS end since I'm afraid of Exim. -Brendan ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Apr 28 19:04:09 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:26 2006 Subject: Log files Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] chardlist wrote: >I have MS running on a system with Exim. Currently MS logs to >/var/log/maillog whereas Exim logs to /var/log/exim_mainlog. > >How can I get the two to log into the same file? I'd rather make the change >on the MS end since I'm afraid of Exim. > > Check your system logger configs. Logging isn't generally done directly to files by applications, they send system calls which the system logger picks up and sends to files. By default, MS sends it's messages to the log facility "mail". Once you find out what logging facility is being directed to exim_mainlog, you can modify your mailscanner.conf to use the same facility, or modify your system logger to direct mail logging to the exim file. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Thu Apr 28 20:16:39 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi, I noticed something odd. As of today almost all of my mail treated as spam. My configuration hasn't changed in the last of weeks. The funny thing is, spam isn't caught anymore, it scores very low. I'm receiving tons of spam right now. I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT. Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL 0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50) Apr 28 21:06:03 unix-asp MailScanner[89691]: Message 86ECC4AC14.538E1 from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=0.57, required 7, AWL 0.04, FORGED_RCVD_HELO 0.05, INFO_TLD 0.48) Apr 28 21:06:03 unix-asp MailScanner[89691]: Spam Checks: Found 5 spam messages Regards, Remy de Ruysscher. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From mkettler at EVI-INC.COM Thu Apr 28 20:33:28 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: > Hi, > > I noticed something odd. As of today almost all of my mail treated as > spam. My configuration hasn't changed > in the last of weeks. The funny thing is, spam isn't caught anymore, it > scores very low. I'm receiving tons of spam right now. > > I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT. > > Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A > from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com > is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL > 0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50) That's happening because you are using rfc-ignorant in your MailScanner spam lists. rfc-ignorant currently lists the JISCMAIL.AC.UK domain, and has since august 2004. They take exception with the fact that the whois record for jiscmail doesn't have any contact information at all. No address, No phone, No email, Nothing. You might want to not use rfc-ignorant as a spam-list. In fact, IMHO, you shouldn't use MailScanner's spam-list at all. I've yet to find any RBL that I find suitably low in false positives to be trusted as a sole criteria for spam. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Thu Apr 28 20:46:01 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:29:26 2006 Subject: {Spam?} Re: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: Hi, I noticed something odd. As of today almost all of my mail treated as spam. My configuration hasn't changed in the last of weeks. The funny thing is, spam isn't caught anymore, it scores very low. I'm receiving tons of spam right now. I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT. Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL 0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50) That's happening because you are using rfc-ignorant in your MailScanner spam lists. Thanks for the reply. Yes, I saw the headers. I'm just wondered why this happened suddenly. Why does MailScanner tags mail as spam, when it hits only 1 spam list (and the spam score is below the threshold)? See my config below. spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=0.805, required 7, AWL 0.27, FORGED_RCVD_HELO 0.05, INFO_TLD 0.48) # Spam List = ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL spamcop.net SORBS-DNSBL SORBS-DUL CBL RSL DSBL BLITZEDALL # This is the list of spam domain blacklists which you are using # (such as the "rfc-ignorant" domains). See the "Spam List Definitions" # file for more information about what you can put here. # This can also be the filename of a ruleset. Spam Domain List = RFC-IGNORANT-DSN RFC-IGNORANT-BOGUSMX RFC-IGNORANT-IPWHOIS RFC-IGNORANT-ABUSE # If a message appears in at least this number of "Spam Lists" (as defined # above), then the message will be treated as "High Scoring Spam" and so # the "High Scoring Spam Actions" will happen. You probably want to set # this to 2 if you are actually using this feature. 5 is high enough that # it will never happen unless you use lots of "Spam Lists". # This can also be the filename of a ruleset. Spam Lists To Reach High Score = 3 rfc-ignorant currently lists the JISCMAIL.AC.UK domain, and has since august 2004. They take exception with the fact that the whois record for jiscmail doesn't have any contact information at all. No address, No phone, No email, Nothing. You might want to not use rfc-ignorant as a spam-list. In fact, IMHO, you shouldn't use MailScanner's spam-list at all. I've yet to find any RBL that I find suitably low in false positives to be trusted as a sole criteria for spam. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! -- met vriendelijke groet / with kind regards, Remy de Ruysscher remy@unix-asp.com ---- Microsoft: Where do you want to go today? Linux: Where do you want to go tomorrow? FreeBSD: Are you guys coming or what? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 28 20:55:20 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:26 2006 Subject: {Spam?} Re: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: > >>Remy de Ruysscher wrote: >> >> >> >>>Hi, >>> >>>I noticed something odd. As of today almost all of my mail treated as >>>spam. My configuration hasn't changed >>>in the last of weeks. The funny thing is, spam isn't caught anymore, it >>>scores very low. I'm receiving tons of spam right now. >>> >>>I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT. >>> >>>Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A >>>from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com >>>is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL >>>0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50) >>> >>> >> >> >>That's happening because you are using rfc-ignorant in your MailScanner >>spam lists. >> >> >> > Thanks for the reply. > > Yes, I saw the headers. I'm just wondered why this happened suddenly. > > Why does MailScanner tags mail as spam, when it hits only 1 spam list > (and the spam score is below the threshold)? See my config below. > > > spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=0.805, required 7, > AWL 0.27, FORGED_RCVD_HELO 0.05, INFO_TLD 0.48) > > > # > Spam List = ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL spamcop.net > SORBS-DNSBL SORBS-DUL CBL RSL DSBL BLITZEDALL Remy, When MS finds a hit with any of the RBL listed on the Spam List the message gets tagged as spam. It takes just one hit. That's why Matt suggested to move RBL checks in SA. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Thu Apr 28 21:06:02 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] As an extra point, you are using the bogus-virus-warnings SpamAssassin ruleset. As a result, any mail from me or from the MailScanner list is hitting rules such as VIRUS_WARNING62. You need to add score VIRUS_WARNING15 0 score VIRUS_WARNING28 0 score VIRUS_WARNING33 0 score VIRUS_WARNING62 0 score VIRUS_WARNING66 0 score VIRUS_WARNING226 0 score VIRUS_WARNING250 0 score VIRUS_WARNING300 0 score VIRUS_WARNING326 0 score VIRUS_WARNING339 0 score VIRUS_WARNING340 0 to your SpamAssassin configuration, so that mail from me does not get such a big score. Remy de Ruysscher wrote: > Hi, > > I noticed something odd. As of today almost all of my mail treated as > spam. My configuration hasn't changed > in the last of weeks. The funny thing is, spam isn't caught anymore, it > scores very low. I'm receiving tons of spam right now. > > I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT. > > Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A > from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com > is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL > 0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50) > Apr 28 21:06:03 unix-asp MailScanner[89691]: Message 86ECC4AC14.538E1 > from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com > is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=0.57, required 7, AWL > 0.04, FORGED_RCVD_HELO 0.05, INFO_TLD 0.48) > Apr 28 21:06:03 unix-asp MailScanner[89691]: Spam Checks: Found 5 spam > messages > > Regards, > Remy de Ruysscher. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From remy at UNIX-ASP.COM Thu Apr 28 21:25:18 2005 From: remy at UNIX-ASP.COM (Remy de Ruysscher) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, Denis, Matt, Thanks for the quick response! It's working perfectly now. Any suggestions on which spam lists to use? I'm currently using: ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL spamcop.net SORBS-DNSBL SORBS-DUL CBL RSL DSBL BLITZEDALL I haven't updated the list for at least a year. Greeting, Remy. Julian Field wrote: > As an extra point, you are using the bogus-virus-warnings SpamAssassin > ruleset. As a result, any mail from me or from the MailScanner list is > hitting rules such as VIRUS_WARNING62. > > You need to add > > score VIRUS_WARNING15 0 > score VIRUS_WARNING28 0 > score VIRUS_WARNING33 0 > score VIRUS_WARNING62 0 > score VIRUS_WARNING66 0 > score VIRUS_WARNING226 0 > score VIRUS_WARNING250 0 > score VIRUS_WARNING300 0 > score VIRUS_WARNING326 0 > score VIRUS_WARNING339 0 > score VIRUS_WARNING340 0 > > to your SpamAssassin configuration, so that mail from me does not get > such a big score. > > Remy de Ruysscher wrote: > >> Hi, >> >> I noticed something odd. As of today almost all of my mail treated as >> spam. My configuration hasn't changed >> in the last of weeks. The funny thing is, spam isn't caught anymore, it >> scores very low. I'm receiving tons of spam right now. >> >> I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT. >> >> Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A >> from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com >> is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL >> 0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50) >> Apr 28 21:06:03 unix-asp MailScanner[89691]: Message 86ECC4AC14.538E1 >> from 80.126.112.129 (owner-mailscanner@jiscmail.ac.uk) to unix-asp.com >> is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=0.57, required 7, AWL >> 0.04, FORGED_RCVD_HELO 0.05, INFO_TLD 0.48) >> Apr 28 21:06:03 unix-asp MailScanner[89691]: Spam Checks: Found 5 spam >> messages >> >> Regards, >> Remy de Ruysscher. >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > > -- met vriendelijke groet / with kind regards, Remy de Ruysscher remy@unix-asp.com ---- Microsoft: Where do you want to go today? Linux: Where do you want to go tomorrow? FreeBSD: Are you guys coming or what? ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 3.9KB. ] [ Unable to print this part. ] From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 28 21:48:38 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: > Julian, Denis, Matt, > > Thanks for the quick response! It's working perfectly now. > > Any suggestions on which spam lists to use? > > I'm currently using: ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL > spamcop.net SORBS-DNSBL SORBS-DUL CBL RSL DSBL BLITZEDALL > > I haven't updated the list for at least a year. Remy, I only use ORDB-RBL and leave everything else to SA. Works very well. Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From ivessm at softecusa.com Thu Apr 28 22:11:04 2005 From: ivessm at softecusa.com (Stewart M. Ives) Date: Thu Jan 12 21:29:26 2006 Subject: OT: mailwatch mailing list Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hey guys, Does anyone know if any further development is happening on Mailwatch. Seems to be stuck at current version 0.5.1 for a l-o-n-g while. BTW, it is a GREAT program and many thanks to the programmer/programmers. stew ---------- Original Message ----------- From: Wayne To: MAILSCANNER@JISCMAIL.AC.UK Sent: Wed, 27 Apr 2005 14:00:07 +0100 Subject: Re: OT: mailwatch mailing list > On 27/04/2005 13:52, "Martin Hepworth" LOGIC.COM> wrote: > > > work for me....you sure you're still subscribed? > > Yeah I saw your post, just tried now again if that fails again > Ill just try and unsubscribe/resubscribe see if that does anything.. > > Thanks, > Wayne > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------- End of Original Message ------- ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Thu Apr 28 22:26:24 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:26 2006 Subject: false negatives Message-ID: I'm seeing a bit of spam slipping through that I'd have thought would get caught. It looks pretty spammy, and here's the SpamCheck results: X-CBJ-MailScanner-SpamCheck: not spam, SpamAssassin (score=2.309, required 5, BAYES_00 -4.90, DRUGS_ERECTILE 1.00, DRUGS_ERECTILE_OBFU 1.50, HTML_50_60 0.10, HTML_FONT_BIG 0.27, HTML_MESSAGE 0.10, MSGID_FROM_MTA_SHORT 3.03, PRIORITY_NO_NAME 1.21) This is just one example, I also see the odd mortgage pitch, or a 419 scam, etc. every now and then. Strange thing is, sometimes I'll see a spam message slipping through and an identical (but different recipient) one getting caught. Didn't think to compare the headers at the time though. Doh. On about all the stuff that slips throuhg I see the first test, BAYES_00 -4.90. Would this indicate that I'm suffering from a case of bayes poisoning? Should I dump the bayes database and start over using the starter kit on Fortress' site, or are there other, better options? TIA... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From smf at F2S.COM Thu Apr 28 23:23:07 2005 From: smf at F2S.COM (Steve Freegard) Date: Thu Jan 12 21:29:26 2006 Subject: OT: mailwatch mailing list Message-ID: Hi Stewart, On Thu, 2005-04-28 at 17:11 -0400, Stewart M. Ives wrote: > Hey guys, > > Does anyone know if any further development is happening on Mailwatch. Seems > to be stuck at current version 0.5.1 for a l-o-n-g while. > > BTW, it is a GREAT program and many thanks to the programmer/programmers. > Thanks - I'm still actively developing MailWatch and there will be a new release soonish - unfortunately I broke the 'release early/release often' rule which has caused me a few headaches, plus the last 6 months have been a bit hectic ;-)) Kind regards, Steve. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From lhaig at HAIGMAIL.COM Fri Apr 29 07:45:08 2005 From: lhaig at HAIGMAIL.COM (Lance Haig) Date: Thu Jan 12 21:29:26 2006 Subject: OT: mailwatch mailing list Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Steve, We can't wait :-) Lance Steve Freegard wrote: Hi Stewart, On Thu, 2005-04-28 at 17:11 -0400, Stewart M. Ives wrote: Hey guys, Does anyone know if any further development is happening on Mailwatch. Seems to be stuck at current version 0.5.1 for a l-o-n-g while. BTW, it is a GREAT program and many thanks to the programmer/programmers. Thanks - I'm still actively developing MailWatch and there will be a new release soonish - unfortunately I broke the 'release early/release often' rule which has caused me a few headaches, plus the last 6 months have been a bit hectic ;-)) Kind regards, Steve. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 29 08:52:41 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:26 2006 Subject: SophosSAVI Problems with MailScanner 4.38.10 Message-ID: Aaron How did you upgrade? Did you remember to do the upgrade using the Sophos install from the MailScanner distribution??? -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Aaron Moore wrote: > I upgraded Sophos from version 3.92 to 3.93 earlier today. I've been > getting error 538 messages when MailScanner tries to scan the messages. > I've verified that SAVI is working okay by using the test scan.pl script > to scan some files. > > It has to be something with what mailscanner is scanning. > > Anyone have any ideas? > > I'm running MailScanner 4.38.10, with SAVI-Perl 0.30, and Sophos Linux > (libc6 glibc 2.2+) version 3.93. > > Thanks. > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From michele at BLACKNIGHT.IE Fri Apr 29 09:07:56 2005 From: michele at BLACKNIGHT.IE (Michele Neylon :: Blacknight Solutions) Date: Thu Jan 12 21:29:26 2006 Subject: FYI FW: SpamAssassin 3.0.3 Released Message-ID: Michael Parker wrote: > SpamAssassin 3.0.3 is released! SpamAssassin 3.0.3 contains > some important bug fixes and is recommended for use over > previous versions. > > SpamAssassin is a mail filter which uses advanced statistical > and heuristic tests to identify spam (also known as > unsolicited bulk email). > > Highlights of the release > ------------------------- > > - Fixed possible memory bloat from large AutoWhitelist db files > > - Fixed where user defined rules scores became ignored > > - Updated parsing code for several Received: header formats > > - Increased some BAYES_* scores for the network+bayes score set > > - Document set_tag for Plugin API and added get_tag > > - Additional bug fixes. > > Downloading > ----------- > > You can pick up the release here: http://spamassassin.apache.org/ > > You can also find it on your favorite CPAN mirror (you may > need to wait a day or so for the release to propagate). > > md5sum of archive files: > c9028e72958909285e43feb806d948dc > Mail-SpamAssassin-3.0.3.tar.bz2 > ca96f23cd1eb7d663ab55db98ef8090c Mail-SpamAssassin-3.0.3.tar.gz > d7292ec75eb61e0fa2ceb6aa5b20fed9 Mail-SpamAssassin-3.0.3.zip > > sha1sum of archive files: > 324763dd7b344b68ad9ab73fd68b8f779c801aab > Mail-SpamAssassin-3.0.3.tar.bz2 > e31407b68bf362dfe53814c0af867e8134c9808b > Mail-SpamAssassin-3.0.3.tar.gz > c1aa1583eebc0771ee053b8a484a42fc22b8630c Mail-SpamAssassin-3.0.3.zip > > The release files also have a .asc accompanying them. The > file serves as an external GPG signature for the given > release file. The signing key is available via the > wwwkeys.pgp.net key server, as well as > http://spamassassin.apache.org/released/GPG-SIGNING-KEY > > The key information is: > > pub 1024D/265FA05B 2003-06-09 SpamAssassin Signing Key > Key fingerprint =3D 26C9 00A4 6DD4 > 0CD5 AD24 F6D7 DEE0 1987 265F A05B > > Note: GnuPG 1.4.0, and possibly 1.3.x versions, seem to have > problems verifying certain signature files, including the > type as used for SpamAssassin releases. If you are running an > affected version, please verify the code using both MD5 and > SHA1 sum values instead. > > The SpamAssassin Developers Mr Michele Neylon Blacknight Internet Solutions Ltd Hosting, co-location & domains http://www.blacknight.ie/ Tel. +353 59 9137101 | Fax. +353 59 9146970 Tired of your current host? Save 15% when you move to us! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 29 09:11:18 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:26 2006 Subject: {Dangerous Filename?} [Fwd: SpamAssassin 3.0.3 Released] Message-ID: Warning: This message has had one or more attachments removed Warning: (nsmail.tmp). Warning: Please read the "ECS-Attachment-Warning.txt" attachment(s) for more information. Jules any tests done on this...?? I presume it 'should' be fine (for varying values of should ;-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 -------- Original Message -------- Subject: SpamAssassin 3.0.3 Released Date: Thu, 28 Apr 2005 22:22:22 -0500 From: Michael Parker To: announce@spamassassin.apache.org, users@spamassassin.apache.org, dev@spamassassin.apache.org SpamAssassin 3.0.3 is released! SpamAssassin 3.0.3 contains some important bug fixes and is recommended for use over previous versions. SpamAssassin is a mail filter which uses advanced statistical and heuristic tests to identify spam (also known as unsolicited bulk email). Highlights of the release ------------------------- - Fixed possible memory bloat from large AutoWhitelist db files - Fixed where user defined rules scores became ignored - Updated parsing code for several Received: header formats - Increased some BAYES_* scores for the network+bayes score set - Document set_tag for Plugin API and added get_tag - Additional bug fixes. Downloading ----------- You can pick up the release here: http://spamassassin.apache.org/ You can also find it on your favorite CPAN mirror (you may need to wait a day or so for the release to propagate). md5sum of archive files: c9028e72958909285e43feb806d948dc Mail-SpamAssassin-3.0.3.tar.bz2 ca96f23cd1eb7d663ab55db98ef8090c Mail-SpamAssassin-3.0.3.tar.gz d7292ec75eb61e0fa2ceb6aa5b20fed9 Mail-SpamAssassin-3.0.3.zip sha1sum of archive files: 324763dd7b344b68ad9ab73fd68b8f779c801aab Mail-SpamAssassin-3.0.3.tar.bz2 e31407b68bf362dfe53814c0af867e8134c9808b Mail-SpamAssassin-3.0.3.tar.gz c1aa1583eebc0771ee053b8a484a42fc22b8630c Mail-SpamAssassin-3.0.3.zip The release files also have a .asc accompanying them. The file serves as an external GPG signature for the given release file. The signing key is available via the wwwkeys.pgp.net key server, as well as http://spamassassin.apache.org/released/GPG-SIGNING-KEY The key information is: pub 1024D/265FA05B 2003-06-09 SpamAssassin Signing Key Key fingerprint =3D 26C9 00A4 6DD4 0CD5 AD24 F6D7 DEE0 1987 265F A05B Note: GnuPG 1.4.0, and possibly 1.3.x versions, seem to have problems verifying certain signature files, including the type as used for SpamAssassin releases. If you are running an affected version, please verify the code using both MD5 and SHA1 sum values instead. The SpamAssassin Developers ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, Text/PLAIN (Name: "ECS-Attachment-Warning.txt") 20 lines. ] [ Unable to print this part. ] From MailScanner at ecs.soton.ac.uk Fri Apr 29 09:40:52 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:26 2006 Subject: {Dangerous Filename?} [Fwd: SpamAssassin 3.0.3 Released] Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I'm running it in production now. No problems whatsoever, as long as you have Digest::SHA1 installed, which my ClamAV-SA package installs for you anyway. I'll get ClamAV-SA updated next. Watch the output of the "perl Makefile.PL" command. Martin Hepworth wrote: > Warning: This message has had one or more attachments removed > Warning: (nsmail.tmp). > Warning: Please read the "ECS-Attachment-Warning.txt" attachment(s) > for more information. > > Jules > > any tests done on this...?? I presume it 'should' be fine (for varying > values of should ;-) > > -- > Martin Hepworth > Snr Systems Administrator > Solid State Logic > Tel: +44 (0)1865 842300 > > > -------- Original Message -------- > Subject: SpamAssassin 3.0.3 Released > Date: Thu, 28 Apr 2005 22:22:22 -0500 > From: Michael Parker > To: announce@spamassassin.apache.org, users@spamassassin.apache.org, > dev@spamassassin.apache.org > > SpamAssassin 3.0.3 is released! SpamAssassin 3.0.3 contains some > important bug fixes and is recommended for use over previous > versions. > > SpamAssassin is a mail filter which uses advanced statistical and > heuristic tests to identify spam (also known as unsolicited bulk email). > > Highlights of the release > ------------------------- > > - Fixed possible memory bloat from large AutoWhitelist db files > > - Fixed where user defined rules scores became ignored > > - Updated parsing code for several Received: header formats > > - Increased some BAYES_* scores for the network+bayes score set > > - Document set_tag for Plugin API and added get_tag > > - Additional bug fixes. > > Downloading > ----------- > > You can pick up the release here: http://spamassassin.apache.org/ > > You can also find it on your favorite CPAN mirror (you may need to > wait a day or so for the release to propagate). > > md5sum of archive files: > c9028e72958909285e43feb806d948dc Mail-SpamAssassin-3.0.3.tar.bz2 > ca96f23cd1eb7d663ab55db98ef8090c Mail-SpamAssassin-3.0.3.tar.gz > d7292ec75eb61e0fa2ceb6aa5b20fed9 Mail-SpamAssassin-3.0.3.zip > > sha1sum of archive files: > 324763dd7b344b68ad9ab73fd68b8f779c801aab Mail-SpamAssassin-3.0.3.tar.bz2 > e31407b68bf362dfe53814c0af867e8134c9808b Mail-SpamAssassin-3.0.3.tar.gz > c1aa1583eebc0771ee053b8a484a42fc22b8630c Mail-SpamAssassin-3.0.3.zip > > The release files also have a .asc accompanying them. The file serves > as an external GPG signature for the given release file. The signing > key is available via the wwwkeys.pgp.net key server, as well as > http://spamassassin.apache.org/released/GPG-SIGNING-KEY > > The key information is: > > pub 1024D/265FA05B 2003-06-09 SpamAssassin Signing Key > > Key fingerprint =3D 26C9 00A4 6DD4 0CD5 AD24 F6D7 DEE0 1987 265F > A05B > > Note: GnuPG 1.4.0, and possibly 1.3.x versions, seem to have problems > verifying certain signature files, including the type as used for > SpamAssassin releases. If you are running an affected version, please > verify the code using both MD5 and SHA1 sum values instead. > > The SpamAssassin Developers > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > >------------------------------------------------------------------------ > >This is a message from the MailScanner E-Mail Virus Protection Service >---------------------------------------------------------------------- >The original e-mail attachment "nsmail.tmp" >is on the list of unacceptable attachments for this site and has been >replaced by this warning message. > >If you wish to receive a copy of the original attachment, please >e-mail helpdesk and include the whole of this message >in your request. Alternatively, you can call them, with >the contents of this message to hand when you call. > >At Fri Apr 29 09:18:56 2005 the virus scanner said: > MailScanner: Dangerous attachment according to Microsoft Q883260 (nsmail.tmp) > >Note to Help Desk: Look on jackdaw in /var/spool/MailScanner/quarantine/20050429 (message j3T8IM7K016693). > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From rcooper at DWFORD.COM Fri Apr 29 13:59:25 2005 From: rcooper at DWFORD.COM (Rick Cooper) Date: Thu Jan 12 21:29:26 2006 Subject: Problem with unrar and 4.40.11 Message-ID: [ The following text is in the "iso-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK]On > Behalf Of Denis Beauchemin > Sent: Thursday, April 28, 2005 10:27 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Problem with unrar and 4.40.11 > > > Hello, > > Just tested unrar with MS 4.40.11 and I got the following problem: all > extracted files have a zero length so MS is complaining about empty > attachments (because I asked it to). > > If I extract the archive manually everything is fine (no file has a zero > byte size). > > Is this corrected in more recent releases? > > Thanks! > > Denis > Sorry to take so long to get back. I have checked 4.40.11 and files extract fine. But my version of 4.40.11 has all the fixes that are in the version Julian just released, so it could have something to do with one of the several items that were changed. I honestly don't know exactly what lines I changed I just submit the changes to Julian and go back to work. I would try the latest version, if that doesn't resolve your problem it would be most helpful if you could send an example archive for me to test. Bear in mind that if the rar is encrypted all files will be zero in length since they cannot be opened but the file names will be tested against your file name rules. Rick Cooper -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Thu Apr 28 16:03:24 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:26 2006 Subject: Debian unstable error on 'MailScanner check' Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] "MailScanner check" is not a valid command. Do you mean "check_MailScanner"? Steve Waterman wrote: >System: Debian unstable >Kernel: 2.6.11, custom >Mailscanner version: 4.40.11-1 >CPU: Intel Pentium III (Katmai) stepping 02, 450 Mhz >Memory: 512 MB >Filesystem: EXT3 >Perl: revision 5 version 8 subversion 4 >Characteristics of this binary (from libperl): > Compile-time options: MULTIPLICITY USE_ITHREADS USE_LARGE_FILES >PERL_IMPLICIT_ >CONTEXT > Built under linux > Compiled at Mar 8 2005 19:51:48 > @INC: > /etc/perl > /usr/local/lib/perl/5.8.4 > /usr/local/share/perl/5.8.4 > /usr/lib/perl5 > /usr/share/perl5 > /usr/lib/perl/5.8 > /usr/share/perl/5.8 > /usr/local/lib/site_perl > >Apt-get sources are default and all updates have been applied 'apt-get >update' and 'apt-get upgrade'. > >Problem: > >When running the command 'MailScanner check' or '/etc/init.d/MailScanner >start' I receive the following error: > >Cannot open config file check, No such file or directory at >/usr/share/MailScanner/MailScanner/Config.pm line 592. >Compilation failed in require at /usr/sbin/MailScanner line 65. >BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 65. > >Line 592 in /usr/share/MailScanner/MailScanner/Config.pm refers to: > >$fh->open("<$filename") or die "Cannot open config file $filename, $!"; > >Line 65 in /usr/sbin/MailScanner refers to: > >use MailScanner::CustomConfig; > >I have removed MailScanner via 'apt-get remove mailscanner --purge', >re-installed, edited the maintainer's /etc/MailScanner/MailScanner.conf >file, saved the file and tried using my previous MailScanner.conf file from >my previous working config. > >The program did work correctly until the last 'apt-get upgrade'. As a last >resort, I have done an 'apt-get dist-upgrade' yet continue to receive the >same error message. > >Thank you! > >Steve > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Denis.Beauchemin at USHERBROOKE.CA Thu Apr 28 16:27:04 2005 From: Denis.Beauchemin at USHERBROOKE.CA (Denis Beauchemin) Date: Thu Jan 12 21:29:26 2006 Subject: Problem with unrar and 4.40.11 Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hello, Just tested unrar with MS 4.40.11 and I got the following problem: all extracted files have a zero length so MS is complaining about empty attachments (because I asked it to). If I extract the archive manually everything is fine (no file has a zero byte size). Is this corrected in more recent releases? Thanks! Denis -- _ °v° Denis Beauchemin, analyste /(_)\ Université de Sherbrooke, S.T.I. ^ ^ T: 819.821.8000x2252 F: 819.821.8045 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! [ Part 2, "S/MIME Cryptographic Signature" ] [ Application/X-PKCS7-SIGNATURE 4.4KB. ] [ Unable to print this part. ] From spike_cacti at YAHOO.COM Fri Apr 29 15:16:05 2005 From: spike_cacti at YAHOO.COM (Spike Cacti) Date: Thu Jan 12 21:29:26 2006 Subject: Can't get rid of the .header files in the incoming directory.... Take 2, more info... Message-ID: These are the files in 1 of the incoming directory. -rw------- 1 postfix postfix 560 Apr 29 09:26 0F9925018B.2FCCA.header -rw------- 1 postfix postfix 655 Apr 29 09:25 1113150180.90685.header -rw------- 1 postfix postfix 492 Apr 29 09:38 1505750245.D9F99.header -rw------- 1 postfix postfix 661 Apr 29 09:25 3740C50181.BB3CC.header -rw------- 1 postfix postfix 654 Apr 29 09:26 377DC50192.2C0F7.header -rw------- 1 postfix postfix 642 Apr 29 09:28 3FD34501AA.CE42A.header -rw------- 1 postfix postfix 664 Apr 29 09:30 41F3D501DB.150E6.header -rw------- 1 postfix postfix 753 Apr 29 09:36 4D89550227.E5E08.header -rw------- 1 postfix postfix 600 Apr 29 09:37 555DF50251.EC685.header -rw------- 1 postfix postfix 696 Apr 29 09:31 56614501F1.7145D.header -rw------- 1 postfix postfix 2145 Apr 29 09:36 62EF75022F.4DB55.header -rw------- 1 postfix postfix 702 Apr 29 09:37 646E450246.E6DCE.header -rw------- 1 postfix postfix 672 Apr 29 09:37 7FDEA5024D.66BD8.header -rw------- 1 postfix postfix 2100 Apr 29 09:26 9B7B150180.60E20.header -rw------- 1 postfix postfix 633 Apr 29 09:38 9BC5F50245.C8FE3.header -rw------- 1 postfix postfix 1463 Apr 29 09:26 A169B50174.CC622.header -rw------- 1 postfix postfix 651 Apr 29 09:25 B6CB450174.15372.header -rw------- 1 postfix postfix 1256 Apr 29 09:27 BF8845019F.C5637.header -rw------- 1 postfix postfix 1284 Apr 29 09:35 D7A7D50211.2B245.header -rw------- 1 postfix postfix 454 Apr 29 09:26 E01FD50192.27BEE.header -rw------- 1 postfix postfix 765 Apr 29 09:25 F1DCC5017F.056E1.header Doing a strace, I can see the following : chdir("/var/spool/MailScanner/incoming/15462") = 0 open(".", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 6 fstat64(6, {st_mode=S_IFDIR|0700, st_size=360, ...}) = 0 fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 getdents64(6, /* 18 entries */, 4096) = 808 stat64("4D89550227.E5E08", {st_mode=S_IFDIR|0700, st_size=80, ...}) = 0 unlink("E5E08.header") = -1 ENOENT (No such file or directory) stat64("4D89550227.E5E08.header", {st_mode=S_IFREG|0600, st_size=753, ...}) = 0 unlink("2B245.header") = -1 ENOENT (No such file or directory) stat64("D7A7D50211.2B245.header", {st_mode=S_IFREG|0600, st_size=1284, ...}) = 0 unlink("7145D.header") = -1 ENOENT (No such file or directory) stat64("56614501F1.7145D.header", {st_mode=S_IFREG|0600, st_size=696, ...}) = 0 unlink("150E6.header") = -1 ENOENT (No such file or directory) stat64("41F3D501DB.150E6.header", {st_mode=S_IFREG|0600, st_size=664, ...}) = 0 unlink("CE42A.header") = -1 ENOENT (No such file or directory) stat64("3FD34501AA.CE42A.header", {st_mode=S_IFREG|0600, st_size=642, ...}) = 0 unlink("C5637.header") = -1 ENOENT (No such file or directory) stat64("BF8845019F.C5637.header", {st_mode=S_IFREG|0600, st_size=1256, ...}) = 0 unlink("2C0F7.header") = -1 ENOENT (No such file or directory) stat64("377DC50192.2C0F7.header", {st_mode=S_IFREG|0600, st_size=654, ...}) = 0 unlink("27BEE.header") = -1 ENOENT (No such file or directory) stat64("E01FD50192.27BEE.header", {st_mode=S_IFREG|0600, st_size=454, ...}) = 0 unlink("60E20.header") = -1 ENOENT (No such file or directory) stat64("9B7B150180.60E20.header", {st_mode=S_IFREG|0600, st_size=2100, ...}) = 0 unlink("2FCCA.header") = -1 ENOENT (No such file or directory) stat64("0F9925018B.2FCCA.header", {st_mode=S_IFREG|0600, st_size=560, ...}) = 0 unlink("CC622.header") = -1 ENOENT (No such file or directory) stat64("A169B50174.CC622.header", {st_mode=S_IFREG|0600, st_size=1463, ...}) = 0 unlink("90685.header") = -1 ENOENT (No such file or directory) stat64("1113150180.90685.header", {st_mode=S_IFREG|0600, st_size=655, ...}) = 0 unlink("056E1.header") = -1 ENOENT (No such file or directory) stat64("F1DCC5017F.056E1.header", {st_mode=S_IFREG|0600, st_size=765, ...}) = 0 unlink("BB3CC.header") = -1 ENOENT (No such file or directory) stat64("3740C50181.BB3CC.header", {st_mode=S_IFREG|0600, st_size=661, ...}) = 0 I am not an expert, but I think it's unlinking with the wrong filename.... Could have to do with this code in WorkArea.pm, sub ClearAll : # Clean up the whole thing while($f = $dirhandle->read()) { #print STDERR "Studying \"$f\"\n"; next if $f =~ /^\./; # Needs untaint: $f =~ /([-\w]+\.header)$/ and unlink "$1"; # And delete core files $f =~ /^core$/ and unlink "core"; # Also needs untaint... sledgehammer. nut. $f =~ /(.*)/; push @ToDelete, $1 if -d "$1"; } $dirhandle->close(); Maybe due to the fact that you added a new header section in the name for Postfix queue files ? I dont think your regexp will match names like : 377DC50192.2C0F7.header I could also be totally wrong ;-) I just took a very quick look... Spike __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Thu Apr 28 18:29:16 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:29:26 2006 Subject: maillog logging level Message-ID: --- NOTE: I am trying to cut some of the message because it is being rejected looking like a script or something. --- Ok :) That worked, as in I sent a message to me from the sendmail successfully to my email address. Now how do I test to see if it can/will receive email? Billy Pumphrey IT Manager Wooden & McLaughlin > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Julian Field > Sent: Thursday, April 28, 2005 12:05 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > I'm not sure the -v will actually help you, but the main things are > 1) Put a blank line after the headers, before the body of the message > 2) End the message by putting a dot '.' on its own on a line. > 3) Make sure you put proper email address in the From and To as you are > using -t so it gets the envelope addresses from the headers. > > So your message should look like > To: craigh@ora.com > From: craigh@ora.com > Subject: Sendmail Test > > Ignore this test. > . > > I think that should work rather better. If it doesn't immediately give > you your shell prompt back after the "." line then press Ctrl-D to end > the message. > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Apr 29 16:38:43 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: Rose, Bobby wrote: > Is anyone else seeing this slip thru? The symantec stuff running on > our exchange servers is picking it up but it slipping thru my current > MailScanner and ClamAV configured email router. Symantec is saying > that it found W32.Mimail.a@mm in Unknown0000000.data within > message.html. Yesterday I added that to the banned filename types but > it still came thru so I'm wondering if it's another funky mime/header > issue. > > I'm running ClamAV .83 and Mailscanner 4.40.11 on Solaris 8. The > clamav defs are up to date. I'm going to try to quarantine one to > get a look at it. Are you sure the messages are coming through your MailScanner gateway? I had a similar problem a year or so ago where Trend would pick up viruses on Exchange. Turned out that one of my users had pointed their Outlook client at their home ISP so they could check non-local mail account. The viruses waltzed right in with nary so much as a 'howdy-do'. Fortunately, the bouncers from Trend took them in the back alley and pummelled them before they could cause a ruckus... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Fri Apr 29 16:24:43 2005 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: Is anyone else seeing this slip thru? The symantec stuff running on our exchange servers is picking it up but it slipping thru my current MailScanner and ClamAV configured email router. Symantec is saying that it found W32.Mimail.a@mm in Unknown0000000.data within message.html. Yesterday I added that to the banned filename types but it still came thru so I'm wondering if it's another funky mime/header issue. I'm running ClamAV .83 and Mailscanner 4.40.11 on Solaris 8. The clamav defs are up to date. I'm going to try to quarantine one to get a look at it. -=Bobby ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 29 16:42:05 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: So the moral os this is.... you need virus proctection every windows desktop, because that's where the problem is. like I've been saying for years really ;-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Rose, Bobby wrote: > >> Is anyone else seeing this slip thru? The symantec stuff running on >>our exchange servers is picking it up but it slipping thru my current >>MailScanner and ClamAV configured email router. Symantec is saying >>that it found W32.Mimail.a@mm in Unknown0000000.data within >>message.html. Yesterday I added that to the banned filename types but >>it still came thru so I'm wondering if it's another funky mime/header >>issue. >> >>I'm running ClamAV .83 and Mailscanner 4.40.11 on Solaris 8. The >>clamav defs are up to date. I'm going to try to quarantine one to >>get a look at it. > > > Are you sure the messages are coming through your MailScanner gateway? I > had a similar problem a year or so ago where Trend would pick up viruses on > Exchange. Turned out that one of my users had pointed their Outlook client > at their home ISP so they could check non-local mail account. The viruses > waltzed right in with nary so much as a 'howdy-do'. Fortunately, the > bouncers from Trend took them in the back alley and pummelled them before > they could cause a ruckus... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Kevin_Miller at CI.JUNEAU.AK.US Fri Apr 29 16:49:22 2005 From: Kevin_Miller at CI.JUNEAU.AK.US (Kevin Miller) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: Martin Hepworth wrote: > So the moral os this is.... > > you need virus proctection every windows desktop, because that's where > the problem is. > > like I've been saying for years really ;-) No, you need Linux desktops like we've all been saying for years. But that's a different war. S'later... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From martinh at SOLID-STATE-LOGIC.COM Fri Apr 29 16:50:30 2005 From: martinh at SOLID-STATE-LOGIC.COM (Martin Hepworth) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: MacOS X desktops ?? ;-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Martin Hepworth wrote: > >>So the moral os this is.... >> >>you need virus proctection every windows desktop, because that's where >>the problem is. >> >>like I've been saying for years really ;-) > > > No, you need Linux desktops like we've all been saying for years. But > that's a different war. > > S'later... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From brose at MED.WAYNE.EDU Fri Apr 29 16:57:03 2005 From: brose at MED.WAYNE.EDU (Rose, Bobby) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: Actually we do...at least here in house. AV on the desktop, AV on the mailbox servers (exchange), and AV on the email gateway. Been at this biz for along time. I'm still waiting for one to appear in the quarantine to see where it's coming from. Symantec just says it was detecting it in the smtp queue and the server that is reporting it is the one that all mail from the email (MailScanner) gateway uses to deliver mail into the exchange system. Yeh the AV is on the exchange servers is stopping it, but the mail gateway (MailScanner) also handles forwarding to other places outside my management control and I want to make sure that I'm not passing the problem onto someone else. Before I turned on quaranteening on Symantec, the last one came thru mentioned that the attachment "Mime.822" located in message.... That is kind of odd that the attachment is named that. I just wanted to send out a quick feeler to gauge others. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Friday, April 29, 2005 11:42 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: W32/MiMail.A So the moral os this is.... you need virus proctection every windows desktop, because that's where the problem is. like I've been saying for years really ;-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Rose, Bobby wrote: > >> Is anyone else seeing this slip thru? The symantec stuff running on >>our exchange servers is picking it up but it slipping thru my current >>MailScanner and ClamAV configured email router. Symantec is saying >>that it found W32.Mimail.a@mm in Unknown0000000.data within >>message.html. Yesterday I added that to the banned filename types but >>it still came thru so I'm wondering if it's another funky mime/header >>issue. >> >>I'm running ClamAV .83 and Mailscanner 4.40.11 on Solaris 8. The >>clamav defs are up to date. I'm going to try to quarantine one to get >>a look at it. > > > Are you sure the messages are coming through your MailScanner gateway? > I had a similar problem a year or so ago where Trend would pick up > viruses on Exchange. Turned out that one of my users had pointed > their Outlook client at their home ISP so they could check non-local > mail account. The viruses waltzed right in with nary so much as a > 'howdy-do'. Fortunately, the bouncers from Trend took them in the > back alley and pummelled them before they could cause a ruckus... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From bpumphrey at WOODMACLAW.COM Fri Apr 29 16:49:34 2005 From: bpumphrey at WOODMACLAW.COM (Billy A. Pumphrey) Date: Thu Jan 12 21:29:26 2006 Subject: maillog logging level Message-ID: --- NOTE: I erased the rest of the message to get by the "looks like a script" error" --- Ok, telnet To make it clear, I have a new MailScanner machine (the one that I am trying to get working) and the one in production that is out of date on software and hardware. Anyway, I know that sendmail is having problems because when I telnet to the new one it looks like it tries and just comes back to the command prompt. If I telnet to the old one a connection is made and shows some stuff. Now, Should I just reinstall sendmail on top of mine or something? I installed sendmail by selecting the package when installing centos4.0. The service appears to be running ok. I did the ch config that the book and web site talks about. A service MailScanner restart reads fine for the services starting (outgoing and incoming sendmail starts fine). If I look at the running services it has 1 sendmail running (under user smmsp) which is the one that is suppose to be running isn't it? I was comparing the service --status-all command between the 2 machines. The services looks the same as far as MailScanner and sendmail look. There is a sendmail running on each, and MailScanner running (MailScanner,incoming sendmail, outgoing sendmail) Billy Pumphrey IT Manager Wooden & McLaughlin ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Apr 28 20:54:23 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: >> >> > Thanks for the reply. > > Yes, I saw the headers. I'm just wondered why this happened suddenly. > > Why does MailScanner tags mail as spam, when it hits only 1 spam list > (and the spam score is below the threshold)? See my config below. > Because that's the definition of what the mailscanner spam lists do. If listed, tag as spam, no matter what SpamAssassin has to say about it. Period. No scoring, No nothing. 1 hit = instant spam tag. Basically the spam-lists are intended for those who want to just use RBLs as a block criteria. If you want to use scoring, then do it in your SpamAssassin configuration. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From t.d.lee at DURHAM.AC.UK Fri Apr 29 16:01:04 2005 From: t.d.lee at DURHAM.AC.UK (David Lee) Date: Thu Jan 12 21:29:26 2006 Subject: [Fwd: SpamAssassin 3.0.3 Released] Message-ID: On Fri, 29 Apr 2005, Julian Field wrote: > I'm running it in production now. No problems whatsoever, as long as you > have Digest::SHA1 installed, which my ClamAV-SA package installs for you > anyway. I'll get ClamAV-SA updated next. > Watch the output of the "perl Makefile.PL" command. We, too, have been running it in production since about 10:00 UK time (that's 5+ hours) on machines that handle 60K msgs per day. Nothing eventful (so far...). It seems to have better (higher) BAYES_95 and BAYES_99. (The previous version (3.0.2) had these surprisingly low, and so we had applied our own higher overrride values, which I should now (3.0.3) be able to remove.) Hope that helps. -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : University of Durham : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham : : Phone: +44 191 334 2752 U.K. : ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Apr 28 21:31:06 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: > As an extra point, you are using the bogus-virus-warnings SpamAssassin > ruleset. As a result, any mail from me or from the MailScanner list is > hitting rules such as VIRUS_WARNING62. > > You need to add > > score VIRUS_WARNING15 0 > score VIRUS_WARNING28 0 > score VIRUS_WARNING33 0 > score VIRUS_WARNING62 0 > score VIRUS_WARNING66 0 > score VIRUS_WARNING226 0 > score VIRUS_WARNING250 0 > score VIRUS_WARNING300 0 > score VIRUS_WARNING326 0 > score VIRUS_WARNING339 0 > score VIRUS_WARNING340 0 > > to your SpamAssassin configuration, so that mail from me does not get > such a big score. Julian, I'd revise that list. Really all he needs to disable is 62 to get mail from you. The others might hit mail from this list quoting spam reports, but some won't even do that. One doesn't even look to be MailScanner related at all. #This looks for a virus-scanning tool name in the From, including MailScanner (ie: Julian's mail) score VIRUS_WARNING62 0 #These are body rules and might hit posts on this list with people quoting output from their MailScanner. score VIRUS_WARNING28 0 score VIRUS_WARNING33 0 score VIRUS_WARNING226 0 score VIRUS_WARNING250 0 score VIRUS_WARNING300 0 score VIRUS_WARNING326 0 score VIRUS_WARNING340 0 # The following are header rules that won't hit mail from you or this list, but will hit real virus warnings from MailScanner. Won't hit quotes on the list. # These are probably safe to keep on, unless you re-scan your postmaster warning messages. # subject mentions "email viruses detected" score VIRUS_WARNING15 0 #Any header contains "Found to be infected" score VIRUS_WARNING66 0 #This one appears to have nothing to do with MailScanner at all: # looks for body-text reference to ISSWarning.txt, probably not MailScanner related despite description score VIRUS_WARNING339 0 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From amoore at DEKALBMEMORIAL.COM Thu Apr 28 21:19:13 2005 From: amoore at DEKALBMEMORIAL.COM (Aaron Moore) Date: Thu Jan 12 21:29:26 2006 Subject: SophosSAVI Problems with MailScanner 4.38.10 Message-ID: I upgraded Sophos from version 3.92 to 3.93 earlier today. I've been getting error 538 messages when MailScanner tries to scan the messages. I've verified that SAVI is working okay by using the test scan.pl script to scan some files. It has to be something with what mailscanner is scanning. Anyone have any ideas? I'm running MailScanner 4.38.10, with SAVI-Perl 0.30, and Sophos Linux (libc6 glibc 2.2+) version 3.93. Thanks. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From mkettler at EVI-INC.COM Thu Apr 28 21:44:30 2005 From: mkettler at EVI-INC.COM (Matt Kettler) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Remy de Ruysscher wrote: > Julian, Denis, Matt, > > Thanks for the quick response! It's working perfectly now. > > Any suggestions on which spam lists to use? As I said before... IMO you should use none. I have yet to find any RBL to be low enough in FPs. If I stopped caring about FPs, I might use XBL, as it came in with a 1.000 S/O in SA 3.0's set1 mass-checks. Same with DSBL. CBL and blitzed are redundant with XBL. XBL meta-lists both of them. SA 3.0's S/O for a couple other lists: 0.994 SPAMCOP 0.992 SORBS-DUL 0.985 SBL (For reference a S/O of 0.985 means that 98.5% of emails which hit the list were spam, and 1.5% were nonspam. The higher the S/O, the lower the FPs.) To me, anything with a S/O of less than 0.999 isn't even worth considering for a pure-block criteria. More than 1 in 1000 hits being a FP is too many for me when used with this kind of absolute treatment. Really, I'd prefer a SO of 0.99995 (1 FP in 20k hits) or higher, but the SA statistics would round even 0.9996 (1 in 2.5k) to 1.000 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve at yurmail.com Thu Apr 28 23:02:32 2005 From: steve at yurmail.com (Steve Waterman) Date: Thu Jan 12 21:29:26 2006 Subject: Debian unstable error on 'MailScanner check' Message-ID: Yes, I was using the wrong command. No problem here. check_MailScanner works as it should. Thank you, Steve -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Julian Field Sent: Thursday, April 28, 2005 10:03 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: Debian unstable error on 'MailScanner check' "MailScanner check" is not a valid command. Do you mean "check_MailScanner"? Steve Waterman wrote: >System: Debian unstable >Kernel: 2.6.11, custom >Mailscanner version: 4.40.11-1 >CPU: Intel Pentium III (Katmai) stepping 02, 450 Mhz >Memory: 512 MB >Filesystem: EXT3 >Perl: revision 5 version 8 subversion 4 Characteristics of this binary >(from libperl): > Compile-time options: MULTIPLICITY USE_ITHREADS USE_LARGE_FILES >PERL_IMPLICIT_ CONTEXT > Built under linux > Compiled at Mar 8 2005 19:51:48 > @INC: > /etc/perl > /usr/local/lib/perl/5.8.4 > /usr/local/share/perl/5.8.4 > /usr/lib/perl5 > /usr/share/perl5 > /usr/lib/perl/5.8 > /usr/share/perl/5.8 > /usr/local/lib/site_perl > >Apt-get sources are default and all updates have been applied 'apt-get >update' and 'apt-get upgrade'. > >Problem: > >When running the command 'MailScanner check' or >'/etc/init.d/MailScanner start' I receive the following error: > >Cannot open config file check, No such file or directory at >/usr/share/MailScanner/MailScanner/Config.pm line 592. >Compilation failed in require at /usr/sbin/MailScanner line 65. >BEGIN failed--compilation aborted at /usr/sbin/MailScanner line 65. > >Line 592 in /usr/share/MailScanner/MailScanner/Config.pm refers to: > >$fh->open("<$filename") or die "Cannot open config file $filename, $!"; > >Line 65 in /usr/sbin/MailScanner refers to: > >use MailScanner::CustomConfig; > >I have removed MailScanner via 'apt-get remove mailscanner --purge', >re-installed, edited the maintainer's /etc/MailScanner/MailScanner.conf >file, saved the file and tried using my previous MailScanner.conf file >from my previous working config. > >The program did work correctly until the last 'apt-get upgrade'. As a >last resort, I have done an 'apt-get dist-upgrade' yet continue to >receive the same error message. > >Thank you! > >Steve > >------------------------ MailScanner list ------------------------ To >unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and the >archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From dnsadmin at 1BIGTHINK.COM Fri Apr 29 18:38:00 2005 From: dnsadmin at 1BIGTHINK.COM (DNSAdmin) Date: Thu Jan 12 21:29:26 2006 Subject: W32/MiMail.A Message-ID: At 11:50 AM 4/29/2005, you wrote: >MacOS X desktops ?? ;-) Still, run ClamXav!!! -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. http://www.sng.ecs.soton.ac.uk/mailscanner/ Configuration by Glenn Parsons dnsadmin-at-1bigthink.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Fri Apr 29 00:22:53 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:26 2006 Subject: false negatives Message-ID: Seems your Bayes is the problem. BAYES_00 means the probability of this message being spam because of its wording is quite low. You may want to regenerate your Bayes database. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Kevin Miller Sent: Thursday, April 28, 2005 4:26 PM To: MAILSCANNER@JISCMAIL.AC.UK Subject: false negatives I'm seeing a bit of spam slipping through that I'd have thought would get caught. It looks pretty spammy, and here's the SpamCheck results: X-CBJ-MailScanner-SpamCheck: not spam, SpamAssassin (score=2.309, required 5, BAYES_00 -4.90, DRUGS_ERECTILE 1.00, DRUGS_ERECTILE_OBFU 1.50, HTML_50_60 0.10, HTML_FONT_BIG 0.27, HTML_MESSAGE 0.10, MSGID_FROM_MTA_SHORT 3.03, PRIORITY_NO_NAME 1.21) This is just one example, I also see the odd mortgage pitch, or a 419 scam, etc. every now and then. Strange thing is, sometimes I'll see a spam message slipping through and an identical (but different recipient) one getting caught. Didn't think to compare the headers at the time though. Doh. On about all the stuff that slips throuhg I see the first test, BAYES_00 -4.90. Would this indicate that I'm suffering from a case of bayes poisoning? Should I dump the bayes database and start over using the starter kit on Fortress' site, or are there other, better options? TIA... ...Kevin -- Kevin Miller Registered Linux User No: 307357 CBJ MIS Dept. Network Systems Admin., Mail Admin. 155 South Seward Street ph: (907) 586-0242 Juneau, Alaska 99801 fax: (907 586-4500 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From derek at CSOLVE.NET Fri Apr 29 21:34:32 2005 From: derek at CSOLVE.NET (Derek Buttineau | Compu-SOLVE) Date: Thu Jan 12 21:29:26 2006 Subject: Whitelist > Blacklist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Good Day, Just upgraded to 4.40 and I see that this issue is still there. So I thought I'd clarify a bit of what I'm seeing, there's really only one scenario where this becomes an issue: - User has an individual address on their whitelist: username@domain.com - User has the domain on their blacklist: *@domain.com - System is configured to want SA headers What's happening currently is the message gets flagged as on the whitelist so the $iswhitelisted value gets set positive, but then it gets flagged as spam as well when it does the blacklist check. While not a huge issue, it becomes somewhat confusing to the end user. I've worked around it locally by just extending the if (!$iswhitelisted) check to include the blacklist check in Message.pm Regards, Derek Buttineau Internet Systems Developer Compu-SOLVE Internet Services Compu-SOLVE Technologies Inc. 705.725.1212 x255 Derek Buttineau | Compu-SOLVE wrote: > Hey, just thought I'd mention there seems to be a small bug with the > whitelist vs the blacklist in MailScanner 4.39.6. The blacklist is > being checked even if the sender is whitelisted (ie if a user is set to > have one specific address whitelisted and the remainder of the domain > blacklisted, both checks are being hit). I've found that I can correct > this, simply by wrapping the blacklist check in a (!$iswhitelisted) in > Message.pm. > > -- > Regards, > > Derek Buttineau > Internet Systems Developer > Compu-SOLVE Internet Services > Compu-SOLVE Technologies Inc. > > 705.725.1212 x255 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 29 22:01:14 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:26 2006 Subject: Whitelist > Blacklist Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Good idea. I have changed the "spamblacklist" check to only have an effect if it is not whitelisted. Hopefully this will work well. Derek Buttineau | Compu-SOLVE wrote: > Good Day, > > Just upgraded to 4.40 and I see that this issue is still there. So I > thought I'd clarify a bit of what I'm seeing, there's really only one > scenario where this becomes an issue: > > - User has an individual address on their whitelist: username@domain.com > - User has the domain on their blacklist: *@domain.com > - System is configured to want SA headers > > What's happening currently is the message gets flagged as on the > whitelist so the $iswhitelisted value gets set positive, but then it > gets flagged as spam as well when it does the blacklist check. While > not a huge issue, it becomes somewhat confusing to the end user. > > I've worked around it locally by just extending the if (!$iswhitelisted) > check to include the blacklist check in Message.pm > > Regards, > > Derek Buttineau > Internet Systems Developer > Compu-SOLVE Internet Services > Compu-SOLVE Technologies Inc. > > 705.725.1212 x255 > > > > Derek Buttineau | Compu-SOLVE wrote: > >> Hey, just thought I'd mention there seems to be a small bug with the >> whitelist vs the blacklist in MailScanner 4.39.6. The blacklist is >> being checked even if the sender is whitelisted (ie if a user is set to >> have one specific address whitelisted and the remainder of the domain >> blacklisted, both checks are being hit). I've found that I can correct >> this, simply by wrapping the blacklist check in a (!$iswhitelisted) in >> Message.pm. >> >> -- >> Regards, >> >> Derek Buttineau >> Internet Systems Developer >> Compu-SOLVE Internet Services >> Compu-SOLVE Technologies Inc. >> >> 705.725.1212 x255 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Fri Apr 29 22:05:02 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:26 2006 Subject: All mail treated as spam? Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Matt Kettler wrote: >Julian Field wrote: > > > >>As an extra point, you are using the bogus-virus-warnings SpamAssassin >>ruleset. As a result, any mail from me or from the MailScanner list is >>hitting rules such as VIRUS_WARNING62. >> >>You need to add >> >>score VIRUS_WARNING15 0 >>score VIRUS_WARNING28 0 >>score VIRUS_WARNING33 0 >>score VIRUS_WARNING62 0 >>score VIRUS_WARNING66 0 >>score VIRUS_WARNING226 0 >>score VIRUS_WARNING250 0 >>score VIRUS_WARNING300 0 >>score VIRUS_WARNING326 0 >>score VIRUS_WARNING339 0 >>score VIRUS_WARNING340 0 >> >>to your SpamAssassin configuration, so that mail from me does not get >>such a big score. >> >> > > >Julian, I'd revise that list. Really all he needs to disable is 62 to >get mail from you. The others might hit mail from this list quoting spam >reports, but some won't even do that. One doesn't even look to be >MailScanner related at all. > > ISS are our University computing services department, that is where the ISSWarning.txt comes from. So it's very relevant for me. I don't guarantee the list is quite up to date, I wrote it in a hurry a long time ago. >#This looks for a virus-scanning tool name in the From, including >MailScanner (ie: Julian's mail) >score VIRUS_WARNING62 0 > >#These are body rules and might hit posts on this list with people >quoting output from their MailScanner. >score VIRUS_WARNING28 0 >score VIRUS_WARNING33 0 >score VIRUS_WARNING226 0 >score VIRUS_WARNING250 0 >score VIRUS_WARNING300 0 >score VIRUS_WARNING326 0 >score VIRUS_WARNING340 0 > ># The following are header rules that won't hit mail from you or this >list, but will hit real virus warnings from MailScanner. Won't hit >quotes on the list. ># These are probably safe to keep on, unless you re-scan your postmaster >warning messages. ># subject mentions "email viruses detected" >score VIRUS_WARNING15 0 > #Any header contains "Found to be infected" >score VIRUS_WARNING66 0 > >#This one appears to have nothing to do with MailScanner at all: ># looks for body-text reference to ISSWarning.txt, probably not >MailScanner related despite description >score VIRUS_WARNING339 0 > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From Glenn.Steen at AP1.SE Fri Apr 29 09:36:30 2005 From: Glenn.Steen at AP1.SE (Steen, Glenn) Date: Thu Jan 12 21:29:27 2006 Subject: maillog logging level Message-ID: > -----Original Message----- > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Billy A. Pumphrey > Sent: den 28 april 2005 19:29 > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: maillog logging level > > > --- > NOTE: I am trying to cut some of the message because it is being > rejected looking like a script or something. > --- > > Ok :) > That worked, as in I sent a message to me from the sendmail > successfully > to my email address. > Now how do I test to see if it can/will receive email? As the URL got "linewrapped" to death last time....:-) Go to http://wiki.mailscanner.info Click on "index" at the bottom. click through: documentation->test_troubleshoot->mta->connexion to find a page that tells you (hopefully) how to use telnet (from other hosts) to verify that your MTA (sendmail) will accept messages and handle them as expected. I'm not a sendmail guru (Julian is though:-), but will be glad to help (if I can) to decipher any strange behaviour/log entries. -- Glenn (Ignore the "private message" that slightly conflicts with this one... That was from memory, this is from cut'n'paste:-):-) > Billy Pumphrey > IT Manager > Wooden & McLaughlin > > > -----Original Message----- > > From: MailScanner mailing list > [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > > Behalf Of Julian > Field > > Sent: Thursday, April 28, 2005 12:05 PM > > To: MAILSCANNER@JISCMAIL.AC.UK > > Subject: Re: maillog logging level > > > > I'm not sure the -v will actually help you, but the main things are > > 1) Put a blank line after the headers, before the body of > the message > > 2) End the message by putting a dot '.' on its own on a line. > > 3) Make sure you put proper email address in the From and To as you > are > > using -t so it gets the envelope addresses from the headers. > > > > So your message should look like > > To: craigh@ora.com > > From: craigh@ora.com > > Subject: Sendmail Test > > > > Ignore this test. > > . > > > > I think that should work rather better. If it doesn't > immediately give > > > you your shell prompt back after the "." line then press > Ctrl-D to end > > > the message. > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From alex at nkpanama.com Sat Apr 30 16:25:34 2005 From: alex at nkpanama.com (Alex Neuman van der Hans) Date: Thu Jan 12 21:29:27 2006 Subject: W32/MiMail.A Message-ID: A good ruleset on web traffic using squid or whatever also helps a lot... -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Rose, Bobby Sent: Friday, April 29, 2005 10:57 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: W32/MiMail.A Actually we do...at least here in house. AV on the desktop, AV on the mailbox servers (exchange), and AV on the email gateway. Been at this biz for along time. I'm still waiting for one to appear in the quarantine to see where it's coming from. Symantec just says it was detecting it in the smtp queue and the server that is reporting it is the one that all mail from the email (MailScanner) gateway uses to deliver mail into the exchange system. Yeh the AV is on the exchange servers is stopping it, but the mail gateway (MailScanner) also handles forwarding to other places outside my management control and I want to make sure that I'm not passing the problem onto someone else. Before I turned on quaranteening on Symantec, the last one came thru mentioned that the attachment "Mime.822" located in message.... That is kind of odd that the attachment is named that. I just wanted to send out a quick feeler to gauge others. -----Original Message----- From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On Behalf Of Martin Hepworth Sent: Friday, April 29, 2005 11:42 AM To: MAILSCANNER@JISCMAIL.AC.UK Subject: Re: W32/MiMail.A So the moral os this is.... you need virus proctection every windows desktop, because that's where the problem is. like I've been saying for years really ;-) -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Kevin Miller wrote: > Rose, Bobby wrote: > >> Is anyone else seeing this slip thru? The symantec stuff running on >>our exchange servers is picking it up but it slipping thru my current >>MailScanner and ClamAV configured email router. Symantec is saying >>that it found W32.Mimail.a@mm in Unknown0000000.data within >>message.html. Yesterday I added that to the banned filename types but >>it still came thru so I'm wondering if it's another funky mime/header >>issue. >> >>I'm running ClamAV .83 and Mailscanner 4.40.11 on Solaris 8. The >>clamav defs are up to date. I'm going to try to quarantine one to get >>a look at it. > > > Are you sure the messages are coming through your MailScanner gateway? > I had a similar problem a year or so ago where Trend would pick up > viruses on Exchange. Turned out that one of my users had pointed > their Outlook client at their home ISP so they could check non-local > mail account. The viruses waltzed right in with nary so much as a > 'howdy-do'. Fortunately, the bouncers from Trend took them in the > back alley and pummelled them before they could cause a ruckus... > > ...Kevin > -- > Kevin Miller Registered Linux User No: 307357 > CBJ MIS Dept. Network Systems Admin., Mail Admin. > 155 South Seward Street ph: (907) 586-0242 > Juneau, Alaska 99801 fax: (907 586-4500 > > ------------------------ MailScanner list ------------------------ To > unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and the > archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote confirms that this email message has been swept for the presence of computer viruses and is believed to be clean. ********************************************************************** ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From doc at MADDOC.NET Sat Apr 30 16:43:06 2005 From: doc at MADDOC.NET (Doc Schneider) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously thinking of adding MailScanner to the box that hosts them. Anyone else doing this and any "gotchas" you can pass along? Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am running 2.64 currently and doing some procmail magic to keep the spam down to a minimum. TIA, -Doc ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Sat Apr 30 16:52:32 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Doc Schneider > Sent: Saturday, April 30, 2005 11:43 AM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Mailman and MailScanner > > I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously > thinking of adding MailScanner to the box that hosts them. > > Anyone else doing this and any "gotchas" you can pass along? > > Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am > running 2.64 currently and doing some procmail magic to keep the spam > down to a minimum. > > TIA, > > -Doc We have a setup exactly like you are proposing. It works well with no real issues. My only concern would be capacity / loading but that is more of a Mailman issue. Our list server is a system mostly dedicated to running Mailman. It has no real mailboxes so the only email is junk and email destined for Mailman. This is a pretty light load for MailScanner and SpamAssassin. Hope this helps, Steve Steve Swaney President Fortress Systems Ltd. Phone: 202 338-1670 Cell: 202 352-3262 www.fsl.com steve.swaney@fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 16:56:42 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You may want to excempt mail coming from 127.0.0.1 from virus scanning. As long as the server itself isn't capable of generating viruses, then if incoming messages are clean then outgoing messages will also be clean. You can do this very simply with a 2-line ruleset applied to "Virus Scanning" and "Dangerous Content Checking" (or whatever I called it) and probably "Spam Checks" as well. The ruleset just needs to say From: 127.0.0.1 no FromOrTo: default yes Otherwise many people have done this, so others can probably give more advice if you need it. Doc Schneider wrote: > I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously > thinking of adding MailScanner to the box that hosts them. > > Anyone else doing this and any "gotchas" you can pass along? > > Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am > running 2.64 currently and doing some procmail magic to keep the spam > down to a minimum. > > TIA, > > -Doc > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 16:58:21 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] One more thing: use more than 1 virus scanner. A total failure in your incoming scanning will distribute viruses to your list subscribers. You should use 2 or 3 scanners so that they don't fail together. Stephen Swaney wrote: >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Doc Schneider >>Sent: Saturday, April 30, 2005 11:43 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Mailman and MailScanner >> >>I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously >>thinking of adding MailScanner to the box that hosts them. >> >>Anyone else doing this and any "gotchas" you can pass along? >> >>Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am >>running 2.64 currently and doing some procmail magic to keep the spam >>down to a minimum. >> >>TIA, >> >>-Doc >> >> > > >We have a setup exactly like you are proposing. It works well with no real >issues. > >My only concern would be capacity / loading but that is more of a Mailman >issue. Our list server is a system mostly dedicated to running Mailman. It >has no real mailboxes so the only email is junk and email destined for >Mailman. This is a pretty light load for MailScanner and SpamAssassin. > >Hope this helps, > >Steve > >Steve Swaney >President >Fortress Systems Ltd. >Phone: 202 338-1670 >Cell: 202 352-3262 >www.fsl.com >steve.swaney@fsl.com > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From doc at MADDOC.NET Sat Apr 30 17:02:29 2005 From: doc at MADDOC.NET (Doc Schneider) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stephen Swaney wrote: >>-----Original Message----- >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>Behalf Of Doc Schneider >>Sent: Saturday, April 30, 2005 11:43 AM >>To: MAILSCANNER@JISCMAIL.AC.UK >>Subject: Mailman and MailScanner >> >>I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously >>thinking of adding MailScanner to the box that hosts them. >> >>Anyone else doing this and any "gotchas" you can pass along? >> >>Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am >>running 2.64 currently and doing some procmail magic to keep the spam >>down to a minimum. >> >>TIA, >> >>-Doc > > > > We have a setup exactly like you are proposing. It works well with no real > issues. > > My only concern would be capacity / loading but that is more of a Mailman > issue. Our list server is a system mostly dedicated to running Mailman. It > has no real mailboxes so the only email is junk and email destined for > Mailman. This is a pretty light load for MailScanner and SpamAssassin. > > Hope this helps, > > Steve Steve, Yes that really helps a lot, thanks! And same thing here no mailboxes on the server. So guess I'll get to hopping and install MailScanner and see how it does. I was jusy a little leary of running it with all the list and having good list mail be tagged as spam. But this gives me a bit of encouragement to run this on it. BTW: I'm running MailScanner on my secondary MX box with SA 3.0.2 (need to upgrade that) and alls it does is catch spam. Works really well. MailScanner is one great piece of software. kudos to Julian! Thanks for the feedback, appreciate it. -Doc ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From doc at MADDOC.NET Sat Apr 30 17:05:59 2005 From: doc at MADDOC.NET (Doc Schneider) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian, All the lists are set to not allow attachments. I do that specifically to avoid sending virus payloads to unsuspecting list members. I'll, however, look into another virus scanner to use. Using ClamAV right now, any suggestions? Thanks, -Doc Julian Field wrote: > One more thing: use more than 1 virus scanner. A total failure in your > incoming scanning will distribute viruses to your list subscribers. You > should use 2 or 3 scanners so that they don't fail together. > > Stephen Swaney wrote: > >>> -----Original Message----- >>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>> Behalf Of Doc Schneider >>> Sent: Saturday, April 30, 2005 11:43 AM >>> To: MAILSCANNER@JISCMAIL.AC.UK >>> Subject: Mailman and MailScanner >>> >>> I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously >>> thinking of adding MailScanner to the box that hosts them. >>> >>> Anyone else doing this and any "gotchas" you can pass along? >>> >>> Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am >>> running 2.64 currently and doing some procmail magic to keep the spam >>> down to a minimum. >>> >>> TIA, >>> >>> -Doc >>> >>> >> >> >> We have a setup exactly like you are proposing. It works well with no >> real >> issues. >> >> My only concern would be capacity / loading but that is more of a Mailman >> issue. Our list server is a system mostly dedicated to running >> Mailman. It >> has no real mailboxes so the only email is junk and email destined for >> Mailman. This is a pretty light load for MailScanner and SpamAssassin. >> >> Hope this helps, >> >> Steve >> >> Steve Swaney >> President >> Fortress Systems Ltd. >> Phone: 202 338-1670 >> Cell: 202 352-3262 >> www.fsl.com >> steve.swaney@fsl.com >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 17:10:08 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] You don't need attachments to send viruses. Uuencoded data put in the middle of a message will be picked up by mail clients as readable files, without them being proper attachments at all. As a fine example the "MyParty" virus exploited this loophole to great effect at the time. Doc Schneider wrote: > Julian, > > All the lists are set to not allow attachments. I do that specifically > to avoid sending virus payloads to unsuspecting list members. I'll, > however, look into another virus scanner to use. Using ClamAV right now, > any suggestions? > > Thanks, > > -Doc > > > Julian Field wrote: > >> One more thing: use more than 1 virus scanner. A total failure in your >> incoming scanning will distribute viruses to your list subscribers. You >> should use 2 or 3 scanners so that they don't fail together. >> >> Stephen Swaney wrote: >> >>>> -----Original Message----- >>>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>>> Behalf Of Doc Schneider >>>> Sent: Saturday, April 30, 2005 11:43 AM >>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>> Subject: Mailman and MailScanner >>>> >>>> I run a lot of mailing lists here--using Mailman 2.1.4--and am >>>> seriously >>>> thinking of adding MailScanner to the box that hosts them. >>>> >>>> Anyone else doing this and any "gotchas" you can pass along? >>>> >>>> Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on >>>> it. Am >>>> running 2.64 currently and doing some procmail magic to keep the spam >>>> down to a minimum. >>>> >>>> TIA, >>>> >>>> -Doc >>>> >>>> >>> >>> >>> We have a setup exactly like you are proposing. It works well with no >>> real >>> issues. >>> >>> My only concern would be capacity / loading but that is more of a >>> Mailman >>> issue. Our list server is a system mostly dedicated to running >>> Mailman. It >>> has no real mailboxes so the only email is junk and email destined for >>> Mailman. This is a pretty light load for MailScanner and SpamAssassin. >>> >>> Hope this helps, >>> >>> Steve >>> >>> Steve Swaney >>> President >>> Fortress Systems Ltd. >>> Phone: 202 338-1670 >>> Cell: 202 352-3262 >>> www.fsl.com >>> steve.swaney@fsl.com >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >>> >>> >>> >> >> -- >> Julian Field >> www.MailScanner.info >> Buy the MailScanner book at www.MailScanner.info/store >> Professional Support Services at www.MailScanner.biz >> MailScanner thanks transtec Computers for their support >> >> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 17:18:48 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] The usual suggestions are BitDefender and F-Prot. Julian Field wrote: > You don't need attachments to send viruses. Uuencoded data put in the > middle of a message will be picked up by mail clients as readable files, > without them being proper attachments at all. > As a fine example the "MyParty" virus exploited this loophole to great > effect at the time. > > Doc Schneider wrote: > >> Julian, >> >> All the lists are set to not allow attachments. I do that specifically >> to avoid sending virus payloads to unsuspecting list members. I'll, >> however, look into another virus scanner to use. Using ClamAV right now, >> any suggestions? >> >> Thanks, >> >> -Doc >> >> >> Julian Field wrote: >> >>> One more thing: use more than 1 virus scanner. A total failure in your >>> incoming scanning will distribute viruses to your list subscribers. You >>> should use 2 or 3 scanners so that they don't fail together. >>> >>> Stephen Swaney wrote: >>> >>>>> -----Original Message----- >>>>> From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On >>>>> Behalf Of Doc Schneider >>>>> Sent: Saturday, April 30, 2005 11:43 AM >>>>> To: MAILSCANNER@JISCMAIL.AC.UK >>>>> Subject: Mailman and MailScanner >>>>> >>>>> I run a lot of mailing lists here--using Mailman 2.1.4--and am >>>>> seriously >>>>> thinking of adding MailScanner to the box that hosts them. >>>>> >>>>> Anyone else doing this and any "gotchas" you can pass along? >>>>> >>>>> Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on >>>>> it. Am >>>>> running 2.64 currently and doing some procmail magic to keep the spam >>>>> down to a minimum. >>>>> >>>>> TIA, >>>>> >>>>> -Doc >>>>> >>>>> >>>> >>>> >>>> We have a setup exactly like you are proposing. It works well with no >>>> real >>>> issues. >>>> >>>> My only concern would be capacity / loading but that is more of a >>>> Mailman >>>> issue. Our list server is a system mostly dedicated to running >>>> Mailman. It >>>> has no real mailboxes so the only email is junk and email destined for >>>> Mailman. This is a pretty light load for MailScanner and SpamAssassin. >>>> >>>> Hope this helps, >>>> >>>> Steve >>>> >>>> Steve Swaney >>>> President >>>> Fortress Systems Ltd. >>>> Phone: 202 338-1670 >>>> Cell: 202 352-3262 >>>> www.fsl.com >>>> steve.swaney@fsl.com >>>> >>>> ------------------------ MailScanner list ------------------------ >>>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>>> 'leave mailscanner' in the body of the email. >>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>>> >>>> Support MailScanner development - buy the book off the website! >>>> >>>> >>>> >>> >>> -- >>> Julian Field >>> www.MailScanner.info >>> Buy the MailScanner book at www.MailScanner.info/store >>> Professional Support Services at www.MailScanner.biz >>> MailScanner thanks transtec Computers for their support >>> >>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 >>> >>> ------------------------ MailScanner list ------------------------ >>> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >>> 'leave mailscanner' in the body of the email. >>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >>> >>> Support MailScanner development - buy the book off the website! >> >> >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Sat Apr 30 17:28:15 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:27 2006 Subject: ClamAV 0.84 released Message-ID: ClamAV 0.84 released http://www.clamav.net Notes Release Name: 0.84 Notes: 0.84 ---- This version improves detection of JPEG (MS04-028) based exploits, introduces support for TNEF files and new detection mechanisms. Various bugfixes (including problems with scanning of digest mail files) and improvements have been made. We encourage users to help testing the development versions, now with rewritten RAR code and support for 3.0 archives! Visit http://www.clamav.net/snapshot/ -) libclamav: + JPEG exploit detector now also checks embedded Photoshop thumbnail images + archive meta-data scanner (improves malware detection within encrypted archives) + support for TNEF (winmail.dat) decoding + support for all tar archive formats + MD5 implementation replaced with a slightly faster one + improved database reloading with reference counter + database updateable false positive eliminator + speed improvements + various bugfixes -) clamd: + VirusEvent now sets CLAM_VIRUSEVENT_FILENAME and CLAM_VIRUSEVENT_VIRUSNAME environment variables -) clamav-milter: + improved database update detection when not --external -) clamscan: + new options --include-dir and exclude-dir + new option --max-dir-recursion -) freshclam: + new directive LocalIPAddress -) contrib: + clamdmon 1.0 - clamdwatch replacement written in C -) 3rd party software: + hMailServer - open source e-mail server for Microsoft Window + pop3.proxy - proxy server for the POP3 protocol + HTTP Anti Virus Proxy + SmarterMail Filter - ClamAV based plugin for SmarterMail Mail Server + smf-clamd - small & fast virus filter for Sendmail + Squidclam - replacement for SquidClamAV-Redirector.py written in C + QtClamAVclient - remote clamd client based on the Qt Toolkit + qpsmtp - flexible smtpd daemon written in Perl Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 17:36:51 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: ClamAV 0.84 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Cool! I'm about to go out for an evening off, but hope that tomorrow I will build this into the ClamAV+SA tarball I make for you. I'm also planning on releasing the stable 4.41 tomorrow too. Assuming that it's the 1st May tomorrow (I've got a bit lost recently)... :-) Stephen Swaney wrote: >ClamAV 0.84 released >http://www.clamav.net > >Notes >Release Name: 0.84 > >Notes: >0.84 >---- > >This version improves detection of JPEG (MS04-028) based exploits, >introduces support for TNEF files and new detection mechanisms. Various >bugfixes (including problems with scanning of digest mail files) and >improvements have been made. >We encourage users to help testing the development versions, now with >rewritten RAR code and support for 3.0 archives! Visit >http://www.clamav.net/snapshot/ > >-) libclamav: > + JPEG exploit detector now also checks embedded Photoshop thumbnail >images > + archive meta-data scanner (improves malware detection within encrypted >archives) > + support for TNEF (winmail.dat) decoding > + support for all tar archive formats > + MD5 implementation replaced with a slightly faster one > + improved database reloading with reference counter > + database updateable false positive eliminator > + speed improvements > + various bugfixes >-) clamd: > + VirusEvent now sets CLAM_VIRUSEVENT_FILENAME and >CLAM_VIRUSEVENT_VIRUSNAME > environment variables >-) clamav-milter: > + improved database update detection when not --external >-) clamscan: > + new options --include-dir and exclude-dir > + new option --max-dir-recursion >-) freshclam: > + new directive LocalIPAddress >-) contrib: > + clamdmon 1.0 - clamdwatch replacement written in C >-) 3rd party software: > + hMailServer - open source e-mail server for Microsoft Window > + pop3.proxy - proxy server for the POP3 protocol > + HTTP Anti Virus Proxy > + SmarterMail Filter - ClamAV based plugin for SmarterMail Mail Server > + smf-clamd - small & fast virus filter for Sendmail > + Squidclam - replacement for SquidClamAV-Redirector.py written in C > + QtClamAVclient - remote clamd client based on the Qt Toolkit > + qpsmtp - flexible smtpd daemon written in Perl > >Steve > >Steve Swaney >President >Fortress Systems Ltd. >www.fsl.com >steve.swaney@fsl.com > >------------------------ MailScanner list ------------------------ >To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >'leave mailscanner' in the body of the email. >Before posting, read the Wiki (http://wiki.mailscanner.info/) and >the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > >Support MailScanner development - buy the book off the website! > > > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From steve.swaney at FSL.COM Sat Apr 30 18:05:44 2005 From: steve.swaney at FSL.COM (Stephen Swaney) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: > -----Original Message----- > From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > Behalf Of Doc Schneider > Sent: Saturday, April 30, 2005 12:02 PM > To: MAILSCANNER@JISCMAIL.AC.UK > Subject: Re: Mailman and MailScanner > > Stephen Swaney wrote: > >>-----Original Message----- > >>From: MailScanner mailing list [mailto:MAILSCANNER@JISCMAIL.AC.UK] On > >>Behalf Of Doc Schneider > >>Sent: Saturday, April 30, 2005 11:43 AM > >>To: MAILSCANNER@JISCMAIL.AC.UK > >>Subject: Mailman and MailScanner > >> > >>I run a lot of mailing lists here--using Mailman 2.1.4--and am seriously > >>thinking of adding MailScanner to the box that hosts them. > >> > >>Anyone else doing this and any "gotchas" you can pass along? > >> > >>Also going to be using the new Spamassassin 3.0.3 w/SQL bayes on it. Am > >>running 2.64 currently and doing some procmail magic to keep the spam > >>down to a minimum. > >> > >>TIA, > >> > >>-Doc > > > > > > > > We have a setup exactly like you are proposing. It works well with no > real > > issues. > > > > My only concern would be capacity / loading but that is more of a > Mailman > > issue. Our list server is a system mostly dedicated to running Mailman. > It > > has no real mailboxes so the only email is junk and email destined for > > Mailman. This is a pretty light load for MailScanner and SpamAssassin. > > > > Hope this helps, > > > > Steve > > Steve, > > Yes that really helps a lot, thanks! > > And same thing here no mailboxes on the server. So guess I'll get to > hopping and install MailScanner and see how it does. > > I was jusy a little leary of running it with all the list and having > good list mail be tagged as spam. But this gives me a bit of > encouragement to run this on it. > Just create a rule set for Use Spam Assassin = Form: 127.0.0.1 no FromOrTo: default yes Steve Steve Swaney President Fortress Systems Ltd. www.fsl.com steve.swaney@fsl.com > BTW: I'm running MailScanner on my secondary MX box with SA 3.0.2 (need > to upgrade that) and alls it does is catch spam. Works really well. > > MailScanner is one great piece of software. kudos to Julian! > > Thanks for the feedback, appreciate it. > > -Doc > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 18:07:10 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: ClamAV 0.84 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] It turns out I'm a bit early, so I have just updated the ClamAV+SpamAssassin installation package so it contains SpamAssassin 3.0.3 ClamAV 0.84 & all the modules they need to have installed. Using this package is enormously easier than installing everything by hand yourself, as there are a lot of dependencies on other perl modules. Julian Field wrote: > Cool! > I'm about to go out for an evening off, but hope that tomorrow I will > build this into the ClamAV+SA tarball I make for you. > > I'm also planning on releasing the stable 4.41 tomorrow too. Assuming > that it's the 1st May tomorrow (I've got a bit lost recently)... :-) > > Stephen Swaney wrote: > >> ClamAV 0.84 released >> http://www.clamav.net >> >> Notes >> Release Name: 0.84 >> >> Notes: >> 0.84 >> ---- >> >> This version improves detection of JPEG (MS04-028) based exploits, >> introduces support for TNEF files and new detection mechanisms. Various >> bugfixes (including problems with scanning of digest mail files) and >> improvements have been made. >> We encourage users to help testing the development versions, now with >> rewritten RAR code and support for 3.0 archives! Visit >> http://www.clamav.net/snapshot/ >> >> -) libclamav: >> + JPEG exploit detector now also checks embedded Photoshop thumbnail >> images >> + archive meta-data scanner (improves malware detection within >> encrypted >> archives) >> + support for TNEF (winmail.dat) decoding >> + support for all tar archive formats >> + MD5 implementation replaced with a slightly faster one >> + improved database reloading with reference counter >> + database updateable false positive eliminator >> + speed improvements >> + various bugfixes >> -) clamd: >> + VirusEvent now sets CLAM_VIRUSEVENT_FILENAME and >> CLAM_VIRUSEVENT_VIRUSNAME >> environment variables >> -) clamav-milter: >> + improved database update detection when not --external >> -) clamscan: >> + new options --include-dir and exclude-dir >> + new option --max-dir-recursion >> -) freshclam: >> + new directive LocalIPAddress >> -) contrib: >> + clamdmon 1.0 - clamdwatch replacement written in C >> -) 3rd party software: >> + hMailServer - open source e-mail server for Microsoft Window >> + pop3.proxy - proxy server for the POP3 protocol >> + HTTP Anti Virus Proxy >> + SmarterMail Filter - ClamAV based plugin for SmarterMail Mail >> Server >> + smf-clamd - small & fast virus filter for Sendmail >> + Squidclam - replacement for SquidClamAV-Redirector.py written in C >> + QtClamAVclient - remote clamd client based on the Qt Toolkit >> + qpsmtp - flexible smtpd daemon written in Perl >> >> Steve >> >> Steve Swaney >> President >> Fortress Systems Ltd. >> www.fsl.com >> steve.swaney@fsl.com >> >> ------------------------ MailScanner list ------------------------ >> To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: >> 'leave mailscanner' in the body of the email. >> Before posting, read the Wiki (http://wiki.mailscanner.info/) and >> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). >> >> Support MailScanner development - buy the book off the website! >> >> >> > > -- > Julian Field > www.MailScanner.info > Buy the MailScanner book at www.MailScanner.info/store > Professional Support Services at www.MailScanner.biz > MailScanner thanks transtec Computers for their support > > PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) and > the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > Support MailScanner development - buy the book off the website! > -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sat Apr 30 20:17:00 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:27 2006 Subject: Mailman and MailScanner Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Stephen Swaney wrote: Steve, Yes that really helps a lot, thanks! And same thing here no mailboxes on the server. So guess I'll get to hopping and install MailScanner and see how it does. I was jusy a little leary of running it with all the list and having good list mail be tagged as spam. But this gives me a bit of encouragement to run this on it. Just create a rule set for Use Spam Assassin = Form: 127.0.0.1 no FromOrTo: default yes Steve The other method if your Mailman box just looks after the lists and not relaying for other clients/ boxes is to set up a second MTA instance listening on 127.0.0.1 and point mailman to relay through it (Avoiding MailScanner on the out going side). After all the overhead with list management is not the single incoming message (Which you will scan for spam and viruses) but the exploded recipients, which you need to relay as quickly as possible. If this doesn't suit then a 'standard' MailScanner install will work fine but ruleset the spam scanning so not to spam scan the out going mail (As this is the time consuming and CPU intensive bit of what MS does. This is how I'm running mailman myself!). Depending on the number of lists and in turn number of recipients you may want to look at an MTA with a decent queue handler that can manage to relay by grouped domains in single SMTP sessions, for example. My 2p worth (If indeed valued that highly!). Drew -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 21:58:35 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: MailScanner ANNOUNCE: Stable 4.41 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Hi all. I have just released the latest stable release 4.41. The major changes this month are: - Solaris 10 support - AMD64 Fedora Core 3 support - * wildcards in phishing.safe.sites.conf - Improved support of deep RAR archives - Support for ClamAV 0.84 and SpamAssassin 3.0.3 in ClamAV+SA tarball - Several phishing net improvements Download it from www.mailscanner.info as usual. The full Change Log for this month is: * New Features and Improvements * - Improved install.sh to work on AMD64 Fedora Core 3 systems. - Added * wildcard support to phishing.safe.sites.conf, so you can list *.safedomain.com instead of having to list subdomains and other servers individually. Useful for listing your own domain. - Improved IPv6 support as sendmail on Linux adds "IPv6:" on the front of the IPv6 SMTP client address. - Improved support for \ characters in URLs in phishing net. - Better handling of subdirectories in RAR archives. - Duplicates removed in quarantine postmaster notice. - Added filetype entry to allow PostScript files. - Improved phishing net by adding detector for numeric IPs which do match but warn as they might be part of a fraud. - Added new entry to languages.conf which needs translating. - Improved phishing net to improve handling of numbered website references automatically inserted by some Unix text-only email clients. - Improved handling of ClamAV output when it scanned zero-length attachments. - Updated phishing net safe-sites list. - Added comment to MailScanner.conf about Maxium Archive Depth being a ruleset. - Changed default auto-whitelisting to "no". - Installation support for Solaris 10, in main ./install.sh and ClamAV-SA installation script. - Changed blacklisting so it doesn't override whitelisting if you always want to get the SpamAssassin results header. So if you whitelist an address@domain.com and blacklist *@domain.com, it works as you would expect it to. - Upgraded ClamAV+SA tarball to SpamAssassin 3.0.3 and ClamAV 0.84. * Fixes * - RAR archive handling: creation of directory only archive entries, both windows and *nix created archives (caused problems for SAVI). - RAR archive handling: possible false Encrypted file trigger on file names containing the word "Encrypted". - RAR archive handling: full path names used when extracting archived files, extracted to safe file name without out path. - Removed harmless error message when clearing out empty working directories at startup in debug mode. - Fixed problem where using rulesets to scan messages for dangerous content but not for viruses would cause the messages to be scanned by viruses anyway. - Fixed problem where filename/type checks were still being done on messages which had rulesets saying they should not do dangerous content checking. - Fixed problem in tar distribution install script where it would not correctly find the installed tnef expander binary. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner-announce' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 22:15:22 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: MailScanner ANNOUNCE: Stable 4.41 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Congratulations to the people at webspeed.dk and ngoweb.dk for downloading it within 1 minute of me posting the announcement to the mailing list! Julian Field wrote: > Hi all. > > I have just released the latest stable release 4.41. -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From drew at THEMARSHALLS.CO.UK Sat Apr 30 22:18:14 2005 From: drew at THEMARSHALLS.CO.UK (Drew Marshall) Date: Thu Jan 12 21:29:27 2006 Subject: MailScanner ANNOUNCE: Stable 4.41 released Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Julian Field wrote: Congratulations to the people at webspeed.dk and ngoweb.dk for downloading it within 1 minute of me posting the announcement to the mailing list! Blimey, speed by name speed by nature :-) -- In line with our policy, this message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From devonharding at gmail.com Sat Apr 30 22:58:07 2005 From: devonharding at gmail.com (Devon Harding) Date: Thu Jan 12 21:29:27 2006 Subject: ClamAV Perl module not found Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] No one knows how to fix this? On 4/27/05, Devon Harding wrote: Anyone? On 4/27/05, Devon Harding < devonharding@gmail.com> wrote: Did anyone ever fix this? I'm having the same issue. Here is the content of my /usr/lib/perl5 dir. drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.0 drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.1 drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.2 drwxr-xr-x 4 root root 4.0K Apr 26 18:47 5.8.3 drwxr-xr-x 3 root root 4.0K Apr 26 18:47 5.8.4 drwxr-xr-x 43 root root 4.0K Apr 26 18:47 5.8.5 drwxr-xr-x 8 root root 4.0K Apr 26 18:47 site_perl drwxr-xr-x 2 root root 4.0K Apr 27 02:03 Text drwxr-xr-x 8 root root 4.0K Apr 26 18:47 vendor_perl On 12/14/04, Mike Kercher < mike@camaross.net> wrote: Chris Trudeau wrote: > List, > > Installing ClamAV module via CPAN on machine running MailScanner > 4.36-4 stable. The install of the module goes fine, but when > starting MailScanner with Virus Scanners = clamavmodule the log > returns the message: > > ClamAV Perl module not found, did you install it? > > I verified using CPAN install that it is in fact installed and > uptodate. > > Any ideas? > > CT Do you have more than one version of perl installed? Mike ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the archives ( http://www.jiscmail.ac.uk/lists/mailscanner.html ). Support MailScanner development - buy the book off the website! ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website! From MailScanner at ecs.soton.ac.uk Sat Apr 30 23:16:43 2005 From: MailScanner at ecs.soton.ac.uk (Julian Field) Date: Thu Jan 12 21:29:27 2006 Subject: ClamAV Perl module not found Message-ID: [ The following text is in the "ISO-8859-1" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] Type "which perl". If it doesn't return "/usr/bin/perl" then you have installed the ClamAV module into 1 perl installation, which MailScanner is using a different one (/usr/bin/perl). Devon Harding wrote: > No one knows how to fix this? > > On 4/27/05, *Devon Harding* > wrote: > > Anyone? > > > On 4/27/05, *Devon Harding* < devonharding@gmail.com > > wrote: > > Did anyone ever fix this? I'm having the same issue. Here is > the content of my /usr/lib/perl5 dir. > > drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.0 > drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.1 > drwxr-xr-x 3 root root 4.0K Oct 12 2004 5.8.2 > drwxr-xr-x 4 root root 4.0K Apr 26 18:47 5.8.3 > drwxr-xr-x 3 root root 4.0K Apr 26 18:47 5.8.4 > drwxr-xr-x 43 root root 4.0K Apr 26 18:47 5.8.5 > drwxr-xr-x 8 root root 4.0K Apr 26 18:47 site_perl > drwxr-xr-x 2 root root 4.0K Apr 27 02:03 Text > drwxr-xr-x 8 root root 4.0K Apr 26 18:47 vendor_perl > > > On 12/14/04, *Mike Kercher* < mike@camaross.net > > wrote: > > Chris Trudeau wrote: >> List, >> >> Installing ClamAV module via CPAN on machine running > MailScanner >> 4.36-4 stable. The install of the module goes fine, but when >> starting MailScanner with Virus Scanners = clamavmodule > the log >> returns the message: >> >> ClamAV Perl module not found, did you install it? >> >> I verified using CPAN install that it is in fact > installed and >> uptodate. >> >> Any ideas? >> >> CT > > Do you have more than one version of perl installed? > > Mike > > ------------------------ MailScanner list > ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk > with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the MAQ > (http://www.mailscanner.biz/maq/) and > the archives ( > http://www.jiscmail.ac.uk/lists/mailscanner.html > ). > > Support MailScanner development - buy the book off the > website! > > > > > ------------------------ MailScanner list ------------------------ > To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: > 'leave mailscanner' in the body of the email. > Before posting, read the Wiki (http://wiki.mailscanner.info/) > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). > > *Support MailScanner development - buy the book off the website!* -- Julian Field www.MailScanner.info Buy the MailScanner book at www.MailScanner.info/store Professional Support Services at www.MailScanner.biz MailScanner thanks transtec Computers for their support PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 ------------------------ MailScanner list ------------------------ To unsubscribe, email jiscmail@jiscmail.ac.uk with the words: 'leave mailscanner' in the body of the email. Before posting, read the Wiki (http://wiki.mailscanner.info/) and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html). Support MailScanner development - buy the book off the website!